.jpg)
The TSE imposed a fine of JPY 3 million on Rakuten Securities, Inc. (hereafter "Rakuten Securities" or "the company") as the company's management of the electronic information processing system relating to financial instruments business was deemed insufficient. The TSE also requested Rakuten Securities to submit a business improvement report regarding the following actions:
- (i) Classify the problems foreseen during recovery of any electronic system glitch by verifying past cases of glitches, and take effective measures;
- (ii?Clarify the locus of responsibility (including the management level), considering two past business improvement orders by the FSA and two past disciplinary actions by the TSE for insufficient management of the electronic information processing system;
- (iii) Draw up an improvement plan covering each field of planning, developing, management, and maintenance, etc. and implement the plan, in order to establish the preparation for stable management of the electronic information processing system;
- (iv) Verify the effectiveness of system management by conducting external system audit which covers the whole electronic information processing system when the improvement plan mentioned (iii) above is drawn up and implemented, and prepare for adjustments in light of the result of the external system audit; and
- (v) Remind officers and employees about the importance of system management, and implement the necessary system reviews and training, etc. to secure an appropriate business execution system.
Outline of Violation
On November 11, 2008, Rakuten Securities caused a large-scale system glitch which affected all customers. All order acceptance was suspended for approximately seven hours, a period including the day's morning session. On January 13, 2009, Rakuten Securities caused another system glitch which affected 3,024 customers. Order submission was delayed for nearly five hours, a period including the day's morning session. As a result, Rakuten Securities was acknowledged that it had failed to take the proper measures to avoid unnecessary confusion in customers when a glitch occurs, and that measures to prevent escalation or minimize damage caused by a system glitch, and arrangements for a system with the purpose of recovery from such a glitch were insufficient.
The above is acknowledged to be a 'situation deemed to be an insufficient management of the electronic information processing system relating to financial instruments business, etc.' as defined in Article 123, Item 14 of the Cabinet Office Ordinance on the Financial Instruments Business based upon Article 40, Item 2 of the Financial Instruments and Exchange Act.
A summary of the system glitches is as follows.
- System glitch on November 11, 2008
- A glitch (primary glitch) was caused by a defect in the database product. A secondary glitch occurred due to human error by the vendor when manual reboot of the said product during system recovery caused order acceptance to be suspended. There was no double-checking of the result of such high-risk emergency operations, and the company failed to check the result of the operation. As a result, the system to prevent operational errors was deemed insufficient.
- A secondary glitch was caused by the vendor failing to boot some systems due to an omission in the vendor's reference manual for such operations. The company was deemed to have failed to ensure the effectiveness of such manuals, and its check on the range of effect of the glitch was deemed insufficient.
- Orders that required corrections were accepted due to deficiencies in the company's system of removing the suspension of order acceptance and user login.
- System glitch on January 13, 2009
- During system consolidation in February 2008, the company failed to have a system of vigorous checks on order submission system network settings, and it failed to detect an erroneous setting. As a result, the system to prevent operational errors was deemed insufficient.
- As a result of the above error, in an attempt at system recovery, the company tried to route orders in the above system to another order submission system connected to the TSE. However, the procedure manual for such recovery operations did not provide guidance on such a case.
- Due to deficiencies in the standard or policy to void orders, there was a delay in the decision by the committee dealing with such matters in the company on appropriate action. Customers who placed such orders were unable to correct or cancel their orders, and the transaction potential of these orders was curbed for a signification period of time.
A major internet securities company such as Rakuten Securities is expected to have a system in place to appropriately address issues such as development and operation of durable systems and measures in response to technical glitches. However, the company had caused large-scale system glitches despite a history of receiving two past administrative punishments from the FSA. As such, in addition to measures in response to the above actual events, further measures to establish a system to secure stable system operation are deemed necessary.
