Bulletin – October 2024 Financial Stability The Reliability of Retail Payment Services

Introduction

The safe and reliable operation of payment systems is critical to the operation of the Australian economy. Most salary, pension and welfare payments are made via account-to-account payments (electronic transfers between bank accounts) and over 75 per cent of consumer transactions are made through electronic payment rails such as debit and credit cards (Nguyen and Watson 2023). This reliance on electronic payment methods means that any disruption to the provision of these services (i.e. an outage) can have serious impacts on customers, businesses and the broader economy.

Recognising the growing importance of payment service availability, in 2012 the RBA started collecting incident reports from payment service providers on unplanned retail payment service outages. Following an increase in payment systems outages over 2018 and 2019, the RBA collaborated with industry to improve the quality of the RBA’s data collection by establishing a standardised set of statistics to measure operational outages in retail payments.

To support the transparency of retail payment service reliability, the RBA also expects individual providers of payment services to publish a standardised set of statistics about the availability of their services on their websites (RBA 2021). These disclosures commenced in November 2021. Public disclosure has enabled retail payment service providers to benchmark their performance against competitors, while also providing an incentive for service providers to improve the reliability of their own offerings. Disclosure has also provided the general public with more visibility on the reliability of their current retail payment service providers and an ability to compare their performance to other providers.

This article presents insights from the RBA’s collection of retail payment incident statistics. It provides an overview of the dataset, including which service providers report and what they report to the RBA each quarter. The article then presents information about the availability of the different types of retail payment services. It also provides information on the root causes of outages and discusses the importance of managing operational risk.

The retail payment incidents dataset

The RBA expects certain financial institutions to report and publicly disclose data on the reliability of their retail payment services. These retail payment services include ATM, branch and online banking services, services provided to merchants to accept card payments, services provided to customers to make card payments, fast payments^[1] and next-day payments.^[2]

The institutions expected to report and disclose reliability data are those that provide payment and banking services to individual and business customers, and that are either ranked within the top 25 largest authorised deposit-taking institutions^[3] or acquire card transactions for merchants (RBA 2022).

The information that the institutions disclose each quarter to the RBA is summarised in Figure 1 and includes:

• the time and date of any incident that affected the institution’s ability to provide retail payment services, the root cause of the incident, the time taken for the incident to be detected and the time taken for the incident to be resolved^[4]
• the length of any outage to a retail payment service caused by an incident and the proportion of customers affected by an outage
• the total number of hours that the institution planned to provide retail payment services to customers, the total length of any planned or unplanned outage that affected any retail payment service and the overall percentage availability of the retail payment service.

An institution should report any ‘significant outage’ that lasts for more than 30 minutes or, for next-day payments, if a next-day account transfer cannot be processed by the end of the day. A significant outage also includes an outage that impacts either 10 per cent of customers for that service or impacts a major geographical area for ATM, branch or card payment services.^[5] One downside of this definition is that it does not capture some localised outages, such as those caused by natural disasters affecting regional communities, which can be very disruptive for the consumers and businesses impacted.

Under the agreement with industry, disclosing institutions publish a subset of the information reported to the RBA on their websites.^[6] For each retail brand, data is publicly disclosed on the percentage availability of their retail payment services,^[7] the length of any significant outage caused by incidents arising from within the institution and the length of any significant outage caused by issues arising from system-wide infrastructure issues or natural disasters. If the institutions operate multiple brands, disclosures should be made at the retail brand level, given that households and businesses interact with these brands for their payment and banking services.

The RBA uses the full set of information reported by the institutions to update the Payments System Board on progress towards one of its key strategic priorities – to strengthen the resilience of payments and market infrastructure. Through this dataset, the RBA is able to monitor the reliability of payments services and work with industry to minimise the occurrence of incidents that might impact the day-to-day activity of households and businesses. The RBA is currently drawing on the data to understand the system-wide reliability of the payments system and to identify if there is a need for additional resilience and redundancy within certain parts of the system.

Availability of retail payment services

Fast transfers and online banking have the highest number of significant outages relative to other retail payment services (Table 1). Online banking and fast transfers have also recorded the most hours of significant outages since the dataset’s inception. Access to online banking is increasingly essential for end-users making fast and next-day transfers. As a result of this dependency, online banking outages can have a greater impact on end-users by also disrupting the ability of consumers to use other payment rails. While the median length of significant outages for next-day transfers is higher than other retail payment services, this is a product of the different reporting criteria for next-day transfers. Indeed, the average quarterly duration of planned outages to next-day payments is approximately 1⅓ hours, which is lower than other payment rails.

