UK’s CMA Finds HSBC Failed to Share Payment Transaction Histories

The U.K.’s Competition and Markets Authority (CMA) has found that HSBC has breached an order that requires banks to send payment transaction histories to some customers.

Part 5 of the Retail Banking Market Investigation Order 2017 requires banks to send these histories to any business current account (BCA) customer with a turnover of less than £6.5 million (about $8.4 million) who closes their BCA, the CMA said in a letter notifying HSBC of its findings.

“HSBC failed to send an estimated 12,200 payment transaction histories to former BCA holders between February 2018, when Part 5 of the Order came into effect, and November 2022,” the CMA said in the letter. “This was due to weaknesses in its control environment and individual human errors amongst its staff. The weaknesses in controls also meant that HSBC is unable to determine exactly how many payment transaction histories it failed to send.”

Reached for comment by PYMNTS, a spokesperson for HSBC UK said in an emailed statement: “We are sorry some of our former customers did not receive their Payment Transaction Histories, required by the CMA, when they closed their Business Current Accounts. As soon as we discovered the issue, we took various steps to improve our processes in order to avoid this happening again.”

The CMA said on a page on its website devoted to the issue that HSBC has taken steps to end the breaches and to prevent a recurrence.

HSBC became aware of the breaches on Dec. 1, 2022, and notified the CMA of the breaches on Dec. 16, the CMA said in the letter, adding that it has reminded HSBC that the Order requires companies to notify the CMA of noncompliance within 14 days of their discovery of it.

The requirements of Part 5 of the Order were implemented to make it easier for small and medium-sized businesses (SMBs) to switch BCAs, according to the letter. Previously, SMBs had been concerned that they would lose access to their banking history — which they often need when seeking credit from lenders.

The steps HSBC is taking include reviewing its controls and procedures, providing reminders and additional coaching to staff, and introducing an enhanced assurance process, the letter said.

“Given the action that has been, and is being, taken by HSBC, the CMA does not consider it appropriate to take further formal enforcement action in relation to these breaches at present,” the CMA said in the letter. “However, the CMA will consider such action in the event of any further breaches.”

This letter comes about six months after the CMA found that HSBC breached another part of the Retail Banking Market Investigation Order 2017 by failing to publish required information or publishing inaccurate information.