Our position, put simply, is that we do not believe that customers should be responsible for any security breach or system problem that is not due to negligence on their part, and we have requested that this should be reflected in the contractual agreements for internet banking services. Reputational risk Risk of damage to the bank’s reputation goes along with the other risks I have mentioned. It can arise, for example, from operational risk even if customers suffer no actual damage. If a hacker successfully 3  BIS Review 108/1999  breaks into a bank’s website and makes alterations, the bank concerned can suffer substantial damage to its reputation although customers’ balances are safe and the hacker has not obtained any financial benefit. This does not only affect the individual bank concerned but may also undermine confidence in the security of e-banking more generally and therefore slow down development in this area. Systems breakdown, even if only temporary, is another example of how banks may be affected by bad publicity. Given the fact that the element of trust is so fundamental to banks’ business, banks will find it increasingly important to adopt measures to manage reputational risk and incorporate public relations strategies into their overall risk management framework. Banking risks As I have already mentioned, an internet-based bank is faced with the same types of banking risk as its traditional counterparties. In some ways, the internet may heighten these risks.
Here, we would have to look at the circumstances of each case – whether, for example, the offshore internet bank advertised its services in the local Hong Kong press or accepted Hong Kong dollar deposits or refused to take deposits from a number of specified jurisdictions, but did not include Hong Kong among these. If we come across such cases of illegal advertisements targeted at Hong Kong, how would we deal with them? The easiest case would be where the bank itself is respectable and is based in an overseas location which is properly supervised. We could then write to the bank itself and to its supervisors to notify them of the advertising rules in Hong Kong, and request the bank either to comply with these rules or to add Hong Kong to the list of the jurisdictions from which it was not prepared to take deposits. If necessary, we would seek the cooperation of the home supervisor to enforce this request. It might also be necessary to supplement this with a reminder to local Internet Service Providers about the advertising rules in the Banking Ordinance and to seek their cooperation to block offending websites. The problem with this, however, is that the website in question may not actually be posted on the local ISP’s server – in which case, there may be little that the ISP can do. If the bank concerned is not respectable and it is based in an uncooperative jurisdiction, the situation would be more difficult to handle.