.svg)
The Hong Kong Monetary Authority (HKMA) has written to authorised institutions with regard to payments-related incidents as it warns firms of plans to increase its surveillance over their payments operations.
Over the past year, the HKMA has noted a number of payments-related operational incidents reported by institutions that it oversees, according to a new memo to the industry.
The regulator said that most of these incidents were caused by IT system malfunctions, rendering the institutions unable to complete payment transactions within the cut-off timelines specified by the Hong Kong Interbank Clearing Limited (HKICL).
For example, an outage in June saw HSBC and Hang Seng’s ATM and online banking services take a hit, after services were down for several hours.
Incidents like this have not only affected the institutions themselves and their customers, but in several instances have also affected other financial institutions, including those in the securities sector, HKMA said.
“The HKMA would like to remind AIs [authorised institutions] of the importance of maintaining high operational resilience with respect to their payment operations,” the memo cautions. “They should appreciate that a stable and efficient payment system is immensely important to Hong Kong being an international financial centre.”
In view of the increased number of incidents, the HKMA said it will step up its surveillance of supervised firms' payment operations, including undertaking examinations focused on these operations, it announced in the new document.
To counter the risk, the HKMA has recommended that all system updates are thoroughly tested before widespread use. “Where an AI’s payment systems rely on those of its head office, it should clearly communicate with its group counterparts to ensure that the local management is informed of any system changes affecting payment operations well in advance.”
In addition, the local management should be closely involved in the testing process before any system changes are effected.
The HKMA has also highlighted that a key commonality of the operational incidents is the disruption of the institution’s payment operations was not raised to the attention of bank management in good time as most of the efforts were placed on system recovery.
“The decision to trigger the contingency arrangements specified in the BCPs [business contingency plans] was usually made at a late stage, causing many of the outstanding transactions not being completed in time.”
Institutions should not always expect that real-time gross settlement cut-off times will be extended, with the HKMA warning that this will only happen on “an exceptional basis”.
The regulator, which is effectively Hong Kong’s central bank, further called for better communication with the market, stating that this could ensure key stakeholders in the payments process are warned in a timely manner.
The HKMA concluded by recommending that institutions review their existing practices.
"Where gaps are identified, AIs should critically evaluate the need for enhancing their existing practices and make improvements where appropriate."
