6th July 2012
initial response to your letter of 27 June, I am now
writing to address your additional questions, and welcome
the further opportunity to update the Committee on the
actions we are taking.
We remain deeply sorry for the disruption our customers
encountered, and I would like to acknowledge their
understanding and patience. The number one job for everyone
at RBS as we resolve the incident is to put our customers'
interests first. As stated in my first response, the
initial technical issue has been resolved in RBS and
NatWest. There is continuing backlog in our service in
Ulster Bank though this too is substantially improving each
day. Our focus is now on completing the recovery in Ulster
Bank, resolving the remaining issues faced by our
customers, and on remediation and redress.
As you know a full and detailed investigation is underway
into the causes of the problem, overseen by independent
experts and reporting to the Board Risk Committee. It will
consider both the Group's own operations, as well as the
role of third parties in the context of the incident. It
will establish a full account of what happened, an
assessment of how the Group responded and a thorough review
of root cause. It would be wrong for me to second-guess its
findings. Therefore, some of the responses below must be
viewed as preliminary in nature.
The main RBS Group (RBS) brands affected have been NatWest,
RBS and Ulster Bank Group (UBG) and the customers primarily
affected are in the UK, Ireland and the Crown Dependencies.
At UBG, progress in restoring normal services has been the
slowest. We continue to work to accelerate the processing
of the backlog in Ireland, which is reducing. We now expect
that the coming week will be the final week of any
significant delays for Ulster Bank customers, although
there is likely to be some further tidy up work required
thereafter. In the meantime, we continue to publish daily
updates on our progress and maintain extended opening hours
in our branches with additional resource in our call
centres, to ensure we can help as many of our affected
customers as possible.
The precise number and type of customers adversely affected
and the losses they may have suffered are under urgent
investigation. Detailed impact assessments have already
started. These should give us a fuller picture of customer
impact and help us implement customer redress.
Root cause and incident response
Preliminary investigations would indicate that the root
cause was a routine software upgrade managed and operated
by our team in Edinburgh, which caused the automated batch
processing software to malfunction. The immediate software
issue was promptly identified and rectified. Despite this,
significant manual intervention in a highly automated and
complex batch processing was required. This resulted in a
significant backlog of daily data and information
processing. The consequential IT problems and backlog have
taken time to resolve. However, I would like to emphasise
that at no point was any customer data lost or destroyed.
Everyone at RBS is deeply frustrated by the scale of
disruption experienced by our customers and, especially the
time being taken to restore normal service at Ulster Bank.
The investigation will address the effectiveness of our
risk management systems, including the identification of
low probability/high impact events and their mitigation. It
will also assess contingency planning and business
resilience i.e. whether other systems within RBS Group are
at risk of similar incidents. The strategic and operational
response to the incident will also be assessed, as will the
impact on business resilience of any cost saving measures.
A substantial programme of activity will be implemented to
reduce the potential of comparable incidents recurring.
This programme will upgrade resilience, capability and
governance in the relevant areas to the level that would be
expected of us. It will be responsible for closing any
identified gaps quickly and also for longer term upgrades
to our capability.
My senior management team and I are completely focused on
fixing the remaining processing difficulties we face and
making good on our own customers issues and those of other
banks affected by our systems failure. We have already
managed to resolve a very large number of difficulties
experienced by customers through our branches and call
centres. There have been 21,000 other problems or
complaints raised that required a greater degree of
attention and we have so far resolved over 90% of these.
The day to day impact on our operations during the delay
period included: reduced functionality of some back office
systems; extended opening hours for branches and call
centres; the implementation of manual "fixes" to
deal with our customers' needs (e.g., increasing
customer credit limits, providing emergency cash to
customers etc.); and the re-allocation of resources from
"business as usual" issues to fixing the problem
and mitigating its impact on customers.
The incident did affect the Government Banking Service
(GBS) system. Most of the impacts, such as the inability to
view balances and delayed clearing of cheques and cash in
and out during 20-22 June, were quickly resolved. BACS
payments for GBS - the main part of our service contract -
were actioned as normal throughout the period. There
continue to be some delays, however, in some overseas
payments to GBS via Ulster Bank.
