The Business Times

MAS orders DBS to set aside S$930m more in regulatory capital over serious service failure

Bank suffered its worst digital disruption in a decade from Nov 23 to 25

Kelly Ng
Published Mon, Feb 7, 2022 · 08:28 PM

AS penalty for the widespread disruption of its digital banking services in November last year, DBS D05 : D05 0% now has to set aside about S$930 million in additional regulatory capital to guard against operational risks.

The Monetary Authority of Singapore (MAS) announced on Monday (Feb 7) that it has imposed an additional capital requirement on South-east Asia's largest bank, by requiring DBS to apply a multiplier of 1.5 times to its risk-weighted assets for operational risk. 

This amount, based off its reported financial statements as at Sep 30, 2021, is 4 times higher than the amount for a similar disruption DBS encountered in 2010, when MAS had applied a multiplier of 1.2 times to DBS’ operational risk weighted assets - equivalent to approximately S$230 million in additional regulatory capital.

MAS noted deficiencies in DBS' incident management and recovery procedures in restoring its digital banking services, resulting in the "prolonged duration" of the disruption, which is the bank's worst digital disruption in a decade.

The 2-day tech disruption from Nov 23 to Nov 25 last year left many customers unable to access online banking services. DBS said the disruption was due to a problem with its access control servers, but stressed that there was no cyberattack.

MAS has also directed DBS to appoint an independent expert to conduct a comprehensive review of the incident, including the bank's recovery actions. The review should also assess how a similar incident can be prevented in the future.

GET BT IN YOUR INBOX DAILY

Start and end each day with the latest news stories and analyses delivered straight to your inbox.

VIEW ALL

"DBS must rectify all shortcomings identified from the review and implement measures to ensure that any future disruption to its digital banking services is resolved quickly and adequately," MAS said. The additional capital requitement will be reviewed when it is satisfied that the bank has addressed the identified shortcomings.

MAS assistant managing director for banking and insurance Marcus Lim said: "MAS requires financial institutions to have robust controls and processes to ensure the reliability and resilience of their IT systems and the continuous delivery of essential financial services to their customers. MAS will take appropriate supervisory action against any financial institution that falls short of our regulatory expectations."

In response, DBS chief Piyush Gupta said: "In a digital era, customers rightly expect to have seamless and uninterrupted access to online banking services 24/7. This is something we take seriously. Since the November incident, DBS has taken a series of actions to improve the resilience of our services and incident response. These actions are but a starting point.

"Over the course of the next few months, together with an independent expert, we will continue to review our systems and processes to ensure that we do better going forward."

DBS said the penalty will have a 0.4 percentage-point impact on the group's capital ratios till remedial actions are completed. Inclusive of the capital impact arising from its acquisition of Citi's consumer banking business in Taiwan, DBS' pro-forma common equity tier 1 (CET-1) ratio as at Sep 30, 2021, would be 13.4 per cent. The pro-forma ratio is at the upper end of DBS's target CET-1 range and will have no impact on dividend policy, the bank said.

Observers' reactions to MAS' orders were mixed. Kevin Reed, chief information security officer at cyber protection company Acronis called for greater transparency in the review of the incident.

"While I welcome the call for an independent review, there may be room for improvement," Reed said, pointing to how tech companies typically provide "detailed technical post-mortems" after such service failures.

"My concern that such an independent expert's report will not be made public or will be redacted and the customers will just have to trust the necessary measures have been implemented," he said.

Jan Ondrus, associate professor of information systems at ESSEC Business School Asia-Pacific saw MAS' moves as a "symbolic reminder" for all stakeholders that the disruption was a "serious issue that needs to be addressed with most care". It is not likely to affect the bank's financials, he added.

"Beyond the amount of the additional capital requirements, the most important mission for DBS is to make sure that their IT systems and processes are upgraded in a way that would prevent such outages in the future," Ondrus said.

Varun Mittal, chief growth officer at insurer Singlife with Aviva said: "The overall intention of the regulator is to ensure consumer trust in the financial services industry, and they undertake any decisions which are relevant for that."

Nevertheless, Mittal is of the view that the industry is overall robust and "in good position" to retain and enhance consumer confidence and trust.

READ MORE:

KEYWORDS IN THIS ARTICLE

BT is now on Telegram!

For daily updates on weekdays and specially selected content for the weekend. Subscribe to  t.me/BizTimes

Banking & Finance

SUPPORT SOUTH-EAST ASIA'S LEADING FINANCIAL DAILY

Get the latest coverage and full access to all BT premium content.

SUBSCRIBE NOW

Browse corporate subscription here