Banking’s balancing act with technology
Singaporeans’ reliance on cashless payments was evident during a recent service outage at DBS Bank on Oct 14. The incident left customers frustrated and inconvenienced, underscoring the challenges of transitioning to digital payment systems.
DBS Bank experienced five disruptions this year, leading the Monetary Authority of Singapore (MAS) to prohibit pursuing new business ventures for six months, starting from Nov 1. Additionally, the bank was instructed not to downsize its branches and ATM networks, and it was barred from making non-essential IT changes during this period to prioritise restoring its digital banking services.
This was not the first instance of MAS taking action on DBS. On May 5, the central bank imposed an additional capital requirement on DBS due to the widespread unavailability of its digital banking services on March 29, followed by disruptions to its digital banking and ATM services on May 5. The additional capital requirement was 1.8 times the bank’s risk-weighted assets (RWA) for operational risk, up from the 1.5 times multiplier applied in February 2022 following disruptions in November 2021.
Ravi Menon, managing director of MAS, has reportedly called the frequency of outages and DBS’s response time “unacceptable”. “The problem is that the largest bank in Singapore with the largest number of customers has had more than its fair share of outages,” he says.
DBS apologised for the digital disruptions on Nov 1, emphasising that the issues were being prioritised. The apology came two weeks after the bank revealed that the Oct 15 outage was caused by a technical error at an Equinix data centre used by DBS and Citibank, whose customers were also affected by service disruptions.
“This includes the rollout of a comprehensive roadmap to improve technology resiliency, encompassing both immediate and longer-term measures to strengthen technology governance, people and leadership, systems and processes,” said the bank in its Nov 1 statement. The bank promises “improved service reliability” at the end of the roadmap. “Should disruptions occur, the remediation measures being implemented will shorten the time taken for recovery,” adds DBS.
About 2.5 million payment and ATM transactions were affected during the DBS Bank and Citibank outages on Oct 14, said Minister of State for Trade and Industry Alvin Tan in Parliament on Nov 6.
Meanwhile, DBS chairman Peter Seah also apologised for not meeting customers’ expectations, adding: “As an acknowledgement that the bank could have done better, senior management will be held accountable, and this will be reflected in their compensation.”
He continues: “Over the past few months, the bank has been making every effort possible to strengthen our resiliency and business continuity and to be able to recover more quickly when incidents happen. This is a work in progress, and we seek customers’ patience as we work through our remedial actions.”
Balancing act
Companies of all sizes have leveraged technology to optimise their operations for many years. However, with the rapid progress of technology and the accessibility of different IT solutions, the extent to which organisations adopt technology can differ.
With cloud computing in the mainstream after years of active promotion by the vendors, touting factors such as flexibility in operating costs without compromising on reliability, banks like DBS have outsourced some of their data centre needs.
During the recent results briefing on Nov 6, when asked about the bank’s operations, CEO Piyush Gupta says many large organisations typically entrust their data centre operations to a select few specialised service providers in Singapore. These providers include companies like Singapore Telecommunications, ST Telemedia, M1, and Equinix, a global data centre operator with approximately 250 facilities worldwide.
The Oct 14 outage, adds Gupta, was the first suffered by DBS that was caused by a data centre problem. Previous breakdowns were because of other causes, such as software bugs.
With running data centres an increasingly complex business with new requirements such as going green, Gupta believes it is harder for individual companies to own and manage their data centres. The likes of Amazon, Google and Facebook farm out to leading providers, too, as they can run at 99.9999% operation. “It is an extraordinarily high level of resiliency,” he adds.
On its part, DBS chose to outsource the running of data centres 15 years ago. Equinix is a highest-tier data centre operator with supposedly multiple levels of redundancy. If DBS is to run its data centres, it is “very hard” to achieve the same level of resiliency. “So we have no plans to take on data centre management; I don’t think we’re very good at managing physical infrastructures, if you will,” he says.
‘Absolute control’
Conversely, Oversea-Chinese Banking Corporation (OCBC) and United Overseas Bank (UOB) chose to manage their own data centres. OCBC announced the opening of its new regional data centre in March 2018, while UOB revealed during its 3QFY2023 ended Sept 30 earnings briefing it had owned its regional data centre for about 20 years, and the bank is also constructing another one.