As regards customer switching, whilst we experienced a
decline in incoming switching volumes during the incident,
these have now begun to recover. Outbound switching
increased temporarily during the incident but has now
returned to pre-incident levels.
I have already said that no customer should lose out
because of our IT problems and this will of course include
taking action to ensure the credit reference data of our
customers are not unduly affected.
All June data for our customers who have had late incoming
or internal payments to any of their accounts, will be
reviewed for potential errors before being sent to the
credit reference agencies (CRA). We are working with the
CRAs and in turn the Information Commissioner Office (ICO)
to agree an appropriate treatment for corrections made to
these files. In addition, concerned consumer and commercial
customers that want to check their credit reports will be
provided with details of how to do this and given free
access for a period of time.
We will also write to both consumer and commercial
customers whose outgoing payments to third parties (e.g.
other banks, utility companies etc.) have been delayed, to
provide them with details as to how they can likewise check
their credit reports, with free access for a period of
time. For non-RBS customers whose expected payments have
been delayed because of our processing issues (e.g. late
salary payments), a process is being established to
identify where issues may have occurred. Where our error
has adversely affected any accounts held with another
organisation we will provide an explanation of this for the
other organisation so they can amend their records. The
Group is working with the credit references agencies and
their members to put in place an appropriate correction
As noted above, we stand by our commitment to ensure that
if possible, affected customers are restored to the
position they would have been in had the incident not
occurred. We are also conscious that there are customers of
other banks who have been affected by this incident. Since
I last wrote, we have now finalised a Customer Redress
Strategy outlining the approach to be taken for both RBS
customers and customers of other banks.
The principles at the heart of this strategy are to put RBS
and non-RBS affected customers back to the position they
would have been in had the incident not occurred and to
ensure consistent treatment of customers across the various
customer segments and jurisdictions which have been
affected - although some variations will be necessary
depending on the precise customer impact.
The primary criteria for those eligible for redress are
those RBS and non-RBS customers who have been adversely
affected by the incident. Specific customer groups that may
have been adversely affected will be identified to offer
proactive redress wherever possible.
In addition to the proactive work, there are a range of
types of consequential loss that may lead to compensation.
We are assessing complaints/claims received from adversely
affected customers through our customer complaints and
redress processes, whose capacity we will expand as
necessary to support the processing of such claims. Such
claims will be handled on a case by case basis, as quickly
Our plans with respect to compensation for RBS customers
include the following elements:
We will proactively refund (i) fees/charges incurred due
to systems outage, including any interest on those
charges and debtor interest, and (ii) any loss of credit
interest due to delayed credits.
We will proactively identify cohorts of customers where
we can reasonably assume the incident will have had an
adverse impact, to contact them and offer suitable
All claims for any additional losses in excess of the
pro-active redress identified above will be dealt with
through our standard complaints handling processes, with
capacity expanded as necessary to support the prompt
processing of such claims.
With respect to non-RBS customers, we have an agreement in
principle with other banks, building societies, credit card
companies and other financial institutions, via the
Payments Council and Irish Payment Services Organisation,
to ensure that any non-RBS customers impacted by this
incident should not be left out of pocket. This will
The reversal / adjustment of debit interest and/or other
account charges incurred as a result of the incident.
Those financial institutions dealing with any claims for
reimbursement of other categories of loss through their
own complaints handling processes.
Any redress and processing costs incurred by other
financial institutions in respect of the incident will be
reimbursed by RBS.
A dedicated unit is being established within RBS to
provide a 'direct-to-RBS' route for exceptional non-RBS
I am deeply sorry for the disruption experienced by our
customers during the systems delays. We are completely
focused on restoring normal levels of services, where these
remain disrupted, and on re-gaining the confidence of our
customers. We will also continue to explain what went
wrong, what we are doing (or have done) to fix things and
how we are putting our customers first. We are also
determined to learn the lessons of this disruption and we
will provide your Committee with the relevant findings from
our investigation in due course.
Our staff continue to work incredibly hard during this
episode and have dedicated themselves to fixing the
problems and helping customers.
One thing is already evident. However radical our agenda
was to change this bank in 2009 - and we have changed many
things for the better - it is clear that we have more work
to do. I am determined that we should drive further change
to make sure this bank is better for its customers and
becomes an appropriate model for how a bank should relate
With best regards,