Alvin Tan on fixing DBS and Citibank digital banking disruptions on Oct 14

The impact of the disruption of digital banking services of DBS and Citibank on Oct 14 was “wide”, said Minister of State for Trade and Industry and Monetary Authority of Singapore (MAS) Board Member Alvin Tan. Up to 810,000 attempts to access the digital banking platforms of both banks are estimated to have failed between 2.54pm on Oct 14 and 4.47am on Oct 15. Approximately 2.5 million payment and ATM transactions could not be completed. DBS reopened its branches from 5.30pm to 9.30pm on Oct 14 to assist affected customers. Mr Tan, who gave this update in reply to MPs' questions in Parliament on Monday (Nov 6), said DBS and Citibank have fallen short of the requirements of MAS in ensuring that their critical IT systems are resilient against prolonged disruptions. He said that while both banks conducted annual exercises to test the recovery of the IT systems at the backup data centres, the specific issues that led to the delays in system recovery on Oct 14 did not surface during those tests. He stressed the need for accountability and remediation measures to uphold the reliability and recoverability of banking services. On accountability, Mr Tan said the fine quantum is consistent with existing local penalty regimes. Besides fines, MAS uses a range of regulatory tools to address lapses in risk management. Banks are also accountable to their customers but matters of compensation are better dealt with between the bank and its customers. As for remediation, MAS has instructed DBS and Citibank to conduct thorough investigations into the root causes of the incidents on Oct 14 and put in place measures to minimise future disruptions and outages, as well as strengthen the recoverability in the event of an outage. Mr Tan said MAS adopted a tougher stance against DBS because it experienced five disruptions to its banking services in the last eight months. To ensure that DBS keeps a sharp focus on restoring the resilience of its digital banking services, MAS has prohibited DBS from making non-essential changes or acquiring new business ventures for a six-month period. There must not be any distractions that take away the needed resources and attention by the bank to strengthen its technology risk management systems and controls, said Mr Tan. Another dimension of remediation has to do with data centres, which hold the IT systems of not just the banks but also other critical sectors. Mr Tan said the Government is studying ways to further strengthen the security and resilience of data centres where lapses could result in significant impact. Mr Tan said that while Singapore’s banking system is generally robust, customers must plan and prepare for contingencies, and can benefit from having alternative payment options and not be over-reliant on one provider for time-sensitive transactions. Mr Tan said the digitalisation of financial services has brought significant conveniences to the public. “While some disruption from time to time is unavoidable, we expect financial institutions to build and strengthen their capabilities to safely recover from any disruption within a reasonable period of time,” he said.