The Reliability of Retail Payment Services


Photo: gremlin – Getty Images

Abstract

Australians are increasingly dependent on the continuous availability of electronic payment systems. As such, every incident or outage can potentially cause inconvenience or economic harm for end-users of those systems. This article presents insights into the reliability of payment systems using information from the RBA’s retail payment incidents dataset. The article notes that retail payment services have an average availability of at least 99.8 per cent each quarter. Online banking and fast payments services are most likely to be affected from outages, with root causes relating to issues with third parties, software and change management. Given the wide-reaching impact of outages, the effective management of operational risk in the payments system has never been more important.

Introduction

The safe and reliable operation of payment systems is critical to the operation of the Australian economy. Most salary, pension and welfare payments are made via account-to-account payments (electronic transfers between bank accounts) and over 75 per cent of consumer transactions are made through electronic payment rails such as debit and credit cards (Nguyen and Watson 2023). This reliance on electronic payment methods means that any disruption to the provision of these services (i.e. an outage) can have serious impacts on customers, businesses and the broader economy.

Recognising the growing importance of payment service availability, in 2012 the RBA started collecting incident reports from payment service providers on unplanned retail payment service outages. Following an increase in payment systems outages over 2018 and 2019, the RBA collaborated with industry to improve the quality of the RBA’s data collection by establishing a standardised set of statistics to measure operational outages in retail payments.

To support the transparency of retail payment service reliability, the RBA also expects individual providers of payment services to publish a standardised set of statistics about the availability of their services on their websites (RBA 2021). These disclosures commenced in November 2021. Public disclosure has enabled retail payment service providers to benchmark their performance against competitors, while also providing an incentive for service providers to improve the reliability of their own offerings. Disclosure has also provided the general public with more visibility on the reliability of their current retail payment service providers and an ability to compare their performance to other providers.

This article presents insights from the RBA’s collection of retail payment incident statistics. It provides an overview of the dataset, including which service providers report and what they report to the RBA each quarter. The article then presents information about the availability of the different types of retail payment services. It also provides information on the root causes of outages and discusses the importance of managing operational risk.

The retail payment incidents dataset

The RBA expects certain financial institutions to report and publicly disclose data on the reliability of their retail payment services. These retail payment services include ATM, branch and online banking services, services provided to merchants to accept card payments, services provided to customers to make card payments, fast payments and next-day payments.

The institutions expected to report and disclose reliability data are those that provide payment and banking services to individual and business customers, and that are either ranked within the top 25 largest authorised deposit-taking institutions or acquire card transactions for merchants (RBA 2022).

The information that the institutions disclose each quarter to the RBA is summarised in Figure 1 and includes:

  • the time and date of any incident that affected the institution’s ability to provide retail payment services, the root cause of the incident, the time taken for the incident to be detected and the time taken for the incident to be resolved
  • the length of any outage to a retail payment service caused by an incident and the proportion of customers affected by an outage
  • the total number of hours that the institution planned to provide retail payment services to customers, the total length of any planned or unplanned outage that affected any retail payment service and the overall percentage availability of the retail payment service.
Figure 1

Retail Payment Incidents Reporting Structure

Figure 1: A diagram depicting the reporting structure of the retail payment incidents dataset. Institutions report incident, outage and service availability information.

An institution should report any ‘significant outage’ that lasts for more than 30 minutes or, for next-day payments, if a next-day account transfer cannot be processed by the end of the day. A significant outage also includes an outage that impacts either 10 per cent of customers for that service or impacts a major geographical area for ATM, branch or card payment services. One downside of this definition is that it does not capture some localised outages, such as those caused by natural disasters affecting regional communities, which can be very disruptive for the consumers and businesses impacted.

Under the agreement with industry, disclosing institutions publish a subset of the information reported to the RBA on their websites. For each retail brand, data is publicly disclosed on the percentage availability of their retail payment services, the length of any significant outage caused by incidents arising from within the institution and the length of any significant outage caused by issues arising from system-wide infrastructure issues or natural disasters. If the institutions operate multiple brands, disclosures should be made at the retail brand level, given that households and businesses interact with these brands for their payment and banking services.

The RBA uses the full set of information reported by the institutions to update the Payments System Board on progress towards one of its key strategic priorities – to strengthen the resilience of payments and market infrastructure. Through this dataset, the RBA is able to monitor the reliability of payments services and work with industry to minimise the occurrence of incidents that might impact the day-to-day activity of households and businesses. The RBA is currently drawing on the data to understand the system-wide reliability of the payments system and to identify if there is a need for additional resilience and redundancy within certain parts of the system.

Availability of retail payment services

Fast transfers and online banking have the highest number of significant outages relative to other retail payment services (Table 1). Online banking and fast transfers have also recorded the most hours of significant outages since the dataset’s inception. Access to online banking is increasingly essential for end-users making fast and next-day transfers. As a result of this dependency, online banking outages can have a greater impact on end-users by also disrupting the ability of consumers to use other payment rails. While the median length of significant outages for next-day transfers is higher than other retail payment services, this is a product of the different reporting criteria for next-day transfers. Indeed, the average quarterly duration of planned outages to next-day payments is approximately 1⅓ hours, which is lower than other payment rails.

