Regulators fine Royal Bank of Scotland ₤56m for IT failure

The FCA and bank IT

Paul Hinton, commercial technology partner at law firm Kemp Little, said the fine is usually the tip of the iceberg. “The real spend and effort will be in making changes to improve the systems to meet the satisfaction of the PRA and/or FCA, who are taking a much keener interest in all things IT.”

Tracey McDermott, director of enforcement and financial crime at the FCA, said modern banking depends on effective, reliable and resilient IT systems. “The banks' failures meant millions of customers were unable to carry out the banking transactions which keep businesses and people's everyday lives moving,” said McDermott.

"The problems arose due to failures at many levels in the RBS Group to identify and manage the risks which can flow from disruptive IT incidents, and the result was that RBS customers were left exposed to these risks. We expect all firms to focus on how they ensure that they can meet the requirements of their customers when looking at their IT strategies and policies."

Software incompatibility

The FCA revealed the cause of the problems and pointed to the bank’s failings.

“On 17 June 2012, RBS’s IT department upgraded the software that processed updates to customers’ accounts overnight. When it noticed problems with the upgrade it decided to uninstall it without first testing the consequences of that action,” said the FCA. “The IT department did not realise, however, that the upgraded software was not compatible with the previous version.” 

The FCA said there were inadequate testing procedures for managing changes to software; risks related to the design of the software system that ran the updates to customers’ accounts were not identified; and IT risk appetite and policy was too limited, because it should have had a much greater focus on designing systems to withstand or minimise the effect of a disruptive incident. 

'Wake-up call to business leaders'

Lev Lesokhin, business technology executive at software testing company Cast, said the underlying issue was the legacy infrastructure the largest and oldest UK banks use. "This is under increasing pressure to deliver ‘Google-like’ customer services demanded by customers today.”

“Western banking systems are particularly exposed because they were the first to install computer systems, and investment in those systems has since been neglected as tightening budgets have meant less is spent on modernisation and quality assurance. Until these underlying issues are addressed and industry standards put in place, we will continue to see glitches like this,” said Lesokhin.

“Banks are increasingly being defined by software which is becoming increasingly complex, composed of subsystems written in different programming languages, on different machines by different teams – and complexity creates risk. 

"The frequency of technical issues affecting banking is a wake-up call to business leaders. They need to carefully scrutinise the structural integrity of their software systems.”