Better late than never! It’s been almost a month since news broke of security breach at a local bank’s digital payment system, sending alarm bells across the financial system. On November 28 this week, the central bank came up with guidelines on securing digital payments (see the salient points summarized in the table). The burden of digital security has been put squarely on the banks.
The banking custodian has adopted a ruthlessly direct tone in the circular, bringing its regulatory mandate to bear on this critical issue. Come early 2019, any bank that wishes to continue its digital payment products and services better follow the new protocols, or else face penalties that will be go beyond just suspension of such products and services.
Arguably, the Pakistani banks have been slow to embrace digital medium and the demands for security that come with it. (For more on how Pakistani banks haven’t kept up with the demands of the digital era, read “Compromised?” published November 1, 2018). The digital era was here many years ago, but banks found it easy to live the digital dream without making serious investments.
Now compliance with the SBP’s new rules on payments security is going to bite. Now banks have to be proactive in putting a robust data security infrastructure in place, conducting regular internal and external audits of the same, training their in-house human resource, and making efforts to raise customer awareness on the pitfalls of digital banking.
On top of those new costs, effective from January 1, 2019, it is mandatory for all banks to send free Sms and email alerts to their customers on all types of local and international digital transactions. As many banks currently charge for Sms alerts, this new rule will make the industry lose precious few billions in fee income – something the bank bosses will not like during an impending economic slowdown.
Some observers feel that the hammer has fallen unnecessarily hard on the banks. These new rules will inadvertently push up compliance costs to an extent that banks may be forced to scale back their digitization drives. One prominent Fintech expert told BR Research that instead of burdening the banks, the issue of payment security could be resolved if banks are allowed to outsource their data centers and other IT functions to reliable, specialized third parties. Indeed, IT is not a bank’s core, and it can never be.
It is easier to become wise after the event. While the banks clearly need to up their game, the regulator must also reckon with its digital past. It took the SBP a notable hacking incident – and subsequent over-reaction and rumor-mongering – to strengthen the industry’s digital flank. Now the need is to be on the vigil so that digital contagions – of which there will be more kinds in coming years – don’t spread to the point that people, most of whom are already un-banked, lose confidence in the banking system for good.
Comments
Comments are closed.