The Commonwealth Bank waited two years before admitting to the corporate watchdog that it had sold insurance protection on personal loans to 20,000 customers that they would not be able to claim on, the financial services royal commission heard on Monday.

It also admitted initially dragging the chain on reporting in 2015 when it told ASIC only 27,800 credit card customers were sold unusable credit card insurance.

This was despite an internal review finding the true figure was more than double, at 64,000. The higher figure was admitted later.

The bank had earlier admitted that insurance sold with credit cards was often going to people who were not eligible to claim on it because they were unemployed or were students.

The bank wrote to ASIC on May 15, 2015 saying it had identified that credit card customers had been sold unusable debt protection insurance because they were not working 20 hours or more a week and the situation was being investigated. However while internal documents had identified these problems existed in personal loans, the regulator was not advised until 2017.

“Two years after you understood the issue was first identified CBA formally notified ASIC,” counsel assisting Rowena Orr said to CBA executive Clive van Horen.

Mr van Horen’s admission of that spurred Commissioner Kenneth Hayne into action. “What am I to make of that?” he responded.

Taking it as a rhetorical question Mr van Horen replied: “Do you want me to answer that?”

“You are the person representing CBA in the witness box,” Commissioner Hayne said. “I want you to consider that it’s open to me to conclude that CBA swept the problem aside in the hope it would go away.”

“Our attention was on credit cards and we acted too slowly,” Mr van Horen replied.

Overall, CBA said it had sold inappropriate insurance to 140,000 customers and would move to repay $16 million to rectify the situation. To date it has repaid almost $10 million.

A total of 56,000 credit card customers were sold inappropriate insurance products and the bank dealt with rectifying this in different ways depending on circumstances.

Where the clients were students who were not eligible for the insurance protection, they were contacted and told they would be refunded. However where there were questions about whether they worked enough hours to be eligible the customers were dealt with “reactively”, the bank said.

This means they were sent a letter asking them to apply for recompense if they were eligible for it and these customers were far less likely to ask for compensation.

“CBA data shows approximately 30 per cent of [those contacted] take reactive action,” Ms Orr said.

“Correct,” Mr van Horen replied.

The bank also admitted selling inappropriate insurance to 10,000 home loan customers. They are expected to be refunded a total of $568,000, Mr van Horen said.

When the problems emerged, the bank reworked the wording used by branch and telephone staff to ensure that would-be customers were advised that if they worked less than 20 hours they would be ineligible. However it was not until two years later that a similar “knock out” clause was put in online loan application material.

Ms Orr drew the commission’s attention to CBA in-house material that admitted that changes in regulation to bring in four-day gap periods for credit and personal loan insurance would make the practice uneconomic and said this was why CBA had chosen to stop offering the products.

Mr van Horen conceded the bank’s actions were a “breach … of our obligations to act honestly, efficiently and fairly”.

CBA’s credit card insurance rip-off is eerily similar to the PPI scandal in the UK, where British banks were caught selling millions of pounds worth of insurance to customers who were self-employed or had pre-existing medical conditions, making them ineligible for coverage.