BNZ service loss, blamed on parent NAB, raises questions about its implementation of RBNZ's outsourcing policy & closely follows RBNZ stating foreign controlled banks must acknowledge they are operating in NZ & the responsibilities this implies

BNZ service loss, blamed on parent NAB, raises questions about its implementation of RBNZ's outsourcing policy & closely follows RBNZ stating foreign controlled banks must acknowledge they are operating in NZ & the responsibilities this implies

Fresh from the Reserve Bank publishing a letter pointing out foreign controlled banks must acknowledge they are operating in New Zealand and the responsibilities this implies, BNZ has suffered a major weekend service loss blamed on its parent National Australia Bank (NAB).

BNZ says the widely publicised outage started at 9.45am on Saturday with systems back up from 1pm Saturday. Most banking, online banking, EFTPOS and ATM services were affected, with the reason cited for this being power loss at NAB in Australia. BNZ's service loss also raises questions about its implementation of the Reserve Bank's outsourcing policy, through which major NZ banks are supposed to be able to operate on a standalone basis.

"We outsource a number of systems to NAB, sorry I can’t be more specific," a BNZ spokesman told interest.co.nz when asked for details.

The Reserve Bank last year detailed its revised outsourcing policy that requires banks to be able to keep operating in NZ if something goes wrong with one of their key service providers - especially in the case of the Australian owned banks if it's their parent. The Reserve Bank spent two years consulting on how to revise its outsourcing policy, after it determined in a 2014 review that the policy was being inconsistently applied, compromising the stability of NZ's financial system in stress situations, and potentially undermining the viability of the central bank's Open Bank Resolution (OBR) policy. It has estimated it will cost banks about $550 million to implement.

Like the existing outsourcing policy, the revised outsourcing policy applies to all locally incorporated banks whose NZ liabilities, net of amounts due to related parties, exceed $10 billion. This means ANZ, ASB, BNZ, Westpac and Kiwibank, however the four Australian-owned banks are primarily affected.

Interest.co.nz asked the BNZ spokesman whether outsourcing to NAB will change as BNZ implements the Reserve Bank's revamped outsourcing policy. 

"RBNZ’s current outsourcing policy requires banks, amongst other things, to ensure there are robust back up capabilities wherever a service is outsourced to a third party, whether that is a parent bank, or the likes of an IT provider such as IBM or Oracle. From 2022 when RBNZ’s revised policy comes into full effect, where core banking services are outsourced to a parent bank, there are also additional regulatory requirements mandating that the local NZ bank has the ability to bring that service back in house at short notice," the BNZ spokesman says.

"In yesterday’s incident, the backup arrangements in place with our parent bank minimised the impact of the outage. However many customers were impacted and we apologise for that."

BNZ has noted in disclosure statements that the new outsourcing policy "provides for a five-year transitional path for affected banks to become compliant with the policy. Implementation of, and compliance with, the final policy is likely to result in increased costs, which have not yet been quantified, and operational and strategic execution risks to the bank."

The Reserve Bank has not yet responded to a request for comment.

Last week the Reserve Bank published an article by its Governor Adrian Orr detailing where it sees its role in banking conduct and culture against the backdrop of the Australian Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry. One of Orr's key points was banks acknowledging they are operating in NZ – and the responsibilities this implies.

Meanwhile, with media speculation that BNZ may compensate some customers following the outage, the bank issued the following statement - attributed to Paul Carter, BNZ's chief customer officer for consumer and wealth banking.

"On behalf of everyone at BNZ, I want to apologise for the disruption caused to our customers yesterday [Saturday] by the systems outage we experienced. A power failure was the cause of the problem and we are very sorry for the inconvenience it caused to people enjoying their Saturday. Our immediate priority has been to get the system back up and running and I’m pleased to say it was back to normal Saturday afternoon. We are also working through how best to support impacted customers. This will include working with customers who experienced direct financial loss due to the outage to ensure they are not unfairly impacted. The outage was our mistake and we’ll be working to make things right," Carter says.

Here's what NAB has to say, with a power failure isolating NAB's mainframe computer in Melbourne, and BNZ's parent wanting to make sure customers "have no financial loss associated with the outage."

*This article was first published in our email for paying subscribers early on Monday morning. See here for more details and how to subscribe.

We welcome your help to improve our coverage of this issue. Any examples or experiences to relate? Any links to other news, data or research to shed more light on this? Any insight or views on what might happen next or what should happen next? Any errors to correct?