Overall, payment services have high aggregate levels of reliability. All retail payment offerings have an average availability of 99.80 per cent or higher per quarter. Making and accepting card payments have the highest service availability, while fast transfers, next-day transfers and online banking are more likely to experience service disruptions. Despite the overall high average service availability, a singular significant outage can cause economic harm for affected end-users and has the potential to transmit systemic issues across the payments system and economy. For this reason, the RBA engages with industry to understand the causes of outages and to encourage work to reduce their further occurrence.

Table 1: Availability of Retail Payment Services

September quarter 2021 to March quarter 2024

Service Total number of significant outages Total length of significant outages
(hrs)
Median length of significant outages
(hh:mm)
Average quarterly planned outages
(hh:mm)
Average service availability
(%)
ATMs 39 379 2:06 4:58 99.91
Branches 42 101 1:39 6:34 99.90
Make card payments 79 249 1:47 2:24 99.97
Accept card payments 23 72 1:55 1:45 99.98
Fast transfers 415 1316 2:10 5:02 99.81
Online banking 532 1478 1:26 8:42 99.82
Next-day transfers 36 477 7:52 1.22 99.85

Source: RBA.

Across all retail payment services, brands have incurred approximately 30 outages on average since the dataset’s inception (Graph 1). The average aggregate duration of these outages has been 110 hours. As shown in Graph 1, the majority of brands have performed better than the average. Indeed, a significant portion of retail payment incidents are attributable instead to a select number of institutions that have reported outages that are significantly higher than the average brand.

Graph 1

Graph 1: A scatter plot of the number and duration of service outages by brands from September quarter 2021 to March quarter 2024. It shows that there is wide variation in the number and duration of outages across brands.

Frequency of retail payment incidents and outages

The total number of incidents and outages has trended downwards over the time that the RBA has collected the data (Graph 2). The overall reduction in outages has been driven by falls in the number of fast transfers and online banking outages. As stated above, it is possible for multiple outages to arise from a single incident. While the number of incidents causing one service outage has fallen in recent quarters, the number of incidents causing multiple service outages has not fallen to the same extent. The RBA will be analysing future data to see if there is persistency in the number of incidents causing multiple outages and whether this is indicative of increased interdependency between services within the modern payment system.

Graph 2

Graph 2: A bar chart of the total service outage and incidents per quarter from September quarter 2021 to March quarter 2024. It shows that the number of outages and incidents has fallen in recent quarters.

The total duration of outages has not decreased alongside the fall in the overall volume of outages. For example, the number of outages reported in the March quarter of 2024 was the lowest to date, but there has not been any notable fall in total outage duration relative to previous quarters. This insight suggests that the overall impact of service outages has not decreased, despite institutions taking action to reduce the number of incidents. The largest total duration of outages since the dataset’s inception occurred in the December quarter of 2022 (Graph 3). This spike was partly due to an incident affecting RBA-operated payments infrastructure on which some account-to-account transfers rely.

Graph 3

Graph 3: A bar chart of the duration of service outages and incidents per quarter from September quarter 2021 to March quarter 2024. It shows that there has not been any equivalent fall in the duration of outages or incidents.

Retail payment outages across business days

Certain payment rails such as fast transfers or card payments are time critical. Consumers and businesses have an expectation that these services will be continuously available – that is, 24/7 – and so any outage preventing transactions can have a significant impact on them. For example, a non-cash carrying customer’s ability to pay for physical goods will be limited when there is a card outage. Furthermore, a consumer wishing to make an online card payment to secure a discounted price for a product would be affected if an outage occurred and the card payment service was not available; it could mean the consumer has to pay a higher price for the same item when the outage is rectified. For online banking, fast transfers and card payments, outages are reported for all days, including non-business days, since the 24/7 nature of these services means that outages at any time potentially having an impact on end-users (Graph 4).

By contrast, next-day transfers are used for transactions that need to arrive on a particular future date and time and where scheduling is understood in advance. For example, recurring transactions such as salary, direct debits and planned welfare payments need to be available in recipient accounts at a date that can be planned for and set up in advance. As a result, there is a greater ability for an incident affecting next-day transfers to be resolved throughout the day without any immediate impact on end-users; consumers will only be affected if an incident has not been concluded by the end of the day. Outages to next-day transfers are only reported as occurring on business days, given that end-users expect next-day transfer services to be available on business days.

Graph 4

Graph 4: A bar chart of the duration of outages across business and non-business days from September quarter 2021 to March quarter 2024. Outages to next-day transfers only occur on business days, while fast transfers and online banking have a proportion occur on non-business days.

