HSBC Bank Australia has agreed to pay a $35 million penalty after admitting to widespread failures that left customers vulnerable to scammers, in a landmark case brought by the Australian Securities and Investments Commission.