Overall, payment services have high aggregate levels of reliability. All retail payment offerings have an average availability of 99.80 per cent or higher per quarter. Making and accepting card payments have the highest service availability, while fast transfers, next-day transfers and online banking are more likely to experience service disruptions. Despite the overall high average service availability, a singular significant outage can cause economic harm for affected end-users and has the potential to transmit systemic issues across the payments system and economy. For this reason, the RBA engages with industry to understand the causes of outages and to encourage work to reduce their further occurrence.

Across all retail payment services, brands have incurred approximately 30 outages on average since the dataset’s inception (Graph 1). The average aggregate duration of these outages has been 110 hours. As shown in Graph 1, the majority of brands have performed better than the average. Indeed, a significant portion of retail payment incidents are attributable instead to a select number of institutions that have reported outages that are significantly higher than the average brand.

Frequency of retail payment incidents and outages

The total number of incidents and outages has trended downwards over the time that the RBA has collected the data (Graph 2). The overall reduction in outages has been driven by falls in the number of fast transfers and online banking outages. As stated above, it is possible for multiple outages to arise from a single incident. While the number of incidents causing one service outage has fallen in recent quarters, the number of incidents causing multiple service outages has not fallen to the same extent. The RBA will be analysing future data to see if there is persistency in the number of incidents causing multiple outages and whether this is indicative of increased interdependency between services within the modern payment system.

The total duration of outages has not decreased alongside the fall in the overall volume of outages. For example, the number of outages reported in the March quarter of 2024 was the lowest to date, but there has not been any notable fall in total outage duration relative to previous quarters. This insight suggests that the overall impact of service outages has not decreased, despite institutions taking action to reduce the number of incidents. The largest total duration of outages since the dataset’s inception occurred in the December quarter of 2022 (Graph 3). This spike was partly due to an incident affecting RBA-operated payments infrastructure on which some account-to-account transfers rely.^[8]

Retail payment outages across business days

Certain payment rails such as fast transfers or card payments are time critical. Consumers and businesses have an expectation that these services will be continuously available – that is, 24/7 – and so any outage preventing transactions can have a significant impact on them. For example, a non-cash carrying customer’s ability to pay for physical goods will be limited when there is a card outage. Furthermore, a consumer wishing to make an online card payment to secure a discounted price for a product would be affected if an outage occurred and the card payment service was not available; it could mean the consumer has to pay a higher price for the same item when the outage is rectified. For online banking, fast transfers and card payments, outages are reported for all days, including non-business days, since the 24/7 nature of these services means that outages at any time potentially having an impact on end-users (Graph 4).

By contrast, next-day transfers are used for transactions that need to arrive on a particular future date and time and where scheduling is understood in advance. For example, recurring transactions such as salary, direct debits and planned welfare payments need to be available in recipient accounts at a date that can be planned for and set up in advance. As a result, there is a greater ability for an incident affecting next-day transfers to be resolved throughout the day without any immediate impact on end-users; consumers will only be affected if an incident has not been concluded by the end of the day. Outages to next-day transfers are only reported as occurring on business days, given that end-users expect next-day transfer services to be available on business days.

Operational risk

Regulators monitor the management of operational risk by payments and market infrastructures to ensure that the infrastructure is robust and supports financial stability. For payment systems, operational risk can arise from deficiencies in internal processes, human error or external events (CPSS and IOSCO 2012). The effective management of operational risk by payment system operators and payment service providers is increasingly important, as the interconnectedness of the ecosystem means that a singular incident has the potential to cascade and create systemic issues across the ecosystem (RBA 2023).

The retail payment incidents dataset captures information on the root causes of incidents and so provides insights into common issues relating to operational risk management. The leading cause of outages are issues with third parties (Table 2). Payment rails rely on various service providers, ranging from information technology and utility service providers to parties that clear or settle retail payments. As a result, regulators such as the RBA and the Australian Prudential Regulatory Authority (APRA) have taken steps to encourage institutions to uplift their management of potential sources of risk from service providers, while also encouraging service providers to consider potential risks they could pose to these institutions (Lonsdale 2024; RBA 2023).

