• Stay NEUTRAL with CIMB, AMMB, Hong Leong Bank, and Alliance Bank Malaysia as preferred picks. Bank Negara Malaysia (BNM) is looking for answers from Malayan Banking (Maybank) and CIMB for their recent banking service outages, and said that it will not hesitate to take action if the banks had fallen short of expectations. While we await to see if BNM will take further action, the recent experience in Singapore (SG) arising from digital banking service disruptions have seen banks having to hold higher regulatory capital and incur additional opex, albeit both of which were manageable.

• BNM seeks answers from Maybank and CIMB… BNM has required Maybank and CIMB to provide a full explanation on the cause for their recent banking service outages, as well as corrective and preventive measures to avoid the recurrence of such issues. It also said that it expects banking institutions to maintain high availability of banking services at all times, and will not hesitate to take further supervisory action where banks have fallen short of its expectations.

• …on the back of recent service disruptions. Maybank said it had, at around 9.20pm on 5 Apr, experienced disruptions to its debit card, online banking and ATM services. The issue hindered customers from making online payments and at retail outlets. The affected services, however, were fully restored at 11.34pm the same day. Meanwhile, CIMB encountered intermittent disruptions to its CIMB Clicks, CIMB OCTO, FPX, MyDebit, credit transactions and self-service terminals services on 8 and 9 Apr, according to The Edge. All its services have since been restored, and CIMB said its core banking system and customer data remain secure and intact.

• Taking a leaf from Monetary Authority of Singapore (MAS) actions. In recent years, the SG banks have experienced several disruptions to their banking services. While no IT system is perfect, MAS does require banks in SG to ensure that: i) Each critical system can be recovered within four hours; and ii) the unscheduled downtime for each critical system does not exceed four hours within any 12-month period. MAS has taken action against banks following repeated and prolonged disruptions to banking services, most recently on DBS (DBS SP, BUY, TP: SGD38.30).

• DBS case study. On the back of various banking services disruptions, MAS took the following actions last year against DBS: i) Imposed additional capital requirements by raising the bank’s risk-weighted assets multiplier to 1.8x for operational risk from the earlier regulatory action of 1.5x. This impacted its CET-1 ratio by 30bps; and ii) on 1 Nov 2023, DBS was further hit with a mandatory 6-month pause on non-essential IT changes. During this time, it was also prohibited from acquiring new business ventures or reducing its SG branch and ATM networks. The key shortcomings DBS had identified were in technology risk governance, incident management, system resilience and change management. Key actions to address these issues include strengthening system resiliency and processes around change management, as well as enhancing its IT talent bench. DBS also set aside SGD80m (c. 1% of 2023 opex) for its technology uplift programme.

Source: RHB Securities Research - 12 Apr 2024