After Rogers outage, Interac failure highlights need for more risk oversight, competition in payments space, observers say

On July 8, when Rogers Communications Inc.'s network went down nationwide, millions lost access to phone, data, and internet services, but many also lost access to banking and debit functions through the failure of the Interac Corp. system. Rogers CEO Tony Staffieri has apologized for the outage, and has blamed the outage on a maintenance update in the core network, and the company will spend tens of millions, according to analysts, on customer credits and customer retention spending. But as stores across the country went cash-only or shut their doors for the day, it became clear how dependent Interac was on the Rogers network. At 10:35 a.m. on the day of the outage, Interac tweeted that Interac debit was down both online and at store checkouts, and that e-transfer was "unavailable at most financial institutions." "Having a payment system like Interac e-Transfer down for 24 hours isn’t acceptable," a Bank of Canada spokesperson wrote in a statement emailed to the Wire Report. Oversight for Interac is split between the Bank of Canada and the Financial Consumer Agency of Canada, with neither claiming responsibility for oversight of telecommunications risk management for Interac's debit system. For executive director of Paytechs of Canada Association and former Payments Canada employee Alex Vronces, the Rogers outage and subsequent Interac failure points to the need for increased regulation in the payments sector. "The government has most of the tools at its disposal. It just has to amend them slightly, or use what it has more effectively," Vronces said in an interview with the Wire Report. Vronces recommended amending the Canadian Payments Act to allow for greater competition in the payments sector. "Financial stability and security shouldn't be an excuse to not promote more competition in relation to payments. Because as the Rogers outage just showed us, it is a false trade off. In fact, the lack of competition exacerbated the problem by putting all of our eggs in one basket," Vronces said. For Centre for International Governance Innovation fellow and former Competition Bureau special advisor Keldon Bester, the reliance on efficiency in both the telecommunications and payment space has occasionally come at the expense of resiliency, adding that the outage was a "wake up call." "Why was there no back up?" Bester said in relation to Interac. "That's a technical question, but I think it is a product of the idea that we've said 'well, if we just have the biggest companies we can get, they should be able to handle it." "Its an example of how telecom policy is really directly tied to so many other important areas. We think that cell phones are the most important things on the planet," Bester said, "but the payment system is how the economy functions." "There will suddenly be, at least for some period of time, a policy attention on this nexus of communication and commerce," Bester said. Payment systems in Canada are governed by two pieces of legislation, the Canadian Payments Act of 1985 and the Payment Clearing and Settlement Act of 1996. Under the latter, the Bank of Canada can designate payments systems like Interac as what are referred to as "prominent payment systems" (PPS). The designation subjects the payment system to a number of risk management standards and risk controls. In August, 2020, Bank of Canada Governor Tiff Macklem designated Interac as a PPS. In a release at the time, the Bank of Canada pointed to the scale of Interac's importance. "Interac e‑Transfer has become central to the Canadian payments system," the statement read, pointing out that in the 2019 fiscal year, the Interac e-transfer system facilitated over 486 million transactions totalling $169 billion. "A disruption or failure of the Interac e‑Transfer system could cause a significant adverse effect on economic activity in Canada, potentially leading to a general loss of confidence in the overall Canadian payments system." Under the Bank of Canada's risk-management standards, published in December 2020 under the auspices of the organization Payments Canada, standard 12 holds that a PPS like Interac "should identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of appropriate systems, policies, procedures and controls" "Systems should be designed to ensure a high degree of security and operational reliability and should have adequate, scalable capacity," the standard reads. In a statement provided to the Wire Report, Bank of Canada spokesperson Paul Badertscher explained that once a payment system is designated as "prominent" – as Interac was in 2020 – the Bank of Canada begins its oversight process. Designation doesn't mean that the system fully adheres to the Bank's risk management standards. Rather, the "system operator and Bank reach a Memorandum of Understanding regarding the specifics of how the oversight will take place. Then, the bank starts a series of 'core assurance reviews', where we look at various risks over a three-year cycle," Badertscher wrote. "The Bank of course recognizes the importance of managing risk associated with a single point of failure in the provision of critical financial services," Badertscher wrote. "A core part of our oversight expectations for designated payment systems is that they appropriately identify, monitor and manage the risks that their critical service providers—such as telecom and utility providers—have on the operational reliability of their system, in order to ensure that payment services are available on a continuous basis." Badertscher added that the Bank and Interac were in communication throughout the outage, and wrote that the company "is taking immediate steps to add a supplier to strengthen their existing network redundancy so Canadians can continue to rely on its services." Because oversight of Interac is split between two federal bodies, the Bank of Canada and its risk-management framework is only responsible for the oversight of Interac's e-transfer function. The company's debit function is not designated as a PPS by the Bank of Canada, and responsibility for its oversight falls to the FCAC according to the Bank, which maintains the Canadian Code of Practice for Consumer Debit Card Services. The Bank of Canada spokesperson referred questions about risk management of Interac's debit system to the FCAC. While the FCAC declined to answer specific questions about oversight of risk on Interac's network or proactive steps taken by the agency in the wake of the outage, the agency said in a statement emailed to the Wire Report that the Code shields cardholders from liability if there are losses resulting from circumstances beyond their control. "Such circumstances include, but are not limited to technical problems, card issuer errors and other system malfunctions," the statement read. A separate code maintained by the FCAC, the Code of Conduct for the Credit and Debit Card Industry in Canada, contains a number of requirements about fees and notifications to merchants and the general relationship between merchants and debit card companies, but nothing about managing the risk of network outages. An FCAC spokesperson referred questions "on operational matters" to Interac itself, and referred questions about operational risk controls for Interac's debit system back to the Bank of Canada. Interac declined to answer questions about oversight of its telecommunications risk management, but pointed to its July 12 statement, in which the company wrote that it is "adding supplier diversity to strengthen our existing network redundancy so Canadians can continue to rely on our services daily." Network redundancy refers to having multiple communication pathways within a network, so that a single failure doesn't take down the whole system. "Each of our platforms, both Interac Debit and Interac e-Transfer, have redundant networks, including circuit diversity," Interac wrote. "These redundant networks with circuit diversity should not have been so vulnerable to the Rogers core maintenance activity." “While this was not an Interac technology failure, the unforeseen system-wide outage for Rogers had a direct impact on our ability to deliver for our customers. We carry the responsibility and accountability of ensuring that Canadians can transact with confidence every day for their essentials – to buy groceries, put gas in the car, send money for rent, or authenticate their information for digital services,” Interac CEO and president Mark O’Connell said in the release. – Reporting by Michael Lee-Murphy at mleemurphy@thewirereport.ca and editing by Jenna Cocullo at jcocullo@thewirereport.ca.

After Rogers outage, Interac failure highlights need for more risk oversight, competition in payments space, observers say

News | July 21, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

After Rogers outage, Interac failure highlights need for more risk oversight, competition in payments space, observers say

News | July 21, 2022

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Google refutes Competition Bureau’s claims in ad market suit

Rogers fights back in dispute with Competition Bureau over ‘Infinite’ data plans

OPINION: More competition does not require new competitors

Competition Bureau suing Google for alleged anti-competitive ad practices

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us