RBS hit with $102m fine for IT failures

The Royal Bank of Scotland has been issued £56 million (A$102 million) in fines over a botched software upgrade in 2012 that left more than six million customers unable to access online banking services or accurate account balances at ATMs.

The June 2012 IT glitch affected customers of the RBS and its NatWest and Ulster Bank subsidiaries, millions of whom were unable to make mortgage repayments, pay staff, finalise accounts, or were left stranded without access to funds in foreign countries for several weeks.

The issues stemmed from a botched software upgrade to the bank's overnight processing system.

When the bank's technology services team noticed problems with the upgrade, they decided to uninstall the update without testing the consequences of that action, and without realising the upgraded software was not compatible with the previous version, the bank revealed.

The UK's Financial Conduct Authority said the incident was not a result of a lack of investment in IT, noting RBS' £1 billion annual IT spend, but rather a lack of adequate systems and controls to identify and manage exposure to IT risks.

The FCA, along with the UK Prudential Authority, today announced they had subsequently fined the group a combined total of £56 million for the systems crash.

RBS was fined £42 million by the FCA, while the PRA slapped the group with a £14 million penalty.

"Properly functioning IT risk management systems and controls are an integral part of a firm's safety and soundness," the PRA said.

"The PRA considers that the IT incident could have threatened the safety and soundness of the banks and could have, in extremis, had adverse effects on the stability of the financial system in that it interfered with the provision of the banks' core banking functions, impacted third parties and risked disrupting the clearing system."

Ulster Bank was was given a separate fine of €3.5 million (A$5.1 million) by the Central Bank of Ireland earlier this month. 

RBS was able to access a 30 percent discount on the fines after agreeing to settle early - had it not, the fines would have exceeded £90 million.

The penalties add to the heavy financial burden the bank has been forced to face as a result of its IT issues, having already paid out more than £70 million in compensation to affected customers.

It has also spent £750 million since the June 2012 crash to rectify and improve its core IT systems - including on splitting out its overnight batch processing for each individual bank to ensure one outage would not affect another, and implementing a "mirror bank" to ensure customer transactions can continue to be processed during an outage.

"Our IT failure in the summer of 2012 revealed unacceptable weaknesses in our systems and caused significant stress for many of our customers," RBS chairman Philip Hampton said in a statement.

"As I did back then, I again want to apologise to all customers in the UK and Ireland that we let down two and a half years ago."

The bank plans to continue impoving its systems before the end of the year, including moving its externally-hosted mobile platform back in-house.