Conditions imposed on Kiwibank document scanners

Strict security and business control assurances imposed by the Reserve Bank and international authorities

After years of cumbersome paper-based processes for approving loans, Kiwibank is about to take its second step towards completely paperless operation.

But what may seem like a minor purchase of document scanning equipment has been encumbered with strict security and business control assurances imposed by the Reserve Bank and international authorities.

In the event of the scanning service being outsourced, says a request for proposal, the supplier must agree to the Reserve Bank’s conditions on outsourcing, known as BS11.

These conditions state that against the possibility of “stress or failure” of the bank or any of its external suppliers, the bank must retain “legal and practical ability to control and execute any business, and any functions relating to any business” sufficient to enable it to meet its clearing and settlement obligations, know its financial position and give its customers “access to payments facilities on the day following any failure and on subsequent days.”

In practice this may mean, for example, modification to the supplier’s normal conditions for licensing software, the bank’s request for proposal document says.

Kiwibank’s supplier will also be obliged to satisfy the payment card industry data security standard (PCI DSS).

The effectiveness and relevance of the PCI DSS standard is the subject of some debate. Late last year security specialist Kyle Gibson estimated that only about 30 percent of New Zealand merchants had complied with it.

Prior to November last year, Kiwibank processed loan applications from its mobile mortgage managers via paper files, which were in some instances printouts of information already held electronically. Paper files were physically moved between Kiwibank departments until the completion of the loan agreement, when the whole document collection was scanned into a central electronic system.

A SharePoint database was implemented in November 2012 as a first step. The newly requested document-capture equipment is expected to enable electronic transmission to be pushed further out into the bank’s branch network, eliminating more paper, with a consequent reduction in workload and speeding of service to customers.

Responses to the RFP must be submitted by March 13 and a supplier is expected to be selected around May.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Show Comments