MAS bans DBS from new businesses ventures for 6 months following disruptions

The Monetary Authority of Singapore (MAS) has imposed a six-month pause on DBS Bank's non-essential IT changes to ensure that the bank keeps sharp focus on restoring the resilience of its digital banking services. DBS Bank will also not be allowed to acquire new business ventures during this period or reduce the size of its branch and ATM networks in Singapore, according to MAS. This comes after "repeated and prolonged" disruptions of DBS’ banking services this year.

In April this year, MAS directed DBS Bank to engage an independent third-party to conduct a comprehensive review of the effectiveness and adequacy of the people, processes, and technology supporting its digital banking services.

It found shortcomings in its system resilience, incident management, change management and in its technology risk governance and oversight.

Don't miss: DBS brand sentiments plummet (again) as customers face new disruptions

Following the review, DBS Bank came up with a technology resiliency roadmap to address the shortcomings, improve system resilience, and better position the bank to meet future digital banking needs.

These include the establishment of a new sub-committee of the Board Risk
Management Committee called the BRMC Technology Risk Committee (BTRC). The BTRC will provide dedicated oversight of technology risk. It will also oversee the implementation of the remedial measures that the bank will carry out, according to DBS.

Work has also commenced to establish clearer ownership and management of incidents within the bank, as well as between the bank and its service providers and vendors. 

The bank will establish a better protocol for vendor management and the use of third-party tools. Having a rigorous process to manage change and vendors is important as the bank uses microservices by multiple vendors, it said. 

The bank will also uplift its proactive problem management through the active review of early warning indicators, identification of other possibly affected areas, and taking preventive actions. This is in addition to ensuring that lessons learnt from prior incidents are shared with the rest of the organisation.

DBS is also reviewing the bank’s systems architecture for opportunities to provide additional resiliency and will ensure a high availability of critical services and disaster recovery. This includes identifying potential failure scenarios and possible remediation actions, such as a having a warm standby, or increased redundancy. A budget of SG$80 million has been allocated towards this.

MAS has reviewed DBS Bank’s remediation plan under the roadmap and is satisfied with its scope and the planned measures to improve system resilience, it said. In line with MAS’ expectations, DBS Bank will also hold senior management accountable for the lapses and the board will enhance its governance approach to oversee the implementation of the roadmap.

MAS has also directed DBS Bank to suspend all changes to the bank’s IT systems except for those related to security, regulatory compliance and risk management for this six-month period.  This is to ensure that the bank dedicates the needed resources and attention to strengthen its technology risk management systems and controls.

It will also not approve any new business acquisitions by the bank during this period and has directed the bank to not reduce the size of its branch and ATM networks. 

This is to ensure there are adequate alternative channels for its customers in the event of further disruptions while the bank works to enhance the operational resilience of its digital channels. This direction will be in force until MAS is satisfied with the progress of DBS Bank’s remediation plan.

In its statement, MAS explained that it would review the progress made by DBS Bank on its remediation efforts at the end of six months and that the duration of these measures may be extended at that point. Additional capital or further action can also be imposed at this juncture. 

In the meantime, MAS will retain the multiplier of 1.8 times to DBS Bank’s risk weighted assets for operational risk. It also acknowledged that in the meantime, it is possible that disruptions may still occur. In such situations, MAS expects DBS Bank to promptly recover its services and communicate to its customers in a clear and timely manner.

"The board apologises for the digital banking disruptions. When customers bank with us, they expect to be able to access our banking services conveniently, and at any time of the day," said DBS Chairman Peter Seah. "With the incidents of the past year, we have failed to live up to these expectations, and have also fallen short of our own standards. As an acknowledgement that the bank could have done better, senior management will be held accountable, and this will be reflected in their compensation.”

“Over the past few months, the bank has been making every effort possible to strengthen our resiliency and business continuity, and to be able to recover more quickly when incidents happen. This is a work in progress, and we seek customers’ patience as we work through our remedial actions,” he added.

DBS added that when the roadmap is completed, they will see improved service reliability.

This comes after a slew of outages by the bank over the last year. Most recently, in September, DBS PayNow's service was impacted with customers reporting delays in their FAST or PayNow transactions.

"We are aware that some of our customers faced a delay in their FAST and PayNow transactions earlier this afternoon. The issue was rectified at 4.30 pm," said DBS in a Facebook update at 6.02 pm on 27 September. 

"We would like to assure customers that their delayed transaction will be processed by today. We are sorry for the inconvenience caused," it continued at the time.

 However, the problem persisted and at 7.30 pm, DBS issued another update to see that it was continuing to see delays in processing FAST and PayNow transactions. It apologised to users and explained that it was working to resolve the issue and that updates on its progress would be provided.  

At 9.05 pm, DBS put out a final update saying that as of 7.40 pm, all FAST and PayNow services returned to normal.

"Please be assured that transactions that were affected by the delay are being processed. We will provide further updates on our progress in due course," it said. DBS went on to thank users for their patience and understanding. 

Shortly before then, on 5 May, DBS customers were unable to access internet and mobile banking, electronic payment, and ATM services.

While DBS fully restored affected services after six and a half hours, MAS stated publicly at the time that it regards this second disruption within a period of two months as unacceptable, and that DBS had fallen short of MAS’ expectations for banks to deliver reliable services to their customers. MAS was referencing an incident that happened days before where DBS PayLah users faced delays in receiving their cashback for a SG$3 meal subsidy initiative.

Related articles:
DBS Bank relinquishes majority stake in AXS to Tower Capital Asia
DBS' digital banking disruption caused by 'human error', according to preliminary investigations
MAS slaps DBS bank with additional capital requirement following "unacceptable" slew of outages