Recent Interruption of Digital Banking Services and Affected Customers

Since July 2021, four major retail banks1 have reported a total number of eight interruptions to their digital banking services. The incidents were mostly resolved within three hours. They affected, on average, about 12,000 customers, with the numbers ranging from 500 to 37,000. The longest interruption of 39 hours was experienced by DBS Bank from 23 to 25 November 2021, arising from a malfunction of the bank's access control servers.

The root causes of these incidents lay mainly within the banks themselves, such as software misconfigurations, system malfunctions and errors that were introduced when the banks were making system changes. One of the incidents was related to an outage in a third-party cloud service provider.

MAS takes seriously all IT incidents that affect the availability of digital banking services. It requires banks to be able to recover systems supporting critical banking services, such as fund transfers and payments services, within four hours following any disruption. In addition, the total unscheduled downtime for each critical system must not exceed four hours within any 12-month period. MAS takes supervisory action when the banks breach these requirements.

In the case of the prolonged interruption in DBS Bank's digital banking services in November 2021, MAS directed the bank to appoint an independent expert to conduct a comprehensive review of the incident, including the bank's controls and recovery actions and how a similar incident can be prevented in future. The bank has also been directed to rectify all shortcomings identified from the review and implement measures to ensure that any future disruption to its digital banking services is resolved quickly and adequately. MAS has required the bank to hold additional capital2 until all shortcomings identified from the review are satisfactorily rectified.

The recent incidents highlight the need for banks to continually review their IT resilience strategy and ensure that there is sufficient redundancy and fault tolerance built into their digital banking IT infrastructure. In addition, swift diagnosis and recovery of systems, coupled with robust business continuity management, are critical in minimising the impact of an IT disruption.

MAS has recently published a set of new Business Continuity Management Guidelines (BCMG)3 that set out measures that financial institutions can employ to sustain critical business services and to minimise service disruption. They include identifying the end-to-end dependencies across business processes, systems, manpower and other resources required to deliver critical business services and addressing any gaps that could hinder the effective recovery of these services during an outage.

Globally, financial institutions are increasingly relying on third-party services, such as public cloud computing. This increases financial institutions' exposure to third-party risks. MAS has highlighted third-party risks as one of the key areas for financial institutions to focus on in both BCMG and the Technology Risk Management Guidelines (TRMG)4.

MAS has been working closely with the industry, global financial regulators and leading service providers, on best practices to manage third-party risks.

One, MAS has collaborated with the Association of Banks in Singapore (ABS) to issue guidelines on sound cloud computing practices5. It has also issued an advisory on managing the risks of using public cloud computing services.

Two, MAS has been co-leading an international subgroup on cloud monitoring and identity and access management under the Bank for International Settlements (BIS).

The technology landscape that banks operate in is becoming more complex. It is, hence, critical that banks continually maintain and uplift the security and resiliency of their IT systems so as to maintain stability and trust in the banking system. MAS will continue to work closely with the industry in this regard.