MAS orders DBS and Citibank to conduct probes after service outages, advises customers to keep cash on hand

SINGAPORE: In response to media queries, following a conspicuous absence of communication in the days after last Saturday’s service disruptions, the Monetary Authority of Singapore (MAS) shared on Thursday (19 Oct) that it has mandated an investigation into DBS Bank and Citibank.

This directive stems from the banks’ failures to comply with the prescribed system recovery protocols during the outages. MAS has affirmed its commitment to enacting appropriate supervisory measures, dependent on the findings from a thorough fact-finding inquiry.

Both banks’ customers experienced significant inconveniences, unable to access online and mobile banking services during the disruption that started last Saturday afternoon. The service anomaly was attributed to a technical glitch within the cooling system at a data centre, managed by Equinix, shared by both financial institutions.

According to Equinix, complications with the chilled water system occurred amidst a scheduled system enhancement, causing a surge in temperatures that impacted various equipment and operations. This technical snag resulted in a complete shutdown of online banking and payment services for DBS and Citibank from approximately 3 pm on Saturday until full restoration on Sunday morning, lasting over 12 hours.

While DBS reported a gradual restoration of services from 7 pm on Saturday, including corporate internet banking and ATM services, Citibank confirmed complete service normalization by Sunday morning.

An MAS representative stated, “Banks must guarantee the resilience of their critical systems and customer services against disruptions. This involves maintaining and periodically testing backup data centres and systems to ensure a maximum four-hour recovery time for critical services following an outage.”

MAS further emphasized that banks should not experience unscheduled downtime exceeding four hours within any 12-month period. Although the authority does not directly supervise data centres, it expects banks to incorporate these MAS stipulations into their contracts with data centre providers.

Notably, both banks activated their backup data centres in response to the primary systems’ failure last Saturday. However, MAS highlighted the institutions’ non-compliance with the mandated recovery timeframe.

Acknowledging the fallibility of IT systems, MAS reminded banks and customers to establish robust backup strategies for potential service interruptions. The authority commended the contingency steps taken, like extending branch operational hours and providing alternative credit card transaction methods.

“Customers are advised to consider options such as alternative payment providers and keeping cash on hand. During the recent service disruption, customers with alternative arrangements faced minimal inconvenience,” the MAS spokesperson added.

Singapore’s President, Mr. Tharman Shanmugaratnam, in his former capacity as the Chairman of MAS, had addressed similar system resilience concerns in April and July this year over the past two disruptions experienced by DBS. He emphasized that DBS had embarked on strategic enhancements to its digital banking system, underscoring the importance of robust access control, system redundancy, comprehensive monitoring, and efficient restoration processes.

However, despite these assurances, the recent incident underscores persistent gaps in the banks’ digital resilience strategies, raising questions about the efficacy of redundancy systems and preventative measures.