Non-repudiation is a legal notion, and the Law is not context-free. From the restrictive, cryptographic view of things, a MAC shows that someone knowing the MAC key was involved at some point; but both the customer (you) and the bank technically "know" that key (you "know" it by virtue of it being embedded in your digipass token, while the bank server contains the same value in order to verify the value you enter). Therefore, the cryptographer says: the MAC won't help to prove things in case of litigation between the two key owners, you and the bank.
Judges and lawyers are not cryptographers, though. What they want is to make an holistic assessment of who is most probably the fraudster in that context. The bank server contains the secret, but that server might be located in a bunker with heavy access controls (video cameras, smart cards for sysadmin connections, hardware security modules...). The bank will try to give ample evidence that circumventing their own protection systems without leaving any track would cost them much more than the amount under litigation, thus making it highly implausible that they used the bank-known MAC key to compute the contested MAC value. But the MAC value exists -- so it must have been computed on the customer side.
It is all a matter of burden of proof and it highly depends on the country. When countries establish laws for "electronic signatures", they usually take great care not to be too specific about the technical elements involved in the process. Instead, they declare that there are "good systems" which have been duly certified under the control of a governmental body, or an accredited audit firm, to be "hard to subvert"; so that, in case of litigation, it will be up to the customer to find evidence that the signature is forged, rather than requiring proof from the bank that the signature is genuine. A lot of technical means can be employed to achieve this "certified good" status; cryptographic digital signatures (like RSA or DSA) are convenient for that, but they are neither strictly necessary or sufficient.
(If you read French, see how France does it.)
Another side of the problem is threats. This is the cornerstone of "signatures", the kind you do with a pen on a piece of paper. Such signatures can usually be counterfeited, much more easily than actually cracking open a digipass token or hacking into a bunkerized server. And, indeed, the bank necessarily contains in its vaults, somewhere, a reference model for your signature, so they could imitate it. Manuscript signatures still "work", legally speaking, because of the following twist: counterfeiting a signature, or, conversely, repudiating your own signature, is a severely punished criminal offence. Risking years of prison for a matter as trivial as a business transaction would be irrational.