Outages are also often caused by technology issues and change management processes. Technological issues typically arise from software, hardware and infrastructure failures, while outages deriving from change management issues arise from incorrectly carried out installations or failures to follow adequate procedures and verification processes.

The duration of incidents resulting in service outages vary by root cause and business day (Graph 5). Incidents have generally taken longer to resolve when they have been detected on a business day and where the cause can be traced to change management or third party issues. This may seem counterintuitive, but further investigation shows that incidents occurring on a Monday have the longest time to resolve on average, as it is common for system changes and upgrades to be scheduled over the weekend.

This insight highlights the challenges of managing incidents caused by process or technological changes that are introduced outside of business hours and the importance of effective testing when system changes are implemented. As consumers increasingly expect retail payment services such as card payments, fast transfers and online banking to be available 24/7, it is important that service providers have the ability to swiftly address outages, irrespective of whether they arise within or outside of business hours.

Conclusion

This article provides insights into the Australian retail payments ecosystem from the RBA’s collection of retail payments incidents data reported and publicly disclosed by certain institutions. Standardised reporting and publication of data has provided greater transparency for the public and industry. The public is now able to analyse the reliability of their service provider, while industry can compare the reliability of their services with those of other providers.

Payment services overall have high aggregate levels of reliability. However, incidents affecting the reliability and availability of retail payments can have a serious impact on customers, businesses and the broader economy. Significant outages are most likely to occur for online banking and fast transfer services. The importance of industry in effectively managing operational risks relating to payment systems will continue to be emphasised by the RBA in its efforts to promote financial stability. The retail payment incidents database will continue to be an important source of information in this regard.

Endnotes

The authors are from Payments Policy Department. They are grateful to Stephanie Bolt, Ellis Connolly, Declan Hunt, Sushmitha Kasturi, Elizabeth Kandelas, Kristin Langwasser, Konrad Szylar, Grant Turner and colleagues in Payment Settlements Department for comments on this article. They also wish to acknowledge the work of Grant Turner and Elizabeth Kandelas in establishing these data collection, and Sally Wong for helping to collect data used in this article. [*]

Fast transfers refer to account-to-account transfers to a PayID and other one-off or scheduled payments made through NPP/Osko. NPP is the New Payments Platform. [1]

Next-day transfers refer to account-to-account transfers and scheduled payments not made as fast payments through NPP/Osko and BPAY payments. [2]

Authorised deposit-taking institutions are financial institutions such as banks, building societies and credit unions that are licensed by APRA to carry on banking business, including accepting deposits from the public. [3]

Active members of the Reserve Bank Information and Transfer System (RITS) that are direct clearing or settlement participants in the NPP, Bulk Electronic Clearing System (BECS) or BPAY payment systems are also required to provide this information to the RBA. However, they are not obliged to publicly disclose this information. [4]

A major geographical area is defined as an entire capital city metropolitan area or 50 per cent of ATMs, branches, card payment transactions or point-of-sale terminals in the rest of a state or territory. For a more detailed explanation of the RBA’s data collection, see RBA (2022). [5]

For a compilation of links to published statistics, see RBA (undated). [6]

The service availability is the actual amount of time that the service is not experiencing an unplanned significant outage, as a proportion of the amount of time the service was planned to be available in the quarter. [7]

For further detail about this outage, see Deloitte (2023). [8]

References

CPSS and IOSCO (Committee on Payment and Securities Systems and the Technical Committee of the International Organisation of Securities Commissions) (2012), ‘Principles for Financial Market Infrastructure’, April.

Deloitte (2023), ‘Independent Review of the October 2022 Reserve Bank Information and Transfer System (RITS) Outage’, Final Report, April.

Lonsdale J, ‘Severe but Plausible: Taking a Wider View of Risk’, Speech at the AFR Banking Summit, 26 March.

Nguyen T and B Watson (2023), ‘Consumer Payment Behaviour in Australia’, RBA Bulletin, June.

RBA (Reserve Bank of Australia) (2021), ‘New Statistical Disclosures on Retail Payment Service Reliability’, Media Release No 2021-15, 15 November.

RBA (2022), ‘Quarterly Disclosures – Retail Payment Service Reliability’, Explanatory Information, March.

RBA (2023), ‘5.5 Focus Topic: Operational Risk in a Digital World’, Financial Stability Review, October.

RBA (undated), ‘Disclosures on Retail Payments Service Reliability’.