On May 5, 2023, customers of DBS Bank faced a major disruption to the bank’s digital banking services that lasted for more than six hours. Preliminary investigations revealed that the disruption was caused by human error in coding the program used for system maintenance.
Human Error
According to Senior Minister Tharman Shanmugaratnam in his written answer to a parliamentary question, the disruption to DBS’ digital banking services on May 5, 2023, was attributed to human error in coding the program responsible for system maintenance.
This error resulted in a significant reduction in system capacity, leading to difficulties in processing internet and mobile banking, electronic payment, and ATM transactions.
DBS initially described the disruption as a “systems issue” unrelated to a previous disruption in March.
MAS Takes Action: Strengthening Resilience
The Monetary Authority of Singapore (MAS) expressed its dissatisfaction with the second disruption within a two-month period. MAS emphasized the importance of delivering reliable services to customers and required retail banks to ensure the resilience of their mission-critical systems supporting digital banking.
In response to the May 5 disruption, MAS imposed an additional capital requirement on DBS, effective from May 6. This requirement aims to ensure that banks can recover quickly from system disruptions and continue serving their customers without significant interruptions.
Following the March disruption, DBS established a special committee to conduct a root cause investigation and review the bank’s IT resilience comprehensively.
However, after the May 5 incident, MAS mandated the committee to extend its review to cover the May disruption as well. Additionally, qualified independent third parties were engaged to assist in the review process.
Once the review is completed, DBS is expected to provide the public with more details regarding the disruptions and the measures taken to prevent similar incidents in the future.
Recap
DBS bank users across Singapore faced problems accessing the bank’s online banking services on 5 May before the service was resumed hours later, it was the latest service disruption since the outage on 29 March.
Following the latest service disruption, the Monetary Authority of Singapore (MAS) has increased the penalty on the bank that was imposed for a previous disruption, and ordered for a further review on the latest incident.
In a statement released by the MAS, they described the incident as falling short of their expectations for banks and said that it was unacceptable.
MAS’ statement
MAS Imposes Further Additional Capital Requirement on DBS Bank for Disruption of Banking Services
Singapore, 5 May 2023…
The Monetary Authority of Singapore (MAS) has imposed on DBS Bank Ltd (DBS Bank) an additional capital requirement, following the widespread unavailability of DBS Bank’s digital banking services on 29 March 2023 and a subsequent disruption to its digital banking and ATM services on 5 May 2023. Together with the additional capital requirement imposed on DBS in February 2022 , this translates to approximately S$1.6 billion in total additional regulatory capital.
- The additional capital requirement on DBS Bank is now a multiplier of 1.8 times to its risk weighted assets for operational risk, an increase from the multiplier of 1.5 times that MAS applied in February 2022 following the November 2021 disruption. MAS may subsequently vary the size of the multiplier depending on the outcome of ongoing reviews.
- After the March incident, DBS Bank had convened a Special Board Committee to oversee a full review of the bank’s IT resiliency, to be performed by an independent external expert. MAS had then directed DBS Bank to conduct a comprehensive review, including an assessment of the adequacy of management oversight, staff competencies, operational processes, system resiliency, and architecture design for its digital banking services. Although the causes of the March and May incidents appear distinct from each other, MAS has now required the review to cover the May incident as well.
- MAS has also required DBS Bank to take immediate steps to improve the resiliency and recoverability of its existing system, including enhanced monitoring, more comprehensive testing and additional system redundancies, in order to minimise disruption of its services to its customers.
- Ms Ho Hern Shin, Deputy Managing Director (Financial Supervision), MAS, said, “DBS Bank has fallen short of MAS’ expectations for banks to deliver reliable services to their customers. The repeated inconvenience caused to the public is unacceptable. The additional capital requirement imposed at this time underscores the seriousness with which MAS treats this matter. DBS Bank must spare no effort in dealing with the underlying issues leading to these disruptions.”