Today, Mizuho Financial Group, Inc. and Mizuho Bank, Ltd. received a business improvement order from the Financial Services Agency of Japan, pursuant to the provisions of Article 52-33, Paragraph 1 and Article 26, Paragraph 1 of the Banking Act of Japan, in regard to the series of IT system failures that have occurred since February 28, 2021.
Also today, Mizuho Bank received a corrective action order from the Ministry of Finance of Japan, pursuant to the provisions of Article 17-2, Paragraph 1 of the Foreign Exchange and Foreign Trade Act of Japan, in regard to the performance of the confirmation obligations of banks under Article 17 of said act.
As a financial institution bearing responsibility for maintaining societal infrastructure, we deeply apologize for the inconvenience and concern we have caused to our customers and society by allowing these system failures to occur repeatedly in a short period of time and, as a consequence, failing to adequately fulfill our role in facilitating smooth settlements and failing to adequately ensure thorough operations under the Foreign Exchange and Foreign Trade Act of Japan.
Both Mizuho Financial Group and Mizuho Bank are treating the Financial Services Agency's business improvement order and the Ministry of Finance's corrective action order with the utmost seriousness. We are fully accounting for our mistakes and endeavoring to formulate and implement business improvement plans and measures to prevent further incidents in conformance with the orders.
I. Details of the business improvement order from the Financial Services Agency of Japan
Mizuho Bank: Banking Act of Japan Article 26, Paragraph 1
1. Promptly implement the measures Mizuho Bank has formulated to prevent further incidents in regard to system failures.
2. Formulate a business improvement plan covering the following items and promptly implement the plan. Reassess and review the business improvement plan on an ongoing basis.
(1) Measures to prevent further incidents in regard to system failures, to include any measures identified as necessary through the reassessment and review process
(2) Specific initiatives to put in place a corporate management (governance) framework that will ensure stable operations in IT systems
(3) Specific initiatives to improve operations, addressing the root causes of the system failures
3. Clarify and report on the responsibility of management in line with the causes of the system failures and other factors.
4. Submit the business improvement plan based on 2. above and the report based on 3. above by Monday, January 17, 2022, together with the status of implementation, as of December 31, 2021, of the measures to prevent further incidents based on 1. above.
5. Summarize the progress made in implementing the business improvement plan (including the reassessment and review of the plan) every three months, starting with the three months to March 31, 2022, and report the summary by the 15th day of the following month.
Mizuho Financial Group: Banking Act of Japan Article 52-33, Paragraph 1
1. Promptly implement the measures Mizuho Financial Group has formulated to prevent further incidents in regard to system failures.
2. As the bank holding company, formulate a business improvement plan covering the following items (including reassessment and review as needed of the business improvement plan formulated by Mizuho Bank) and promptly implement the plan. Reassess and review the business improvement plan on an ongoing basis.
(1) Measures to prevent further incidents in regard to system failures, to include any measures identified as necessary through the reassessment and review process
(2) Specific initiatives to put in place a corporate management (governance) framework that will ensure stable operations in IT systems
(3) Specific initiatives to improve operations, addressing the root causes of the system failures
3. Clarify and report on the responsibility of management at Mizuho Financial Group in line with the causes of the system failures and other factors
4. Submit the business improvement plan based on 2. above and the report based on 3. above by Monday, January 17, 2022, together with the status of implementation, as of December 31, 2021, of the measures to prevent further incidents based on 1. above.
5. Summarize the progress made in implementing the business improvement plan (including the reassessment and review of the plan) every three months, starting with the three months to March 31, 2022, and report the summary by the 15th day of the following month.
II. Details of the corrective action order from the Ministry of Finance of Japan
Mizuho Bank: Foreign Exchange and Foreign Trade Act of Japan Article 17-2, Paragraph 1
1. Formulate effective measures to improve operations and prevent further incidents in order to fully comply with the provisions of the Foreign Exchange and Foreign Trade Act in regard to economic sanctions such as asset freezes, as well as to fully comply with the provisions of the business improvement order based on said act.
(1) Reassess the causes of the failure to appropriately perform the bank's confirmation obligations under the provisions of Article 17 of the Foreign Exchange and Foreign Trade Act and the decision-making and events that led to said failure. Based on this, formulate effective measures to improve operations and prevent further incidents in order to redevelop the internal control structure appropriately for all economic sanctions, such as asset freezes, required by the Foreign Exchange and Foreign Trade Act.
(2) Establish an audit framework to verify the efficacy of the analysis of the causes reassessed in (1) above; the appropriateness of the measures to improve operations and prevent further incidents, in light of the causes and decision-making processes above; and the proper implementation of said measures to improve operations and prevent further incidents.
2. Submit a report on the measures to improve operations and prevent further incidents based on 1. (1) above (including measures already taken) and on the establishment of the audit framework based on 1. (2) above by Friday, December 17, 2021. Promptly implement the measures. Promptly submit additional reports should there by any changes or additions to the measures to improve operations and prevent further incidents or the establishment of the audit framework. For the immediate future, report on the implementation status of the measures to improve operations and prevent further incidents and the establishment of the audit framework (including any changes or additions) at the end of each quarter, beginning from January 2022.
Measures to prevent further incidents based on administrative actions (PDF/106KB)
(Attachment) Additional penalties for executives (PDF/573KB)