SINGAPORE: Around 2.5 million payment and ATM transactions could not be completed during last month’s DBS and Citibank service disruptions, Minister of State for Trade and Industry Alvin Tan said in parliament on Monday (Nov 6).
Up to 810,000 attempts to access the digital banking platforms of the two banks also failed between 2.54pm on Oct 14 and 4.47am the next day, said Mr Tan, describing the impact of the outage as “wide”.
DBS and Citibank’s online banking and payment services were disrupted, while DBS automated teller machines (ATMs) at several locations were down. The outage was caused by a “technical issue” with the cooling system at an Equinix data centre.
The temperature at the data centre rose above the optimal operating range, causing the information technology (IT) systems of both banks to shut down, Mr Tan said.
Related:
MAS penalties on DBS won’t set the bank back, analysts say
Mr Tan added DBS and Citibank immediately activated their IT disaster recovery and business continuity plans.
“However, both banks encountered technical issues which prevented them from fully recovering their affected systems at their respective backup data centres,” he said.
DBS was affected by a network misconfiguration and Citibank was affected by connectivity issues.
Services at DBS and Citibank were progressively restored from 8.21pm and 7.05pm respectively on Oct 14, but only fully recovered in the early hours of Oct 15.
DBS and Citibank fell short of the Monetary Authority of Singapore (MAS) requirements to ensure that critical IT systems are resilient against prolonged disruptions, Mr Tan said.
MAS requires banks to establish IT disaster recovery plans and test them regularly. Banks must conduct disaster recovery exercises with their backup data centres to check that critical systems and services can be restored within four hours of an outage.
Related:
'This is not supposed to happen': Experts on DBS, Citi outage caused by data centre failure
“While both banks conducted annual exercises to test the recovery of their IT systems at their backup data centres, the specific issues that led to the delays in system recovery on Oct 14 did not surface during those tests,” Mr Tan said.
PENALTIES IMPOSED ON DBS
Last week, MAS announced that DBS would not be allowed to make non-essential IT changes or acquire new business ventures for six months.
Analysts told CNA that they were unaware of upcoming acquisition plans for DBS. Mr Thilan Wickramasinghe, head of Singapore research at Maybank, said DBS was focused on integrating other businesses into the bank and likely has “limited appetite” for more mergers and acquisitions.
MAS also said DBS must maintain the size of its branch and ATM networks for now, and continue to apply a multiplier of 1.8 times to its risk-weighted assets for operational risk.
It was first instructed to do so in May. At that time, the multiplier of 1.8 times translated to around S$1.6 billion (US$1.2 billion) in additional regulatory capital, or money that must be set aside as a buffer.
A higher capital requirement can limit the bank’s ability to invest.
Watch:
Alvin Tan on fixing DBS and Citibank digital banking disruptions on Oct 14
“Holding additional regulatory capital comes with costs for the bank. It increases cost of capital, a key metric that drives business decisions such as dividends and investments,” said Mr Tan.
“It is a drag on the return on capital which could in turn impact credit ratings and stock price of the bank.”
TECHNOLOGY IS FALLIBLE
While financial institutions have to take prompt action in the event of an outage to reduce inconvenience to customers, users should also be prepared for disruptions, Mr Tan said.
“No IT system is infallible. Disruptions can occur for a variety of reasons and can happen without warning,” he said.
Related:
The Big Read: With no foolproof way to prevent banking and e-payment outages, what can businesses and consumers do?
During the Oct 14 outage, customers who were able to switch to alternative payment methods or providers, or had cash on hand were less affected, he said.
“While we want to be digital first (in) our approach to digitalisation, we cannot be digitally only,” said Mr Tan.
Additionally, consumers and businesses should be aware that some people may not be able to transition to digital payments smoothly.
“Some people may not be adept at technology, and banks and financial institutions, and in fact companies, service providers must acknowledge that, and must be able to provide other forms of payment approaches so that others who are not so adept can still participate in the economy,” he said.