Really Bad Systems

IT WAS probably low expectations rather than a manifestation of the Blitz spirit, but millions of customers of the Royal Bank of Scotland (RBS) remained remarkably calm when computer glitches led to money mysteriously disappearing from their accounts and payments going awry. There were loud complaints but no signs of customers panicking and trying to withdraw all their money. Yet the snafu at the state-controlled firm highlights worrying vulnerabilities at the heart of British banking.

The first is that the market is highly concentrated, with just five big consumer banks. Their sheer size means that even a mundane problem could cause a systemic crisis or a bank run. Glitches at large banks in America have generated far less angst among regulators and the public (although not for their customers), simply because their share of the national market is so much smaller.

A second worry is that Britain's big banks have been stitched together through a series of acquisitions and combinations. In many cases the disparate computer systems were simply cobbled together. “RBS has this problem in spades,” says one regulator. Compounding the problem, many of these computer systems were bespoke ones, built in the 1970s by in-house teams. Many have their own idiosyncrasies, yet it is likely that many details of how they work will not have been written down. “Back in the 1970s a single guru could have most of the system understood in their head,” says Bill Curtis of Cast, an American software analysis firm. Systems are now far more complex, yet banks' own processes have not kept pace.

The rise of internet and mobile banking is greatly increasing the risk of things going wrong, adds Mark Jenkinson of Capco, a consulting firm. A handy innovation, such as allowing customers to check their balances using their phones, may work perfectly well on its own, yet could crash the entire system when it is deployed.

The latest travails of RBS will be a boon for IT consultants, many of whom are already pitching nifty new ways of managing risk and satisfying supervisors. Yet perhaps bank regulators should ask a deeper question: does it really make sense to allow critical functions such as bank payments to be concentrated in so few hands?