********************************
Following is a question by the Hon Miriam Lau and a written reply by the Secretary for Financial Services and the Treasury, Professor K C Chan, in the Legislative Council today (February 23):
Question:
It was reported that the automatic teller machine (ATM) system of two local banks experienced severe failure on January 16 this year of the service of over 1,200 ATMs in Hong Kong being completely paralyzed for at least five minutes, or even for an hour as suggested in some reports. It was also reported that the incident made it impossible for the public to withdraw or transfer money, and their cards were even trapped in the ATMs with wrong amounts deducted from their accounts, which had caused substantial inconvenience to and impact on the public. In this connection, will the Government inform this Council:
(a) whether it knows the number of incidents involving ATM systems in the past five years, the causes of such incidents, the number of ATMs involved, the duration during which the systems were affected, the number of complaints received (e.g. complaints about failure to make withdrawals or transfers, failure to retrieve ATM cards and erroneous deduction of money from accounts), the total amount of money involved in all such incidents and the maximum amount involved in a single incident;
(b) given that it was reported that the aforesaid incident occurred on January 16 was caused by a routine system upgrade conducted by the banks involved, whether the authorities will consider requesting the banks concerned to in future notify their customers before testing or upgrading their ATM systems, so that their customers will not be affected; if they will, of the details; if not, the reasons for that; and
(c) given that some members of the public have pointed out that, as the number of bank branches has decreased significantly in recent years, the public may not be able to locate bank branches and make withdrawals or transfers in case of ATM system failures, thus causing inconvenience to the public, what measures the authorities have to ensure the stability of ATM systems of the banks and to prevent failures of such systems?
Reply:
President,
The Administration's reply to the question is as follows:
(a) ATM services provided by banks in Hong Kong have always been maintained at a high level of service availability. According to the information provided by banks, the service availability for ATM services in Hong Kong was maintained at a high level of around 99% in 2010.
The January incident mentioned in the question involved the ATM network of two banks. According to the information provided by the banks, the incident affected all (some 1,200) ATMs of the concerned ATM network and the ATM service was suspended for about five minutes. The same ATM network also encountered an ATM service outage in 2009. However, as that incident occurred at 3am, the impact on bank customers was minimal.
Apart from these two cases, the Hong Kong Monetary Authority (HKMA) had received 14 reports of ATM service outage due to system failure in the past five years (from January 2006 to January 2011). The number of ATMs affected ranged from 25 to around 200 which accounted for only a small portion of ATMs within the network that the banks operated. The duration of ATM service outage for these incidents ranged from a few minutes to around four hours.
In addition, the HKMA had received five reports of ATM system interruptions which affected services other than cash withdrawal and deposit.
ATM service interruptions or outages are mainly caused by system hardware failure, operational errors, and inadequate controls of system development and modification.
From January 2006 to January 2011, the HKMA had received 120 complaints from customers about incidents related to banks' ATM systems. Among these complaints, only one case was related to ATM service outage. The remaining cases were related to disputes in discrepancies between the actual amount of cash withdrawn from the ATM and the amount being debited to the customer's bank account. The HKMA will follow up on these complaints. If the allegation is substantiated, the bank is required to bear the full loss incurred by the complainant due to the failure of the ATM terminals (Note). The HKMA does not have information on the total and maximum amounts involved in these complaint cases.
(b) As system enhancements or upgrades of ATMs may require temporary suspension of ATM services, they are usually conducted during non-peak hours to minimise any impact on bank customers. If an incident occurs after system enhancements or upgrades, banks would fix the problem immediately and this may lead to interruptions of ATM services.
In general, if system enhancement or upgrade requires a longer time to complete, and will affect the banks' ATM services during that period of time, banks are required by the HKMA to notify their customers in advance through appropriate channels to minimise the inconvenience to bank customers.
(c) According to the Supervisory Policy Manual module on "General Principles for Technology Risk Management" issued by the HKMA, to ensure the continued availability of technology-related services, banks should maintain and service information technology (IT) facilities and equipment (e.g. computer hardware and network devices) properly and regularly. Banks are required to develop effective IT controls for the systems and equipment related to the ATM services (including ATM terminals and related network devices) to ensure efficient and continued availability of ATM services to their customers. Also, the HKMA regularly assesses the IT controls of banks and will follow up with banks on any major system failure incidents, and require the banks concerned to make the necessary improvement.
Note: According to the Code of Banking Practice, card issuers will bear the full loss incurred when faults have occurred in the terminals, or other systems used, which cause cardholders to suffer direct loss.
Ends/Wednesday, February 23, 2011
Issued at HKT 15:26
NNNN