Is there anything here we didn't already know?

Complacency and complexity, arrogant and insular, a culture that allowed bank executives to operate without fear of penalty. Strong words, indeed.

For all the searing criticism, the irony of the Australian Prudential Regulatory Authority's report into the ethical vacuum in which the Commonwealth Bank has operated is that it perpetuates the very climate it condemns.

Despite the litany of wrongdoings, APRA has imposed no real penalties.

Instead, the bank has been forced to put aside an extra $1 billion in reserves to cover the potential fallout from its misdeeds.

And, once again, we have a regulatory body delivering the legal equivalent of a slap with a wet lettuce.

Rather than fines or charges, the bank regulator instead has resorted to "enforceable undertakings", essentially exacting a promise from the CBA that it won't do this kind of thing ever again.

Unenforced undertakings

The only problem is no-one, it seems, pays the slightest attention to these "undertakings".

The corporate regulator, the Australian Securities and Investments Commission, has embraced "enforceable undertakings" as its weapon of choice for more than 15 years.

In fact, it signed one with the CBA just a fortnight ago, over the theft of $118 million from its own customers following its policy of deliberately charging for financial planning services it had no intention of delivering.

It signed another with the CBA and National Australia Bank in December 2016 over their involvement in rigging the foreign exchange market for five years until 2013. No executives were fined. No-one was called to account.

Even more memorably, ASIC signed "enforceable undertakings" with AMP back in 2006 for gouging its own clients, deliberately overcharging them.

Given recent revelations, it would appear there was little enforcement in the undertakings.

If anything has changed in the intervening 12 years, it is that fee gouging appears to have become entrenched, as the royal commission has highlighted.

Royal commission needs to look at regulators

It's possible APRA's decision to hold back on penalties is deliberate, to give the royal commission some space.

It's worth remembering the Federal Government called for the APRA inquiry primarily as a bid to stave off a royal commission following revelations CBA had failed on almost 54,000 occasions to comply with money laundering reporting rules.

As a result, we've had inquiries, regulators and now a royal commission tripping over each other in the maze of misdeeds committed by our financial institutions.

Many of the leads for the royal commission appear to have come from ASIC, and no doubt this latest report from APRA into our biggest bank will provide more useful ammunition.

At some stage, however, the commission will need to turn its gaze to the regulators.

The question that needs to be asked is why the rotten culture to which APRA refers — the "lack of accountability" the "complacency" and a "failure to provide oversight" — was allowed to fester.

APRA's report may well provide the answer. The CBA's dismissive attitude to regulators may well be sheeted home to regulators themselves and their failure to enforce the law.