MAS orders DBS and Citibank to investigate extended outage; regulatory actions to follow

Following a prolonged disruption in critical financial services over the weekend, the Monetary Authority of Singapore has ordered DBS and Citibank to do an investigation.

MAS said on 19 October that any unscheduled downtime for a vital service affecting a bank’s operations or customer services must not exceed four hours within a 12-month period. Both banks failed to fully restore their systems within the given timeframe.

“MAS has instructed both banks to conduct a thorough investigation on why they were not able to do so, and will take appropriate supervisory actions after gathering the necessary facts,” said a spokesperson from MAS.

The service interruption on Saturday was attributed to a technical malfunction with the cooling system at a data centre jointly utilised by DBS and Citibank, as confirmed by data centre provider Equinix.

The issue occurred during a planned system upgrade that caused elevated temperatures in certain data centre halls, therefore impacting equipment and customer operations.

This incident led to the temporary suspension of DBS and Citibank online banking and payment services from 3 p.m. on Saturday. The full service restoration was on Sunday morning.

DBS’s services, including DBS/POSB digibank, DBS PayLah!, and ATM banking, were significantly affected. Citibank services, such as the use of Citi Credit Cards, PayNow, and investments via the Citi mobile app or Citibank Online, also faced disruptions.

A DBS spokesperson stated on Thursday that their services were progressively reinstated from 7 p.m. on Saturday, with corporate internet banking being restored shortly after 7 p.m., and most ATMs returning to operation by around 8:30 p.m.

“We have robust business recovery plans in place and have data centres islandwide. In this instance, the rapid overheating of the data centre triggered an abrupt shutdown of our systems, which delayed the full recovery process,” the spokesperson explained.

In a statement released on Wednesday, a Citibank spokesperson confirmed that all services had been fully reinstated by Sunday morning, adding, “all applications have now been recovered and functionalities tested, and we continue to engage with regulators as needed.”

“Citi places great importance on the resilience of our infrastructure, and we will use the lessons from this incident to continually improve. We extend our appreciation to our customers for their patience and understanding.”

MAS clarified that it does not directly oversee data centres but rather expects banks to establish contractual agreements with providers that adhere to its system availability requirements. The authority added that banks must ensure that their critical systems and services to customers are resilient to disruptions.

In addition to imposing limits on the duration of unscheduled downtime, banks are obligated to maintain backup data centres and systems, testing them periodically to ensure that critical services can be restored within four hours after an outage.

MAS acknowledged that both DBS and Citibank had activated their backup data centres when their primary data centres experienced issues on Saturday. However, they were unable to fully restore their systems within the specified timeframe.

Given the fallibility of IT systems, both banks and customers are advised to have contingency measures in place in case of service disruptions caused by IT outages.

“The banks activated contingency measures such as the extension of branch hours and alternative arrangements for credit card transactions, to reduce the impact on customers,” MAS stated.

“Customers can benefit from having alternative payment providers and carrying some cash as a contingency. During this recent service disruption, many affected customers with alternative payment providers were able to switch to those or to using cash, minimising inconvenience.”

More from OMY: Survey reveals shift in Singaporeans’ inflation expectations, DBS and SMU find