Banks unfazed by new outage reporting regime

Australia’s major banks have slipped easily into the central bank’s newest outage reporting regime, introduced in April to improve the resilience of the nation’s retail payments system.

The new regime updated a five-year-old set of requirements for only high-value, real-time gross settlements to include low-value retail payments as well.

It required retail payments providers ­to report all "significant incidents" affecting ATM, EFTPOS, credit and debit card, online and phone banking systems to the Reserve Bank of Australia (RBA).

The RBA planned to collect feedback on the scope of the new requirements, which it said were developed in consultation with “all four major banks”.

Spokespeople from Suncorp, ANZ and NAB noted no major changes as a result of the revised regime, describing it as just one of several incident reporting processes that have existed for some time.

Under the previous high-value regime, Suncorp Bank submitted an average of less than one outage report to the Reserve Bank each year.

Paul Evans, Suncorp Bank executive manager of channel development, said it had reported three incident reports since February 2012 under the new regime.

"In each case they were incidents remediated within a few hours and at the lower-end of the impact scale rather than an entire payment system, geography or customer segment," Evans told iTnews.

"The introduction of the new regime introduced deeper, more granular reporting encompassing impactful events of a smaller scale."

Evans said Suncorp fully supported the new regime, and that the regime "reinforced and enhanced" existing Suncorp procedures, with no new systems or staff required.

ANZ also viewed the regime as “reasonable”, given that outages were typically high-profile events and the bank already reported the required information internally.

In the seven months since the regime's introduction, ANZ was required to report only one incident to the Reserve Bank, last month.

ANZ’s ATMs, EFTPOS, phone and internet banking systems suffered a half-hour outage and intermittent issues between 1pm and 2.30pm on October 16.

Representatives from NAB, the Commonwealth Bank and Westpac declined to disclose incident numbers although NAB suffered a five-hour-long phone and internet banking outage in September.

“We don't disclose incident numbers,” a NAB spokesman said, pointing to its recent annual report, which noted a 28 percent drop in IT outages compared to the 2010-11 financial year.

“NAB has adopted the new reporting requirements and incorporated them into our existing, standardised incident procedures. No new staff were required.

“Effort by the industry or regulators in advocating for customers aligns with NAB's fair value promise.”

The Reserve Bank defined significant incidents as those that disrupted customer access, normal settlement and clearing activity, required business continuity or disaster recovery arrangements, or received “substantial media coverage”.

Retail issues were to be reported to the Reserve Bank Information and Transfer System (RITS) Help Desk within an hour, with updates every one to two hours and a final, written report submitted within four weeks.

The Reserve Bank planned to share the reports with regulator APRA, which has previously urged banks to continue work on the resilience and availability of systems despite cost pressures.

It also was considering requiring retail payment providers to submit periodic statistical reports in addition to incident reports and whether the regime should be supplemented with other “additional measures”.