$OVERSEA-CHINESE BANKING CORP(O39.SI)$
MAS slaps additional S$330m capital requirement on OCBC over its response to SMS scams.
SMS phishing scams
THE Monetary Authority of Singapore (MAS) has imposed an additional capital requirement of about S$330 million on OCBC Bank for its deficiencies in responding to a wave of spoofed SMS phishing scams in December 2021.
OCBC engaged PricewaterhouseCoopers Risk Services to do a “special review” of its fraud surveillance systems and management processes after nearly 800 of its customers fell prey to SMS phishing scams involving the bank last year. The independent review, which also covered recommendations for improvements, has been completed.
Total losses from the scam amounted toS$13.7 million. OCBC has made “full goodwill payouts” to all victims – a move that the second-largest bank in Singapore described as a “one-off gesture” given the circumstances of the scam.
Ms Wong said the phishing scam was “unprecedented” and displayed “a realism not seen in previous scams”, but there was no evidence of any compromise in the bank’s systems.
Additional capital requirement
This additional capital requirement is part of the regulatory capital which MAS requires all banks to hold. The minimum amount of capital would be relative to the size and riskiness of the bank’s operations and investments, and is predominantly in the form of equity and retained earnings
“The SMS phishing attacks impersonating OCBC in December 2021 was unprecedented in that the tactics reached a level of realism not seen in previous phishing scams. While we took various actions in December to stem the scam, we should have responded faster and better to early signs of the attacks,” said Helen Wong, group chief executive officer, OCBC in a media statement.
The bank is required to apply a 1.3 times multiplier to its risk-weighted assets for operational risks which is approximately S$330 million in regulatory capital based on financial statements as of Mar 31, 2022.
“Financial institutions have a duty to put in place robust measures to prevent, detect and respond to scams. This means ensuring that their controls remain effective against evolving scam tactics, and prompt actions are taken as soon as a scam is detected,” said Marcus Lim, assistant managing director, banking and insurance, MAS.
This requirement takes into consideration the actions taken by OCBC to strengthen its controls and its approach to resolving customer complaints following the incident. The bank has engaged an independent firm to review its systems and processes, with deficiencies noted in the mitigation of identified risks, pre and post-transaction controls, incident management and complaints handling. This results in delay in containment measures and customer response time.
SEE ALSOSGX RegCo to extend suspension of entry into watch-list till June 2023.
“We have since implemented and will implement additional measures, including those recommended by the consultant as well as the ones jointly developed with the industry and the authorities,” said OCBC’s Wong.
These deficiencies are in line with MAS’ assessment and the OCBC is in the process of adding them. MAS will review the additional capital requirement when it is satisfied all deficiencies identified in the independent review has been addressed.
“The one-off gesture of goodwill payouts to victims of the scam was the right thing to do given the circumstances at that time. Even as vigilance is a shared responsibility with consumers, we are working with all parties in the ecosystem, including the telecommunication companies, the regulator and law enforcement agencies, to continuously assess and calibrate the anti-scam control measures for our digital banking channels,” said OCBC’s Wong.
The additional capital requirement translates to a 0.21 percentage point impact on OCBC’s capital ratios. The bank says that there will not be any impact on their dividend policy.
Suggestion
“Consumers must also remain vigilant against persistent attempts by scammers to deceive them into divulging their log-in credentials or initiating transfers themselves. MAS is working closely with the industry and other agencies to further strengthen our collective defences against scams,” said MAS’ Lim.
source：BT
Comments