Macquarie’s A$35m short-sale penalty traces nine system errors across fourteen years

A reporting system can process millions of securities transactions and still deliver the wrong signal to an entire market. Macquarie Securities (Australia) Limited admitted shortcomings that affected its daily short-sale disclosures for more than fourteen years; in March 2026 the Supreme Court of New South Wales ordered it to pay A$35 million and carry out a supervised compliance programme. The reported scale is striking: at least 73 million short sales incorrectly reported, with ASIC estimating the total affected population could be between 298 million and 1.5 billion. Those are not three equivalent counts, and the court's judgment supplies a still more important distinction between the long history of the errors and the legally defined contravention period.[1][2]

In the judgment of 13 March, Justice Nixon described the relevant operational period as 11 December 2009 to 14 February 2024, but specified that the contravening conduct covered by the declarations and orders ran from 14 May 2019 to 14 February 2024 because of limitation issues. The difference is almost a decade. It does not erase earlier operational failures, nor does it turn every report published since 2009 into a separately adjudicated statutory contravention. Distinguishing those periods is essential for a fair description of the court's decision.[1]

This investigation reconstructs how apparently small programming and workflow choices created inaccurate market data, why publicly quoted counts should not be converted into a fabricated error rate, and what the independent-expert order requires. The finding is about regulatory reporting systems at the named legal entity, not an allegation that all customers trading with Macquarie Group were misled or incurred quantifiable investment losses.[1][2][3]

Short-selling transparency is built from submissions

Australia introduced comprehensive short-sale reporting requirements after the global financial crisis. During the relevant period, market participants were required to report quantities of covered short sales of specified products to the relevant market operator, generally by the next trading day. The operators aggregated submissions into public reports. Regulators, investors and issuers could use those data to monitor sentiment, short-selling intensity and unusual market conditions. The resulting published total depends on each contributing intermediary supplying a correct component.[1][2]

The relevant Australian market operators included ASX and Cboe Australia. The judgment explains that MSAL submitted its reports through ASX and was not required to submit a separate report to Cboe for products traded only on Cboe because it did not undertake the relevant reportable transactions in those products. That detail is important when evaluating the errors: the fact that the firm operated across two trading environments does not mean it was sending the same short-sale report to two different regulators. The breakdown occurred in the generation and handling of the information to be reported.[1]

A covered short sale and a naked short sale are different legal categories. The reports in question addressed relevant covered short sales of reportable products, while naked short selling was generally prohibited apart from specified exceptions. None of the data errors in the judgment should be read as a finding that 73 million unlawful naked short sales occurred. Misreporting a lawful type of transaction may nonetheless undermine the transparency the disclosure rules were designed to create.[1]

Two code paths explain more than a headline number

One documented defect came from the way a reporting routine replayed trades across two market systems. Rather than processing principal trades from ASX and Cboe Australia in their actual chronological order, the logic replayed all ASX principal trades first and the Cboe transactions afterwards. The problem dated from the addition of the second venue in October 2011. A report built from misordered events can produce the wrong position or quantity even though individual trade records may be correct. The court traced the error to differences between formats, a coding defect, inadequate testing and deficient change management.[1]

The judgment says this issue was identified on 7 November 2022 and a tested change was implemented on 21 December. For a 32-trading-day subset, the court records about 2,819 inaccurate reports, 123 identified instances of wrong short-sale quantities, and 1,692,008 individual financial products incorrectly reported. Extrapolation from that subset suggested 107,133,518 to 149,055,330 incorrectly reported individual products attributable to this issue. Those product counts are expressly not a count of distinct trades, an important caveat for anyone trying to aggregate the underlying errors.[1]

Another defect involved the time of the data extraction. The system used an extract from approximately 5 p.m. even though later trades and amendments could appear in data available at 8 p.m. A report assembled before the complete trading-day dataset is available may systematically omit transactions arriving after the cut-off. That is an ordinary-sounding scheduling decision with an extraordinary potential consequence when applied every market day for years. The technical remedy is not simply faster hardware: the procedure needs a defined close of data, a reconciliation of late changes and repeatable checks after updates.[1]

These defects show why transaction reporting cannot be reduced to sending a file on time. The right schema and timely delivery matter, but data ordering, extraction completeness, product identifiers, reconciliation and exception handling are just as important. A participant might pass a superficial test that a CSV is syntactically valid while the contents diverge from its own execution ledger. The court's reasoning points to a much deeper test of completeness and accuracy across the entire processing path.[1]

The numbers have different levels of certainty

ASIC reported at least 73 million misreported short sales, with an estimated total range from 298 million to 1.5 billion over the historic period. The first count is a documented minimum; the wider range represents extrapolation where complete event-by-event reconstruction was not available in the same form. The range spans more than a factor of five. Reporting the upper endpoint as a confirmed 1.5 billion incorrect trades is therefore unwarranted. Treating 73 million as the entire final total would also be misleading.[1][2]

