Imagine not being able to make or receive payments off your account for three weeks (no benefits payment in or bill payments out). Imagine being a small business and not being able to lodge cash or cheques from your week’s takings. These were some of the problems that faced Ulster Bank’s Irish customers. They could not even go in and close their accounts and open up in another bank as there were no systems available to branch or call centre staff.

This state of affairs was caused because of a failure in the systems that ran Ulster Bank but which were also used by RBS and NatWest. These banks suffered outages as well but not as badly as Ulster Bank.

Root Cause

All over the world, banks have been getting bigger by acquisition and have been driving out cost savings by putting the acquired banks onto a common set of systems. This is true whether it is:

• The USA; JP Morgan Chase with banks such as JP Morgan, Bank One and Chase Manhattan Bank.
• Europe; Santander with Banesto and Abbey in the UK.
• The UK; with Lloyds TSB acquiring Halifax Bank of Scotland.

The logic of economies of scale is inexorable. By having one set of systems for multiple brands, countries, jurisdictions, and legal entities banks can:

• Reduce infrastructure costs by reducing the different types of hardware and operating system software required.
• Reduce IT costs of implementing the very heavy load of regulatory change (FATCA, PSD, CCD, to name a few recent examples) by only having to implement the changes into one software stack and so achieve compliance for lots of brands/banks with that one implementation.
• Reduce the business staff costs by standardising and optimising routine procedures such as cheque clearing or account closure across multiple brands and banks.

These entirely desirable economic aims lead to a position where the core banking systems are pumping the financial life blood for millions of people and businesses every day. They have evolved into important national assets, like major roads, the national grid and key water treatment plants; however they are not really managed like these assets. They are not nationalised assets, nor are they as tightly regulated in terms of quality and guarantee of supply as other national assets.

Questions for the Regulators

1. Do you understand in the banks what are the potential single points of failure?

All important assets will have some single points of failure. Thames Water, as the name suggests, would struggle to provide a service if the Thames went offline. However, not all single points of failure can be justified versus the risk of failure. There is at least the suspicion that the RBS/NatWest/Ulster Bank incident (and others; see our previous article) are driven by cost efficiency rather than guaranteed supply of service; that there may have been single points of failure in the Banks’ systems that should not be there.

2. Where a single point of failure is unavoidable, what is the pecking order for failure recovery?

In the RBS/NatWest/Ulster Bank situation NatWest was the bank to recover fastest and Ulster Bank the slowest.

In one sense this is entirely rational, NatWest affects many more customers and payments than RBS who in turn have many more customers than Ulster Bank

A more subtle lens though might say;

• NatWest has 20% market share in England;
• RBS has 30-40% market share in Scotland;
• Ulster Bank has 30% market share in Northern Ireland.

So in their respective economies the outage of RBS and Ulster Bank does more damage; for NatWest in England, there may be alternatives in terms of Other Bank branches that could help stranded customers. Whatever logic is applied, it needs to be clearly defined and agreed with the regulator [1].

3. Are Current Accounts and Payments Infrastructure too important to be left in the hands of banks?

If the banking regulators do not get very convincing answers to the first two questions above, we have to look at the ownership/control model for the Money Transmissions system. Back in 2000 the Cruikshank report on competition in banking highlighted the banks control of the payment systems as a complex monopoly.

Other industries do have key national assets in private hands (e.g. power stations and water treatment works); however, there is a tendency to nationalise, or incredibly tightly regulate the means of distribution (roads, rivers, canals, National Electricity Grid, Telecoms backbone network).

In banking the means of distribution of money are current accounts and the payment systems, which are inextricably intertwined. The banks would be very resistant to losing control of current accounts as they regard them as the key relationship product and can use current account behaviour to gain powerful insights into their customers.

Conclusions

The RBS incident (and others see previous article) highlight the fact that banking regulators have not been scrutinising the security of supply issues enough. They need to stand up and ask more challenging questions of banks and force them to minimise the risks to continuity of supply. If they don’t get the right response a more hands on regime to managing one of the country’s key infrastructure assets would be required. To create the payments systems equivalent of the National Grid would cost a lot of money. But given the size of bank profits and bonuses, the customers of RBS, NatWest and particularly Ulster Bank might think that was a price worth paying.

Footnote:

1. RBSG claim that no prioritisation decisions were made during the incident, rather the technology defined the sequence. The author finds it hard to believe the there were not choices to be made as to who should work on what problem/risk and when during an issue that lasted weeks.[1]