Neutral on banks as BNM seeks answers for services outage
The team at RHB Investment Bank Bhd (RHB Research) maintains its neutral call on the banking sector while Bank Negara Malaysia (BNM) is looking for answers from Malayan Banking Bhd (Maybank) and CIMB Holdings Bhd (CIMB) for their recent banking service outages.
BNM has required Maybank and CIMB to provide a full explanation on the cause for their recent banking service outages, as well as corrective and preventive measures to avoid the recurrence of such issues.
It also said that it expects banking institutions to maintain high availability of banking services at all times, and will not hesitate to take further supervisory action where banks have fallen short of its expectations.
“This was on the back of recent service disruptions,” RHB Research highlighted.
“Maybank said it had, at around 9.20pm on April 5, experienced disruptions to its debit card, online banking and ATM services. The issue hindered customers from making online payments and at retail outlets.
The affected services, however, were fully restored at 11.34pm the same day.
“Meanwhile, CIMB encountered intermittent disruptions to its CIMB Clicks, CIMB OCTO, FPX, MyDebit, credit transactions and self-service terminals services on April 8 and 9.
“All its services have since been restored, and CIMB said its core banking system and customer data remain secure and intact.”
While we await to see if BNM will take further action, RHB Research cited the recent experience in Singapore arising from digital banking service disruptions have seen banks having to hold higher regulatory capital and incur additional opex, albeit both of which were manageable.
“Taking a leaf from Monetary Authority of Singapore (MAS) actions, in recent years, Singaporean banks have experienced several disruptions to their banking services,” it underscored.
“While no IT system is perfect, MAS does require banks in SG to ensure that each critical system can be recovered within four hours; and the unscheduled downtime for each critical system does not exceed four hours within any 12-month period.”
To note, Singapore’s MAS has taken action against banks following repeated and prolonged disruptions to banking services, most recently on DBS.
On the back of various banking services disruptions, MAS took a action against DBS last year in the form of imposed additional capital requirements by raising the bank’s risk-weighted assets multiplier to 1.8 times for operational risk from the earlier regulatory action of 1.5 times.
“This impacted its CET-1 ratio by 30 basis points; and on November 1, 2023, DBS was further hit with a mandatory 6month pause on non-essential IT changes.
“During this time, it was also prohibited from acquiring new business ventures or reducing its Singapore branch and ATM networks. The key shortcomings DBS had identified were in technology risk governance, incident management, system resilience and change management.
“Key actions to address these issues include strengthening system resiliency and processes around change management, as well as enhancing its IT talent bench.
“DBS also set aside S$80 million (circa one per cent of 2023’s operating expenditure) for its technology uplift programme.”