Customers at the Royal Bank of Scotland (RBS), NatWest and Ulster Bank experienced problems, including with using online banking services, obtaining accurate information on their account balances and making payments, after technical issues arose during a software update implemented by the banks in June 2012.
The Financial Conduct Authority (FCA) fined the banks £42m and the Prudential Regulation Authority (PRA) separately imposed a fine of £14m over what they said was a breach of rules that require regulated financial services companies "to take reasonable care to organise and control its affairs responsibly and effectively with adequate risk management systems".
The regulators said the banks did not have "adequate systems and controls in place to identify and manage their exposure to IT risks". It is the first time the PRA and FCA have pursued joint enforcement action and the first fine the PRA has issued since it undertook its supervisory role in April 2013.
The PRA said the "properly functioning IT risk management systems and controls are an integral part of a firm’s safety and soundness and of particular importance to the stability of the UK financial system".
The FCA said it recently wrote to the chairmen of major UK banks in an effort to assess how well the banks are "managing their exposure to IT risk and to what extent banks’ governing bodies have formally assessed the extent to which a bank is vulnerable to technology failure affecting services supporting retail economic functions".
Tracey McDermott, director of enforcement and financial crime at the FCA, said: "Modern banking depends on effective, reliable and resilient IT systems…. We expect all firms to focus on how they ensure that they can meet the requirements of their customers when looking at their IT strategies and policies."
RBS chairman Sir Philip Hampton said that he recognised that the IT problems at the banks had "caused significant stress" to customers. He said the company had since taken steps to improve its IT systems and controls.
"I am confident that the progress we have made – in increasing the resilience of our IT systems through the additional investment of hundreds of millions of pounds and the enhancement of our control structures – has made RBS better able to provide the service our customers expect and deserve," Sir Philip said.
RBS said it has established a "mirror bank" alongside its operational systems that allows it to continue processing customer transactions for "key customer services" at the same time as it works on restoring the main systems to operation. It said its services are currently available to customers 99.9% of the time.