A tale of two outages: DBS, Singtel show market impact of regulatory response

SHARES of telecommunications company Singtel sank to a 52-week intraday low of S$2.28 on Monday (Nov 20), after Australian subsidiary Optus announced the stepping down of chief executive Kelly Bayer Rosmarin.

The stock ended the day at S$2.31, down 0.9 per cent or S$0.02, adding to two weeks of losses. The counter has fallen S$0.17 or 6.9 per cent since Nov 7. It lost 4.8 per cent of its value on Nov 8 alone. That was the day Optus experienced a network outage affecting 10 million customers across its mobile, broadband and landline services.

The outage resulted in disruption to critical services, such as hospitals and train services, and an uncomfortable senate hearing for Rosmarin on Nov 17.

Contrast that market response to how shareholders reacted after DBS experienced a major outage last month.

Singapore’s biggest bank has succumbed to a number of digital banking disruptions in recent months. On Oct 14, it reported its fifth digital banking disruption in eight months.

The damage was curtailed because Oct 14 happened to be a Saturday, but it was widespread – customers could not withdraw cash, transfer money or use their credit cards. Businesses were unable to accept certain forms of payment.

On Oct 16 – the first trading day after the outage – shares of the lender fell just 1 per cent to S$33.44. DBS shares are down a modest 4 per cent since the outage. They even briefly surpassed their pre-outage high after the bank released a solid set of results for the third quarter of the year.

Have Singtel shareholders over-reacted? Or are DBS shareholders overly optimistic?

Banking on regulatory pressure

Rosmarin’s recent resignation would suggest Singtel’s shareholders were right to be concerned from the get-go.

Australia’s authorities have had some strong words for the telco.

A day after the outage, Assistant Minister for Competition and Treasury Andrew Leigh urged affected customers to keep their receipts for transactions related to the outage.

It will be “a matter for Optus to make clear how it’s going to respond to those compensation claims”, he said.

Communications Minister Michelle Rowland said it was “reasonable” that customers should expect some compensation.

Part of Optus’ damage control has included giving free data and speed upgrades, and government investigations continue.

In Singapore, the Monetary Authority of Singapore (MAS) has also taken action in response to DBS’ recent outage.

The financial regulatory authority has barred the lender – for six months – from making non-essential IT changes, acquiring new business ventures, and reducing the number of its branches and size of its ATM network.

These curbs will hardly be crippling to DBS’ profits or plans, though.

At the bank’s earnings call on Nov 6, chief executive Piyush Gupta said DBS does not have new merger and acquisition or business venture plans. He added that the lender has also not closed any branches or ATMs in the past three years.

“What will have an impact is the deferral of new product and service launches currently in the pipeline,” he said. “The MAS directive gives us a six-month window to consolidate, which is actually a good thing.”

Comparisons trigger questions

Rosmarin’s resignation has triggered the natural question of whether Gupta should do the same.

Some might argue accountability goes all the way to the top. Those who take this line might even look beyond the CEO – to the company’s chairman.

Others might argue that it makes little sense to replace a veteran banker with a less experienced candidate.

Gupta has been DBS’ CEO since 2009, whereas Rosmarin was appointed to the top job in April 2020 (although she had been CEO-designate since December 2019).

A less obvious question – will Optus’ recent episode trigger comparisons of regulator reactions, and lead to a tougher stance on bank outages in future?

Australian regulators are known for their emphasis on consumer rights. When Optus was hit by a cyber breach in 2022, the government initially wanted the company to foot the cost of replacing the passports and drivers’ licences of some 2.1 million customers who had their personal information leaked.

This was later scrapped, but Canberra did introduce changes to its privacy act to increase the penalties for companies that experience major data breaches.

The maximum penalty – previously A$2.2 million (S$1.9 million) – is now either A$50 million, three times the value of the benefit obtained through the misuse of information, or 30 per cent of turnover in the relevant period, whichever is greater.

“We need better laws to regulate how companies manage the huge amount of data they collect, and bigger penalties to incentivise better behaviour,” Attorney-General Mark Dreyfus said then. “It’s not enough for a penalty for a major data breach to be seen as the cost of doing business.”

For its full year ended March 2023, Singtel incurred an exceptional loss of S$142 million in light of the data breach. It is also facing a class-action lawsuit in court as customers seek compensation from the company.

DBS has said it will hold senior management accountable for the lapses, with chairman Peter Seah adding that “this will be reflected in their compensation”.

Some lawmakers, however, have asked if more can be done.

Desmond Choo, Member of Parliament (MP) for Tampines GRC, suggested on Nov 6 that the curbs on DBS were “nothing short of a slap on the wrist”.

The restriction on acquiring new business ventures would not have an impact if there were none planned by the bank to begin with, he said.

West Coast GRC MP Ang Wei Neng asked if MAS would consider asking DBS to compensate businesses directly for the disruption, which could have a greater impact on the bank.

If there is greater public pressure in Singapore for punitive measures and regulatory action, shareholders may have to react differently to a bank’s outage next time.