The Monetary Authority of Singapore (MAS) has ordered DBS and Citibank to conduct a "thorough investigation" on why they were not able to fully recover their systems within the four-hour required timeframe during their respective outages on Oct. 14, 2023.

MAS added that it will take appropriate supervisory actions after gathering the necessary facts, according to a press release on Oct. 19.

What happened on Oct. 14, 2023

DBS and Citibank online banking and payment services went down from around 3pm on Oct. 14 and only went back to normal on Oct. 15 morning.

MAS stated on Oct. 15 that its preliminary investigations indicate that DBS and POSB's service disruptions were caused by an issue at a common data centre that is used by both banks, Equinix.

Equinix stated on that same day that there was a technical issue with their cooling system at one of their Singapore data centres which caused the temperature in the data centre to rise and in turn, impacted some customers' operations.

Banks are required to recover in four hours

On Oct. 20, 2023, MAS responded to media queries about the Oct. 14 DBS and Citibank outage and stated that it requires all banks to ensure that their critical systems and services to customers are resilient to disruption.

Banks are required to have in place backup data centres and systems and test them periodically to ensure that critical systems and services can be restored within four hours following an outage.

In addition, the unscheduled downtime for a critical system affecting a bank’s operations or service to customers must not exceed four hours within any 12-month period.

DBS and Citibank did not recover within required timeframe

MAS said that it does not have oversight of data centres.

However, it expects banks to establish contractual agreements with data centre providers that incorporate MAS’ requirements on system availability.

While both DBS and Citibank activated their backup data centres when their primary data centres failed to perform normally on Oct. 14, 2023, both banks were unable to fully recover their systems within the required four-hour timeframe, MAS stated.

As such, MAS has instructed both banks to conduct a thorough investigation into why they were not able to do so and will take appropriate supervisory actions after gathering the necessary facts.

Customers advised to carry cash and have alternative payment providers

MAS said: "No IT system is infallible. Banks and customers should have contingency measures in the event of service disruptions caused by IT outages."

It noted that the banks activated contingency measures such as extension of branch hours and alternative arrangements for credit card transactions, to reduce the impact on customers.

"Customers can benefit from having alternative payment providers and carrying some cash as a contingency," MAS stated.

"During this recent service disruption, many affected customers with alternative payment providers were able to switch to those or to using cash, minimising inconvenience."

Related stories

Top image from downdetector website and Google Maps