Commonwealth Bank of Australia and subsidiary CommSec have been hit with $10.34 million in penalties — the highest ever imposed in enforcement action by the workplace regulator — after admitting it underpaid thousands of employees more than $16 million.