A simple original calculation demonstrates the relationship but not a statistical error rate. The minimum established count is about 24.5% of the lower estimate and approximately 4.9% of the upper estimate. These percentages describe how the verified minimum compares with the two possible total estimates; they are not proportions of all trades executed by the company. Without the full denominator of actual reportable events across the years and a reconciliation between transaction and individual-product units, no defensible percentage of trades misreported can be calculated.[1][2]

The case also involved other regulatory data omissions relating to orders, a separate reporting obligation. It would be incorrect to add a count of orders lacking fields to the count of short sales incorrectly reported as if each were a unique harmed customer. The same transaction could appear in more than one operational category. Reporting issues can overlap, so any total requires deduplication by source system, event ID, date and product definition. The court provides the legal finding; it does not provide an investor-loss ledger.[1]

The long operational period is also not interchangeable with the shorter legal period. The underlying errors began with the commencement of the short-sale reporting regime in December 2009, but the court's contravention declarations and penalty covered conduct from May 2019 under relevant limitation rules. Saying the company was formally penalised for every trading day since 2009 would ignore the judgment's explicit distinction. Conversely, reporting only 2019–24 without disclosing the prior error history would understate the operational lesson.[1]

The court separated system failure from deliberate deception

Macquarie had reported issues to ASIC after identifying them, beginning with a review launched in October 2022. In its December 2025 statement, Macquarie said it had remediated reporting deficiencies with additional controls, cooperated with the regulator and regarded the misleading conduct as unintentional. The judgment likewise recognised that the errors were not a case of known defects being deliberately ignored after discovery: the company began remediation when the issues were identified. That mitigates the inference of intentional deception but does not negate the admitted statutory contraventions or the market's reliance on accurate disclosures.[1][3]

The court found misleading or deceptive conduct in relation to the inaccurate reporting, inadequate risk management and deficiencies in relevant market-integrity systems and supervision. Those are actual court findings, not merely allegations in a claim form. They do not establish intentional market manipulation, that Macquarie shorted shares improperly, or that a specific investor lost a particular amount. A market-data quality failure can be serious because investors and regulators make decisions using the published numbers, even when a precise loss to an identified counterparty cannot be shown.[1][2]

The responsible entity was Macquarie Securities (Australia) Limited. Other Macquarie Group entities have their own licences and regulatory circumstances. Naming a parent or group in the background does not extend the court's declarations indiscriminately to every bank, asset manager or international affiliate carrying the Macquarie name. That entity boundary is especially important when discussing follow-on controls: the mandatory programme applies to the defendant specified in the court order.[1][3]

A$35 million is not the whole court-imposed workload

The court ordered a monetary penalty of A$35 million, comprising four specified components of A$8.75 million each, and required MSAL to pay ASIC's costs of A$1,545,485.17. The court-ordered monetary amounts therefore total A$36,545,485.17 before the company's own remediation and independent-assessment costs, which are not quantified in the judgment. This total is an arithmetic combination of a civil penalty and legal costs, not a larger civil fine or an estimate of investor compensation.[1]

The compliance programme extends beyond paying the penalty. Within 18 months of the orders, unless the parties agree otherwise in writing, the company must complete a review and implement changes to governance, systems, controls, policies and procedures designed to prevent similar breaches. It must notify ASIC shortly after implementation, appoint an ASIC-approved independent expert, and respond to any recommendations in the expert's report through an agreed remediation process. These are legal obligations with identifiable stages, not a voluntary public-relations promise.[1]

For customers and other market participants, the distinction between a fine and future improvement matters. The money is paid once; the useful test is whether the reporting process can demonstrate durable accuracy across systems changes, late trading updates and multiple venues. The expert can examine design and control effectiveness in ways a public quarterly error count may not. However, the judgment does not mean this investigation has observed the completed expert review or validated the company's present systems. Nor does the programme guarantee that every future reporting file will be error-free.[1]

The audit that would test whether the lesson travelled

A future examination could reconcile reported short-sale quantities against independently sourced execution and positions data for randomly selected trading days, compare pre- and post-venue changes, and verify how trades amended after the initial nightly extraction are incorporated. It could also look at incident-detection lag: the difference between the day a processing error is introduced and the day a control catches it. The original record shows why that lag matters; several defects persisted for years before discovery. These are proposed tests, not a claim that the reporter ran live Macquarie reconciliation scripts.[1]

The more general industry issue is that data often pass through many seemingly reliable layers before becoming an official statistic. Exchange reports, aggregated dashboards and investor screeners may inherit the same upstream discrepancy without any visible software crash. A file can arrive on time, be accepted by a portal and populate a chart while still being wrong. Operational resilience therefore includes correct *meaning*, not merely uptime and punctual message delivery.[1][2]

The court did not need to find deliberate fraud or assign a precise loss to each market user to impose a major penalty. Its judgment supplies a well-documented mechanism, a legally bounded contravention period and a monitored remediation route. The original conclusion is that the largest figure alone is the least useful way to understand the event. The actionable story is how sequential trade replay, stale extraction times and missing reconciliation can distort official short-sale information over years—and how a court has compelled a broker to prove those pipelines can be trusted.[1][2][3]

Report an error or submit an update