Operational risk

Regulators monitor the management of operational risk by payments and market infrastructures to ensure that the infrastructure is robust and supports financial stability. For payment systems, operational risk can arise from deficiencies in internal processes, human error or external events (CPSS and IOSCO 2012). The effective management of operational risk by payment system operators and payment service providers is increasingly important, as the interconnectedness of the ecosystem means that a singular incident has the potential to cascade and create systemic issues across the ecosystem (RBA 2023).

The retail payment incidents dataset captures information on the root causes of incidents and so provides insights into common issues relating to operational risk management. The leading cause of outages are issues with third parties (Table 2). Payment rails rely on various service providers, ranging from information technology and utility service providers to parties that clear or settle retail payments. As a result, regulators such as the RBA and the Australian Prudential Regulatory Authority (APRA) have taken steps to encourage institutions to uplift their management of potential sources of risk from service providers, while also encouraging service providers to consider potential risks they could pose to these institutions (Lonsdale 2024; RBA 2023).

Outages are also often caused by technology issues and change management processes. Technological issues typically arise from software, hardware and infrastructure failures, while outages deriving from change management issues arise from incorrectly carried out installations or failures to follow adequate procedures and verification processes.

Table 2: Number of Outages to Fast and Next-day Payments by Root Cause

September quarter 2021 to March quarter 2024

Root cause Accepting card payments Making card payments Online banking Fast transfers Next-day transfers Total
Change management(a) 8 11 123 64 5 211
Operational(b) 2 3 28 19 1 53
Technology(c) 4 22 246 97 11 380
Third party(d) 9 43 135 235 19 441
Total 23 79 532 415 36 1,085

(a) An outage will have a change management root cause if the outage arose from changes carried out without following proper change management procedures, incorrectly carried out installations or other change activities, inadequate pre- and post-implementation verification or outages caused by a requirement to back out a planned change.
(b) An incident will have an operational root cause if there is an operational failure (e.g. not following procedures, insufficient controls, inadequate monitoring, failure to detect or appropriately respond to alerts or a failure to apply incident prevention where it may have been possible).
(c) An incident will have a technological root cause if there is a software or application failure, an infrastructure or hardware issue or a malicious attack on target systems.
(d) An incident will have a third party root cause if there is a network or communications failure, a service provider failure, a system-wide infrastructure error or a natural disaster.

Source: RBA.

The duration of incidents resulting in service outages vary by root cause and business day (Graph 5). Incidents have generally taken longer to resolve when they have been detected on a business day and where the cause can be traced to change management or third party issues. This may seem counterintuitive, but further investigation shows that incidents occurring on a Monday have the longest time to resolve on average, as it is common for system changes and upgrades to be scheduled over the weekend.

This insight highlights the challenges of managing incidents caused by process or technological changes that are introduced outside of business hours and the importance of effective testing when system changes are implemented. As consumers increasingly expect retail payment services such as card payments, fast transfers and online banking to be available 24/7, it is important that service providers have the ability to swiftly address outages, irrespective of whether they arise within or outside of business hours.

Graph 5

Graph 5: A bar chart of outage duration by root cause from September quarter 2021 to March quarter 2024. Outages have generally taken the longest to resolve when they have occurred on business days.

Conclusion

This article provides insights into the Australian retail payments ecosystem from the RBA’s collection of retail payments incidents data reported and publicly disclosed by certain institutions. Standardised reporting and publication of data has provided greater transparency for the public and industry. The public is now able to analyse the reliability of their service provider, while industry can compare the reliability of their services with those of other providers.

Payment services overall have high aggregate levels of reliability. However, incidents affecting the reliability and availability of retail payments can have a serious impact on customers, businesses and the broader economy. Significant outages are most likely to occur for online banking and fast transfer services. The importance of industry in effectively managing operational risks relating to payment systems will continue to be emphasised by the RBA in its efforts to promote financial stability. The retail payment incidents database will continue to be an important source of information in this regard.

References

CPSS and IOSCO (Committee on Payment and Securities Systems and the Technical Committee of the International Organisation of Securities Commissions) (2012), ‘Principles for Financial Market Infrastructure’, April.

Deloitte (2023), ‘Independent Review of the October 2022 Reserve Bank Information and Transfer System (RITS) Outage’, Final Report, April.

Lonsdale J, ‘Severe but Plausible: Taking a Wider View of Risk’, Speech at the AFR Banking Summit, 26 March.

Nguyen T and B Watson (2023), ‘Consumer Payment Behaviour in Australia’, RBA Bulletin, June.

RBA (Reserve Bank of Australia) (2021), ‘New Statistical Disclosures on Retail Payment Service Reliability’, Media Release No 2021-15, 15 November.

RBA (2022), ‘Quarterly Disclosures – Retail Payment Service Reliability’, Explanatory Information, March.

RBA (2023), ‘5.5 Focus Topic: Operational Risk in a Digital World’, Financial Stability Review, October.

RBA (undated), ‘Disclosures on Retail Payments Service Reliability’.

Source: Reserve Bank of Australia [2021]

Leave a Reply