Across Asia, regulators and bankers are asking the same question about ATM security, though they are asking it from different directions. Regulators are asking how much
guidance the industry needs before it acts. Banks are asking how much they can achieve on their own commercial judgement. The question underneath both is the same: does protecting ATM cash from physical attack require a law, or does it require a business case?
Based on the evidence from markets that have already worked through this debate, the business case is sufficient. But it only becomes sufficient when the central bank creates the right environment for it to operate. That distinction matters because it changes what banks, regulators, and central banks each do next.
What IBNS Does and Why It Is Different
Intelligent Banknote Neutralisation Systems work on a straightforward principle. When an ATM is physically attacked, the system releases indelible ink that permanently stains every banknote inside. Stained notes are rejected by deposit ATMs and by merchants. They cannot be spent or deposited. The attack may still take place, but the criminal leaves with nothing of value.
This is different from every other security measure. Stronger safes, locking bars and anchoring systems make an attack harder. Cameras and alarms assist with evidence and police response. All of these address the attack itself. IBNS addresses the reason for the attack. If the cash inside an ATM becomes worthless the moment it is stolen, there is no longer a financial incentive to steal it. That change in the criminal's calculation is what drives the reduction in attacks seen in every market where IBNS has been widely deployed.
The European Evidence
Belgium made IBNS a legal requirement in 2007. According to data from the European Cash Management Companies Association, the country recorded no cash-in transit attacks for more than thirteen years following that decision. Sweden adopted a comparable approach and has not recorded ATM attacks since 2016. Poland experienced a severe wave of explosive attacks despite significant investment in physical hardening. Once IBNS was widely deployed across the network, successful attacks visibly fell.
These results demonstrate what universal coverage can achieve. They also represent one end of a spectrum. Mandatory regulation is the most direct route to full coverage, but it is not the only route, and for many markets across Asia it is not the right starting point.
The UK and the Market-Led Model
The Bank of England has not made IBNS a legal requirement. It has instead allowed commercial conditions to drive adoption. The mechanism is the note replacement rule: notes stained by an IBNS system during an attack can be returned by banks to the central bank and exchanged.
The result has been wide adoption without any legal obligation. Security outcomes have been comparable to markets where IBNS is compulsory. The UK demonstrates that a liability-based commercial framework, clearly communicated, is sufficient to move the market.
Malaysia: A Developing Market Makes Its Decision
In August 2020, Bank Negara Malaysia issued regulatory guidelines on currency protection devices, confirming that institutions should use ink staining technology to deter ATM robberies. Malaysia is directly relevant to the rest of the region because it operates in the same developing market context as many of its neighbours.
The central bank did not wait for a major wave of attacks before acting. It issued clear guidance, gave the industry a framework to work within, and the market responded. The Malaysian experience shows that clear central bank direction, whether as a guideline or a note replacement policy, is the step that unlocks adoption.
The Choice in Front of Every Bank
Banks that have adopted IBNS have done so because the commercial argument is clear. When the full cost of a single successful attack, including cash lost, the ATM out of service, and the effect on customer confidence, is set against the cost of fitting IBNS, the calculation is straightforward. The banks that have not yet adopted it are, in most cases, waiting for a clearer signal from their central bank or regulator.
That signal does not need to take the form of a law. A published policy on banknote replacement, a clear statement that ink staining of banknotes is permitted, and a conversation with the insurance market is enough to move the commercial case to a point where banks can act with confidence. The choice between regulation and responsibility is, in practice, a choice between waiting to be told and deciding that the numbers already make the argument.
About the Author
Paul Nicholls is Director of Business Development, Oberthur Feerica. With over 30 years in the ATM industry, Paul has extensive expertise in ATM security and self-service technology, and is a regular contributor to the industry as well as a conference speaker.
