[CM] [RYT] [E1] [C10] During Crisis - Crisis Response and Decision-Making

Chapter 10

Overview

In alignment with ISO 22361:2022 on crisis management, this chapter details Ryt Bank’s structured approach during the crisis phase, focusing on decision-making, command structures, activation protocols, and communication strategies.

The goal is to ensure timely, informed, and coordinated actions to mitigate harm, stabilise operations, and preserve stakeholder trust.

Crisis Activation and Escalation Protocols

At Ryt Bank, the moment a disruption escalates beyond the operational recovery capability or poses reputational, financial, or regulatory risks, the crisis management process is activated.

The Crisis Activation Protocol is guided by predefined thresholds and early warning indicators aligned with ISO 22361 Section 6.4.1.

These include:

• Regulatory breaches or significant compliance risks
• Service outages affecting digital banking platforms
• Cybersecurity breaches impacting customer data or trust
• Public or social media incidents requiring rapid containment

The Crisis Management Team (CMT) is notified through the bank’s secure communication platform, and a decision to escalate to crisis level is made by the Crisis Director, often the CEO or a designated senior leader.

The escalation matrix ensures that issues are efficiently transitioned from incident response to executive oversight.

Incident Command System (ICS) for Ryt Bank

Ryt Bank adopts a customised Incident Command System (ICS) adapted for a digital banking environment. The ICS ensures structured command, control, and coordination through defined roles:

• Crisis Director (CD): Strategic leadership and liaison with regulators and the board
• Crisis Manager (CM): Operational commander overseeing all response activities
• Functional Leads: Responsible for areas such as IT, legal, risk, customer service, and communication
• Liaison Officer: Manages interfaces with PIDM, Bank Negara Malaysia, and partner stakeholders

This structure ensures that decision-making authority is apparent, information flows are streamlined, and operational continuity is prioritised, as outlined in ISO 22361, Sections 6.4.2 and 7.1.

Crisis Response Procedures for Different Scenarios

Ryt Bank maintains scenario-based playbooks that support rapid and informed responses across different crisis types. These procedures are validated through regular exercises and scenario testing and include:

• Cybersecurity Breach Response: Isolation of affected systems, customer notification, coordination with regulators and forensic specialists
• Regulatory Action or Enforcement: Immediate engagement of legal and compliance teams, messaging with regulators and public
• Technology Failure or Downtime: Activation of disaster recovery and IT service continuity teams, rerouting of services, and customer outreach
• Reputational Crisis (e.g., media leak, customer outcry): Mobilisation of the brand protection unit, deployment of social listening tools, rapid messaging

Each scenario response emphasises the golden hour principle, maximising decisive action in the first 60–90 minutes of detection. It aligns with ISO 22361’s guidance on evaluating situational complexity and selecting appropriate options (Sections 6.4.3 and 7.4).

Crisis Communication Execution (Internal & External)

Clear, coordinated communication is critical during a crisis. Ryt Bank’s Crisis Communication Plan, aligned with ISO 22361 Section 7.5 and 8.4, ensures:

• Internal Communication: Regular situation reports (SitReps) to staff, coordination briefs for the Board, and instructions for branch and customer support staff
• External Communication: Unified spokespersons (CEO or Communications Head), holding statements issued within 60 minutes, real-time updates via digital channels and media relations
• Stakeholder-Specific Messaging: Regulatory updates to Bank Negara Malaysia and PIDM, partnership communication with Sea Limited, customer-focused FAQs and support helplines

All communication is governed by pre-approved templates and reviewed by legal to ensure factual accuracy, accountability, and reputational protection.

Summing Up ...

Ryt Bank’s crisis response and decision-making framework is built on international best practices and tailored to the complexities of digital banking.

The integration of ISO 22361’s structured crisis activation, decision-making under uncertainty, and stakeholder communication principles enables the bank to respond effectively, maintain public trust, and recover stronger from crises.

As the financial landscape evolves, this crisis blueprint serves as a dynamic, living framework that Ryt Bank continues to test, learn from, and refine.