KUALA LUMPUR: Bank Negara Malaysia (BNM) has imposed administrative monetary penalties on Malayan Banking Bhd
(Maybank) and CIMB Bank Bhd for e-banking service outages that occurred in June and April, respectively.
In separate statements, the central bank said Maybank was fined RM4.32mil for the unplanned downtime while CIMB was fined RM760,000, on July 29.
“Between June 1, 2023 and May 31, 2024, Maybank’s Regional Mobile Banking Platform (RMBP) and MAE applications experienced multiple unplanned downtime that caused prolonged disruptions in several banking services interface with customers and counterparties. The duration of the disruption breached the thresholds specified in paragraph 10.32 of the Risk Management in Technology (RMiT) policy document,” Bank Negara said.
It said the investigation revealed that Maybank's failure to quickly recover from unexpected system disruptions caused significant problems with its online banking services for customers and partners.
It added that measures by Maybank to further strengthen its application and infrastructure resiliency as required by BNM were also incomplete at the time of the incidents which impeded recovery effects.
“Maybank has taken the necessary actions to close these gaps as part of its multi-year infrastructure investments to prevent future non-compliance,” Bank Negara said.
“BNM expects all financial institutions to maintain a high level of their technology resilience against operational disruptions to ensure the continuous availability of essential financial services. BNM will not hesitate to take appropriate supervisory and enforcement actions when financial institutions fall short of regulatory expectations,” it said.
Maybank paid the fine on Aug 8, 2024, while CIMB paid it on Aug 12, 2024.
Meanwhile, CIMB’s customers experienced prolonged service disruptions on April 8 and 9, 2024, affecting e-banking channels, automated teller machines (ATM), as well as debit cards and credit cards.
“The duration of these disruptions to CIMB’s services exceeded the thresholds specified by BNM. Upon investigation into the root cause leading to the incidents, it was found that CIMB’s non-compliance resulted from lapses in the execution of its response and recovery process to restore the disrupted systems promptly, which impacted the availability of essential banking services for its customers and counterparties,” Bank Negara.
It noted that CIMB has taken the necessary remediation actions, including enhancing its real-time IT infrastructure monitoring function to further improve its recovery capabilities and prevent future non-compliance.
In a statement, CIMB said it accepted Bank Negara’s decision and regrets the unplanned downtime to its critical systems, which impacted customers and counterparties in conducting their banking transactions.
“The bank has invested and will continue to invest in technology, systems and processes to strengthen its resilience and ensure that its critical customer infrastructure is able to serve and meet its customers’ needs at all times. Further, the Bank has strengthened its corrective and preventive measures to address service outages in a timely manner including adequate oversight of its third parties, while ensuring business continuity plans can be initiated immediately during critical times.
“CIMB places paramount priority on its obligations to customers and would like to thank them for their support. We will strengthen our resilience and appreciate the trust that all stakeholders have placed in us,” CIMB said.
Separately, Maybank has reiterated its commitment to enhancing customer experience and communication, ensuring that it abides by and adheres to all Bank Negara regulations regarding service uptime.
“Internal measures to further strengthen and monitor our systems are in place to ensure optimum performance. We greatly appreciate our customers continued support, patience and understanding,” Maybank said in a statement.