According to Praveen Raina, head of group operations and technology at OCBC, the bank’s choice to have a wholly-owned data centre was driven by the need for “absolute control over its security, design, and one that is completely tailored to the bank’s exact requirements and physical access.”
“It eliminates the risk of unavailability of space or capacity when needed and removes any risks associated with interdependency on other tenants’ activities, which is the case in shared facilities,” he adds. “We embarked on a four-year journey to develop our purpose-built data centre from the ground up, which became operational in 2017, being the first Singapore bank to do so.”
UOB also prioritised control and stability when acquiring its first data centre. “Technology, as you know, can break down [at any time], and we have to be prepared for it,” says Wee Ee Cheong, deputy chairman and CEO of UOB. “This is why... we centralise a lot of our technology. We don’t outsource [our systems] so that we are in better control of the situation.”
UOB’s CFO, Lee Wai Fai, stresses that the bank is focused on resiliency and security, so it runs its data centre and does its data processing in-house. When suggested that as a result, UOB is “slower to react”, Lee says: “We are a commercial bank looking at longterm stability”.
The bank takes it a step further by stress testing situations such as simulating cyberattacks on its systems and exploring recovery scenarios focused on restoring its systems in the quickest time possible and with minimal disruptions, he explains at the bank’s recent 3QFY2023 results briefing.
“This is why we ensure that our entire technology is standardised so we can replicate some of the best practices. We roll it out in Singapore and replicate it in the rest of the [markets we’re in]. The speed to market again is very important. We want to [work on] responsible innovations,” Wee adds.
Disruptions
OCBC and UOB have also faced disruptions. For instance, on Nov 7, some OCBC customers experienced issues using the bank’s app and PayNow service due to “intermittent slowness,” said the bank.
The lunchtime service disruption lasted about 2½ hours and was the latest in several separate digital banking disruptions or service outages.
In December 2021, 790 OCBC customers were targeted by SMS phishing scams in the last two weeks, resulting in a total loss of $13.5 million from their accounts, as reported by the bank on Jan 30, 2022. While clarifying that its systems were not compromised, OCBC announced on Jan 17, 2022, that it would provide “goodwill payouts” to the affected customers.
The central bank also imposed an additional capital requirement on
OCBC in May 2022 due to the deficiencies in the bank’s response to the phishing scams. The bank must apply a multiplier of 1.3 times its RWA for operational risk. The move translates to some additional $330 million in regulatory capital based on the bank’s financial statements as of March 31, 2022.
On Aug 28, OCBC faced a service disruption attributed to a “technical problem.” The incident affected the bank’s internet and mobile banking platforms, PayNow, ATMs, cards, and its digital business banking platform, Velocity. The disruption lasted approximately four hours, but OCBC assured that no customer data was compromised and customers’ funds remained secure.
UOB also faced intermittent service disruptions lasting several hours in February 2022. The bank later clarified that the disruption was not caused by a cyberattack or breach and reassured customers about the security of its systems. Susan Hwee, UOB’s head of group technology and operations, says there was no full outage at the time, and the bank has since “continued to strengthen [its] system resiliency for our digital banking services”.
Machine learning
Despite the technological challenges, the banks continue to invest in new technologies, with plans to adopt AI and machine learning as part of their digital strategies.
“The next phase of the digital core roadmap from 2023 to 2025 comes with an additional $300 million investment, with customer-led design and development as the focus,” says OCBC’s Raina.
This month, OCBC will offer all its 30,000 employees a generative AI chatbot to help in their writing and research. This chatbot, developed between OCBC and Microsoft’s Azure OpenAI, promises up to 50% productivity improvements and frees up employees’ time to do higher-value tasks and better service clients.
UOB aims to offer highly customised customer experiences with AI and machine learning. The bank’s upcoming $500 million global technology and innovation centre supports this goal at JTC’s Punggol Digital District, which is expected to be ready by the end of 2026.
“This new hub will further enhance the bank’s digital capabilities to drive and scale innovation, advancing UOB to be the most preferred bank for consumers and businesses in Asean,” says Hwee.
As it expands across the region, having a centralised platform allows for a more efficient roll-out of new digital offerings like UOB TMRW while adapting to diverse regulatory needs.
“This is how we were able to build our key digital platform, UOB TMRW, in 14 months and deploy it across Thailand and Indonesia in a few months,” she adds.