The banking sector in South and Southeast is on notice. Address tech outages or expect firmer penalties. That's the message from the region's regulators, and S&P Global Ratings see signs of this trend gaining traction. Recent actions in Malaysia underline the regulators' intentions to improve operational resilience and ensure smooth customer service and essential financial services.

We see banks in the region continuing to invest in technology to ensure system stability and robust disaster-recovery planning. In our view, they understand it is an expensive yet essential step to prevent harsher regulatory actions. Technology costs formed about 12% of operating expenses on average.

Banks' Spending On Technology To Climb

We believe technology expenses could continue to increase at 15%-20% a year over the next two to three years. In Malaysia and Singapore, technology costs grew by an average 13% and 20% respectively over 2023 and 2022 for our sample of rated banks.

For all our rated Malaysian banks, the share of technology expenses as a portion of their total operating expenses has risen in the past two years (see chart 1).

Chart 1

Banks To Face Closer Scrutiny

The Malaysian regulator is the latest to take action against banks following similar moves in Singapore and India. The fines imposed in Malaysia, while relatively meagre, highlight what regulators expect: a more resilient digital infrastructure for banking services and better accounting and ownership of service disruptions by banks. We anticipate the regulator will keep a close eye on the ability of banks to prevent recurrences and to enforce stricter penalties or embargos if they don't. Such regulatory actions also increase reputational risk for the banks.

In the past year, we have seen various regulatory actions in the region against service disruptions, ranging from monetary penalties to bans on new businesses and additional capital requirements.

On Aug. 14, 2024, Malaysia's central bank fined the two largest banks in the country for multiple episodes of prolonged disruption in services during 2023 and 2024. In the case of Malayan Banking Bhd. the fine amounted to US$973,851, representing 0.05% of 2023 net profit. For CIMB Bank Bhd., the fine was US$171,326, representing 0.01% of 2023 net profit. The fines are very small relative to the banks' annual net profit and are unlikely to have any material impact on financial performance.

We believe the rapid scale-up in digital transactions, precipitated by the pandemic, has added to the motivations of regulators to pursue tougher actions aimed at improving banks' technology infrastructure and reducing downtime faced by customers.

The pandemic has led to a massive increase in digital transaction volumes via multiple channels, including online banking, mobile applications, or other payment service providers. As a consequence, service outages are having a two-pronged effect. On the one hand, they are creating more frequent problems for customers. On the other, they are creating elevated operational and reputational risks for banks.

Pandemic-Led Rise In Transaction Volume Adds To Costs

The pandemic-led boost in digital transactions is likely to keep tech spending elevated over the next two to three years. This is because of sustained demand for online services and the fact that technology investments take time to bear results.

Although costly, such investments are necessary. Otherwise, banks face stricter actions--such as bans on new businesses or additional capital requirements. Such actions could have a material impact on growth and profitability. This could in turn affect ratings.

For example, the Indian regulator's recent ban on Kotak Mahindra Bank for issuing fresh credit cards affected growth as well as margins, given this product was a higher-yielding, target growth segment for the bank. The bank estimates a 2.5% impact on profit before tax, including additional technology spending to address the regulator's concerns.

More Drills To Identify Problems Before They Occur

We see simulations becoming a more frequent occurrence. These exercises could help identify emerging risks and prompt banks to plug gaps in their digital infrastructure. A key area of focus is third-party service providers, particularly in Malaysia. The country's central bank, Bank Negara Malaysia (BNM), has zeroed in on this following disruptions at some of these providers, which led to recent outages of banking services.

In November 2023, BNM led a simulation with banks that have large branch and ATM networks. The aim was to test the industry's controls and response to potential disruptions in third-party services affecting cash operations. The exercise provided insights on how to strengthen existing arrangements with alternate service providers to ensure continuity of businesses and services.

Regulators in the region will stay vigilant of system outages by being vocal and working closely with banks on remedial action plans. This should strengthen banks' ability to effectively recover from system disruptions, including those at third-party service providers. Regulators will calibrate their actions so that the nature of penalties matches the severity of the issue.

Time will tell how effective such actions are. But it's becoming apparent that inaction could have implications for reputations and ratings. And customers will demand nothing less.

Related Research

• Regulatory Action Could Restrain Kotak Mahindra Bank's Credit Growth, Profitability, April 26, 2024
• India's Regulatory Clampdown May Raise The Cost Of Capital, March 26, 2024
• DBS' Strong Third-Quarter Results Reflect Higher Margins; Regulatory Penalties Won't Undermine Its Financial Profile, Nov. 8, 2023