Singapore’s financial regulator has slapped OCBC Bank, the country’s second largest lender, with an additional capital requirement of S$330 million ( US$240 million ) following a series of phishing activities that victimized its customers in December 2021.

Highlighting deficiencies in the bank’s response to a wave of spoofed SMS scams, the Monetary Authority of Singapore ( MAS ) says OCBC will be required to apply a multiplier of 1.3 times to its risk-weighted assets for operational risk. This translates to an additional amount of approximately S$330 million in regulatory capital ( based on its reported financial statements as of March 31 2022 ).

The regulator says the additional capital requirement takes into consideration actions taken by OCBC to strengthen its controls and its approach to resolving customer complaints following the incident. About 790 customers lost S$13.7 million in the scams, the bank said in an update in January.

OCBC had engaged an independent firm to review its systems and processes. Deficiencies were noted in the bank’s mitigation of identified risks, pre- and post-transaction controls, incident management and complaints handling, resulting in delays in containment measures and customer response time.

Marcus Lim, MAS assistant managing director ( banking and insurance ), notes: “Financial institutions have a duty to put in place robust measures to prevent, detect and respond to scams. This means ensuring that their controls remain effective against evolving scam tactics, and prompt actions are taken as soon as a scam is detected.”

Responding to the regulator’s actions, OCBC group chief executive officer Helen Wong says: “As digital banking becomes a way of life in today’s world, scammers are using increasingly well-orchestrated tactics to convince, mislead and steal.

“The SMS phishing attacks impersonating OCBC in December 2021 were unprecedented in that the tactics reached a level of realism not seen in previous phishing scams. While we took various actions in December to stem the scam, we should have responded faster and better to early signs of the attacks.

“We have since implemented and will implement additional measures, including those recommended by the consultant as well as the ones jointly developed with the industry and the authorities,” Wong adds. 

The additional capital requirement will be reviewed when MAS is satisfied that OCBC has addressed all deficiencies identified in the review.