UK companies and organisations rely heavily on
payments processor Bacs’ direct credit and direct debit services
which last year processed 5.5 billion payments valued at a total of
£3.7 trillion ($7.2 trillion). For 100,000 Bacs users crucial
credit transfers include supplier payments and salaries while for
15,000 users direct debits enable receipt of 3 billion payments
annually.
Despite Bacs’ key role and advice from banks
and Bacs few businesses have a robust contingency plan in place
should the Bacs submission process fail, warns Harry Hornby, MD of
BACScontingency.com, a unit of financial services company Eagle
Consulting specialising in Bacs backup services.
Many companies assume that their Bacs system is
robust, said Hornby. However, he stressed risks are growing because
submission failures are increasing, especially since introduction
of new Bacs security procedures. In addition, whilst in the past
passwords were shared enabling any number of people to make a
submission, “those days are long gone,” he added.
Today, specific individuals are allocated
authentication devices such as smart cards, said Hornby. Input the
wrong password three times and that person will be locked out of
the Bacs system for at least two weeks while the bank issues a new
card. He noted that there have also been cases where submission
personnel have left the company and no one has ordered a card for
the new recruit, leaving the company a two week wait for a new
card.
Indicative of more serious risks, one
BACScontingency.com client reports that as a result of a damaged
card three months elapsed before their Bacs system was again fully
operational. That was before becoming a client.
Hornby pointed to hardware security modules
(HSM) used by larger organisations. If an HSM fails a replacement
takes two weeks to procure. Other risks include IT failure,
internet compromise (such as a denial of service attack), flood,
fire and theft.
Implications of a Bacs system failure are
severe, stressed Hornby referring to a study revealing that 20
percent of staff will not turn up for work on a Monday if wages
were not paid on a Friday.
“Add in the effect on cash flow of uncollected
direct debits and the impact on supplier relationships of unpaid
bills and organisations simply cannot afford to be so lackadaisical
about electronic payment,” said Hornby.
BACScontingency.com, which is endorsed by Bacs
and several major banks, provides response and back-up service in
the event of a Bacs system failure.
The service is provided on an ad hoc basis or
as a permanent solution that includes checks and a test submission
to Bacs every six months.
Cost of a permanent service is as little as £25
per month and will, said Hornby, ensure a response from
BACScontingency.com within an hour and submissions typically
completed within two or three hours.