The Monetary Authority of Singapore (MAS) has imposed a six-month pause on DBS Bank Ltd’s (DBS Bank) non-essential information technology (IT) changes to ensure that the bank keeps sharp focus on restoring the resilience of its digital banking services.
During these six months, DBS Bank will not be allowed to acquire new business ventures or reduce the size of its branch and ATM networks in Singapore. The MAS action was taken following the repeated and prolonged disruptions of DBS’ banking services this year.
In April 2023, MAS had directed DBS Bank to engage an independent third-party to conduct a comprehensive review of the effectiveness and adequacy of the people, processes, and technology supporting its digital banking services. Shortcomings were identified in the following areas: system resilience; incident management; change management; technology risk governance and oversight.
Following the independent review, DBS Bank has set out a technology resiliency roadmap to address the shortcomings, improve system resilience, and better position the bank to meet future digital banking needs. The roadmap is being implemented in phases, with the changes affecting its system architecture design taking more time to complete.
MAS has reviewed DBS Bank’s remediation plan under the roadmap and is satisfied with its scope and the planned measures to improve system resilience.
In line with MAS’ expectations, DBS Bank will hold senior management accountable for the lapses and the Board will enhance its governance approach to oversee implementation of the roadmap.
For this six-month period, MAS has directed DBS Bank to suspend all changes to the bank’s IT systems except for those related to security, regulatory compliance, and risk management. This is to ensure that the bank dedicates the needed resources and attention to strengthen its technology risk management systems and controls. MAS will not approve any new business acquisitions by the bank during this period.
DBS Bank has been directed not to reduce the size of its branch and ATM networks during the six-month period. This is to ensure that there are adequate alternative channels for its customers in the event of further disruptions, while the bank works to enhance the operational resilience of its digital channels. This direction will be in force until MAS is satisfied with the progress of DBS Bank’s remediation plan.
At the end of the six-month period, MAS will review the progress made by DBS Bank on its remediation efforts. The Authority may extend the duration of the measures, vary the additional capital requirement currently imposed, or take further actions at that point.
In the meantime, MAS will retain the multiplier of 1.8 times to DBS Bank’s risk weighted assets for operational risk, which was imposed after the March and May 2023 incidents.
Also read: DBS Singapore digital banking disrupted… again; bank cites high traffic volume
It will take up to 24 months for DBS Bank to put in place the planned structural changes to improve the resilience of its digital banking services. In the meantime, it is possible that disruptions may still occur. In such situations, MAS expects DBS Bank to promptly recover its services and communicate to its customers in a clear and timely manner.
Ho Hern Shin, Deputy Managing Director (Financial Supervision), MAS, said, “DBS must put in place immediate measures to ensure service reliability while it continues to invest in the longer-term efforts to bolster its operational resilience. We have imposed this six-month pause on the bank to give it the space to take the actions needed to maintain customer trust.”
SGD1.6 billion additional capital requirement
In early May 2023, MAS had imposed on DBS Bank an additional capital requirement, following the widespread unavailability of DBS Bank’s digital banking services on March 29, 2023, and a subsequent disruption to its digital banking and ATM services on May 5, 2023.
Together with the additional capital requirement imposed on DBS in February 2022, this translated to approximately SGD1.6 billion in total additional regulatory capital.
The additional capital requirement on DBS Bank thus became a multiplier of 1.8 times to its risk weighted assets for operational risk, an increase from the multiplier of 1.5 times that MAS had applied in February 2022 following the November 2021 disruption.
Tech resilience plan includes DBS Bank India
In response to a query from Connected to India as to how — and if at all — the DBS Bank India operations might be impacted by the regulatory restrictions in Singapore, and whether DBS Bank India had a resilience plan of its own, a spokesperson said, “DBS is rolling out a comprehensive roadmap to improve technology resiliency, encompassing both immediate and longer-term measures to strengthen technology governance, people/leadership, systems and processes. This plan covers all capabilities in Singapore and will also include resilience initiatives across all our markets, wherever relevant, including India.
“The six-month pause is to limit changes to essential information technology requirements, which will, other than the resilience programme itself, cover security, regulatory and risk management related requirements. However, a substantial part of our technology capabilities for DBS Bank India has been on-shored over the past three years and is hence serviced and maintained by on-shore resources, both direct and indirect.
“Given this, while new business initiatives and some product enhancements may get impacted, the pause will have limited impact on DBS Bank India’s ability to continue servicing existing and new customers based on our existing suite of products and services.”