MAS imposes 6-month freeze on DBS Bank’s IT changes due to repeated disruptions

SINGAPORE: The Monetary Authority of Singapore (MAS) has taken significant actions against DBS Bank Ltd (DBS Bank) in response to repeated and prolonged disruptions in its digital banking services this year.

To bolster the resilience of DBS Bank’s digital banking services, MAS released a statement on Wednesday (1 November) announcing a six-month moratorium on non-essential IT changes imposed on the bank.

This suspension includes restrictions on acquiring new business ventures and reducing the size of branch and ATM networks within Singapore.

These measures were initiated following a directive issued by MAS in April 2023, instructing DBS Bank to undergo an independent third-party review of its digital banking services.

The review identified shortcomings in areas such as system resilience, incident management, change management, and technology risk governance.

Subsequently, DBS Bank outlined a technology resiliency roadmap to address these deficiencies.

This roadmap is being implemented in phases, with a focus on improving system resilience. MAS said that it has reviewed and approved the scope and planned measures of this remediation plan.

Crucially, MAS has directed DBS Bank to suspend all changes to its IT systems, except for those related to security, regulatory compliance, and risk management, for the next six months.

This is to ensure that the bank dedicates its resources to strengthening technology risk management.

In addition to the IT changes freeze, MAS has instructed DBS Bank not to decrease the size of its branch and ATM networks to ensure customers have alternative channels during disruptions.

These directions will remain in effect until MAS is satisfied with the progress of the bank’s remediation plan.

This action comes in the wake of a significant service disruption at DBS on 14 October, during which online banking and payment services encountered substantial outages. Customers also encountered challenges in withdrawing cash from ATMs.

On 20 October, there was a brief disruption to its services which was due to a cooling issue at a data centre which implicated various other companies.

MAS Deputy Managing Director, Ms Ho Hern Shin, emphasized the importance of DBS Bank’s commitment to improving service reliability.

She stated, “DBS must put in place immediate measures to ensure service reliability while it continues to invest in the longer-term efforts to bolster its operational resilience. We have imposed this six-month pause on the bank to give it the space to take the actions needed to maintain customer trust.”

The timeline for DBS Bank to implement structural changes aimed at improving the resilience of its digital banking services is estimated to be up to 24 months.

During this period, MAS expects the bank to promptly recover its services and communicate clearly with customers in the event of disruptions.

MAS will review the progress made by DBS Bank in its remediation efforts at the end of the six-month pause and may take further actions or extend the measures as necessary.

Series of service disruptions plague DBS Bank, prompting MAS action

Previously, the bank faced a significant 6½-hour service interruption on 5 May due to human error, and a prolonged 12-hour disruption in March attributed to software bugs.

Singapore’s President, Mr Tharman Shanmugaratnam, in his former capacity as the Chairman of MAS, had addressed similar system resilience concerns in April and July this year over the past two disruptions experienced by DBS.

He emphasized that DBS had embarked on strategic enhancements to its digital banking system, underscoring the importance of robust access control, system redundancy, comprehensive monitoring, and efficient restoration processes.

However, despite these assurances, the recent incident underscores persistent gaps in the banks’ digital resilience strategies, raising questions about the efficacy of redundancy systems and preventative measures.