We welcome your comments below. If you are not already registered, please register to comment.

Remember we welcome robust, respectful and insightful debate. We don't welcome abusive or defamatory comments and will de-register those repeatedly making such comments. Our current comment policy is here.

11 Comments

Comment Filter

Highlight new comments in the last hr(s).

Been with BNZ for 30+ years and this high profile incident on Saturday is not isolated, but the latest of many issues. I made two purchases with my BNZ credit card on Saturday morning and both went through ok. However, as of this morning they are not showing in my statement - which suggests the problem is still not fully resolved.

A week ago there were intermittent problems with Internet banking that the customer service centre refused to acknowledge. The issue could be replicated on two different internet connections and on both computers and mobile phones i.e. it was not a local problem specific to an ISP or single device. It had mysteriously "fixed itself" by the next day.

Two weeks ago transactions made by EFTPOS appeared in duplicate in one's account. BNZ admitted to this the following day.

There have been other issues. In fairness to BNZ, teach issue is fixed quickly - but the frequency of these issues damages your confidence in BNZ. I don't really want to change banks as I am generally happy with BNZ but, well, these recent issues are cause for concern.

BNZ needs to up their game. While their web application looks very fancy the basics are horrific.
Maximum password length = 8 characters. I can't choose a convenient password, so I keep copies of it.
Two factor security = Stupid inconvenient bingo card. Every f-$! time I want to use online banking they ask me to play bingo. Of course I have copies of the bingo card everywhere thereby negating the security to an extent. Multi-factor security means you're meant to have a combination of knowledge / possession / bio-metric factors. BNZ's bingo card is a knowledge factor pretending to be a possession factor.

ANZ on the other hand get it right. They allow me to use a nice long password. Online ANZ simply send a unique code in a text message to authenticate logins or transactions, and this is configurable by the customer.

With this kind of mediocracy at BNZ I'm not surprised their systems went down.

I will say BNZ are easier to deal with than ANZ for mortgages though I give them that.

Dear Mr Orr,

How would the RBNZ trigger OBR if "Core systems" are over the ditch?

Supplementary Question:

Is this situation that a "Diligent and prudent" regulator should have allowed to occur?

Good point IT Guy.
"Our" banks are less than what they seem.
No one out sources to the parent! the sub is told what to do!
Opens the whole business up to massive transfer pricing and value shift, service fees, management fees and the rest.
Its the same thinking as tax based funding. Its managed from Sydney & Melbourne.
Transactions are booked where ever mgt/exes feel best.

"RBNZ’s current outsourcing policy requires banks, amongst other things, to ensure there are robust back up capabilities wherever a service is outsourced to a third party, whether that is a parent bank, or the likes of an IT provider such as IBM or Oracle. From 2022 when RBNZ’s revised policy comes into full effect, where core banking services are outsourced to a parent bank, there are also additional regulatory requirements mandating that the local NZ bank has the ability to bring that service back in house at short notice," the BNZ spokesman says.

RBNZ should ask TSB UK how easy that is. Maybe the intention is that bank IT will just have to be in-house to start with. Since IT is core business for a bank that would make sense.

"In yesterday’s incident, the backup arrangements in place with our parent bank minimised the impact of the outage. However many customers were impacted and we apologise for that."

This is disingenuous and BNZ are clearly some why off from having local fail-over from core NAB systems.

"In yesterday’s incident, the backup arrangements in place with our parent bank minimised the impact of the outage. However many customers were impacted and we apologise for that."

This is disingenuous and BNZ are clearly some why off from having local fail-over from core NAB systems.

Mental Note: There may be some BS11 implementation jobs going at BNZ.

The "Power Failure" excuse is a weak reason (even if true).

Most Enterprises on the Auckland skyline have their critical IT infrastrucure resilient to power outages, through usage of UPS and Generators, with these systems typically being tested often. To think that a Bank can't implement this at a Group level is stunning (if not curious)

When a Major Incident occurs, and a power outage is the reason, heads should roll, it is the simplest form of IT redundancy to cater for.

Power failure is a building services type roll as well, so obvious under resourcing in tech roles and managers who cannot take basic engineering advice of a backup, or service resilience.

lol, pretty sure the last time BNZ innovated was when they enabled internet banking. Now the BNZ depends on their ability to market fractionally reserve created loans to their customer base. They use the witchery of economists to project credence/relevance.

In their defense, they probably follow capital-requirement regulations better than most of the major NZ banks. Still, I see them being left behind as the fin-tech/crypto movement progresses.