DBS Bank Hit with 6-Month IT Freeze by Singapore Regulator

Singapore's financial regulator, the Monetary Authority of Singapore (MAS), has imposed a six-month pause on DBS Bank Ltd's (DBS Bank) non-essential IT changes to ensure that the bank keeps sharp focus on restoring the resilience of its digital banking services. DBS Bank will not be allowed to acquire new business ventures during this period or reduce the size of its branch and ATM networks in Singapore.

Background

The actions were taken following the repeated and prolonged disruptions of DBS’ banking services this year. In April 2023, MAS directed DBS Bank to engage an independent third-party to conduct a comprehensive review of the effectiveness and adequacy of the people, processes, and technology supporting its digital banking services. Shortcomings were identified in the following areas: system resilience; incident management; change management; technology risk governance and oversight.

Technology Resiliency Roadmap

Following the independent review, DBS Bank has set out a technology resiliency roadmap to address the shortcomings, improve system resilience, and better position the bank to meet future digital banking needs. The roadmap is being implemented in phases, with the changes affecting its system architecture design taking more time to complete. MAS has reviewed DBS Banks remediation plan under the roadmap and is satisfied with its scope and the planned measures to improve system resilience.

Accountability and Governance

In line with MAS’ expectations, DBS Bank will hold senior management accountable for the lapses and the board will enhance its governance approach to oversee implementation of the roadmap. The financial regulator has directed DBS Bank to suspend all changes to the bank’s IT systems except for those related to security, regulatory compliance and risk management for a six-month period. This is to ensure that the bank dedicates the needed resources and attention to strengthen its technology risk management systems and controls.

Business Acquisitions and Branch Network

MAS will not approve any new business acquisitions by the bank during this period. MAS has also directed DBS Bank not to reduce the size of its branch and ATM networks. This is to ensure there are adequate alternative channels for its customers in the event of further disruptions while the bank works to enhance the operational resilience of its digital channels. This direction will be in force until MAS is satisfied with the progress of DBS Bank’s remediation plan.

MAS Review and Customer Communication

MAS will review the progress made by DBS Bank on its remediation efforts at the end of six months. MAS may extend the duration of the measures, vary the additional capital requirement currently imposed, or take further actions at that point. In the meantime, MAS will retain the multiplier of 1.8 times to DBS Bank’s risk weighted assets for operational risk, which was imposed after the March and May 2023 incidents. It will take up to 24 months for DBS Bank to put in place the planned structural changes to improve the resilience of its digital banking services. In the meantime, it is possible that disruptions may still occur. In such situations, MAS expects DBS Bank to promptly recover its services and communicate to its customers in a clear and timely manner.

MAS Deputy Managing Director's Statement

Ho Hern Shin, Deputy Managing Director Financial Supervision, MAS, said: "DBS must put in place immediate measures to ensure service reliability while it continues to invest in the longer-term efforts to bolster its operational resilience. We have imposed this six-month pause on the bank to give it the space to take the actions needed to maintain customer trust.”

The Monetary Authority of Singapore (MAS) has taken strong action against DBS Bank following repeated disruptions to its digital banking services. The six-month pause on non-essential IT changes, the suspension of new business acquisitions, and the restrictions on branch and ATM network reductions are aimed at ensuring that DBS Bank focuses on restoring the resilience of its digital banking services. MAS will review the progress made by DBS Bank at the end of six months and may extend the measures or take further actions if necessary. In the meantime, DBS Bank is expected to promptly recover its services and communicate with its customers in a clear and timely manner.