[OR] [AGB] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5 Understanding Critical Business Services in the Context of Agrobank

In an operational resilience program, a Critical Business Service (CBS) is not simply an important internal function. It is a service delivered to external stakeholders — customers, counterparties, or the market — that would be disrupted in a way that causes intolerable harm.

Harm may arise in the form of financial loss to customers, loss of confidence in the financial system, regulatory breach, reputational damage, or systemic instability.

The focus is therefore on service continuity from the customer’s perspective, rather than on internal departments or systems.

For Agrobank, a development financial institution supporting Malaysia’s agriculture and agro-based sectors, CBS identification must consider both commercial impact and socio-economic implications.

A prolonged disruption to Agrobank’s services could directly affect farmers, SMEs, supply chains, and national food security objectives.

In line with the 2025 Bank Negara Malaysia (BNM) Discussion Paper on Operational Resilience, institutions are expected to identify their CBS, set impact tolerances for severe but plausible scenarios, and ensure they can remain within those tolerances during disruption.

Purpose of the Chapter

This chapter is designed to guide Agrobank’s leadership and operational teams in clearly identifying what truly matters when implementing an operational resilience program: its Critical Business Services (CBS).

Rather than focusing on internal departments, systems, or functions, the chapter shifts the perspective outward — toward the services delivered to customers, counterparties, and the wider financial ecosystem.

In line with regulatory direction under Bank Negara Malaysia’s 2025 Discussion Paper on Operational Resilience, understanding CBS is the starting point for setting impact tolerances, prioritising resources, and strengthening resilience in a structured and defensible manner.

By the end of this chapter, the reader will understand how to define CBS using a harm-based approach, how those services align with Agrobank’s development mandate, and how regulatory expectations shape the identification process.

The objective is to equip decision-makers with clarity on which services must remain within tolerable disruption limits during severe but plausible scenarios, and why board-level oversight and cross-functional coordination are critical to achieving that outcome.

Regulatory Expectations on Critical Business Services

Under the 2025 BNM Discussion Paper on Operational Resilience, financial institutions are expected to:

• Identify and document their Critical Business Services.
• Map dependencies (people, processes, technology, third parties, facilities).
• Set impact tolerances (e.g., maximum tolerable duration of disruption).
• Conduct severe but plausible scenario testing.
• Ensure board and senior management accountability for resilience outcomes.

BNM’s approach aligns with global regulatory trends (e.g., the UK PRA and the Basel Committee), emphasising service-level resilience rather than merely business continuity planning.

For Malaysian insurance companies, BNM’s Risk Management in Technology (RMiT) policy and operational risk management requirements similarly require:

• Identification of critical functions and services.
• Recovery time objectives (RTO) and recovery point objectives (RPO).
• Management of third-party and outsourcing risk.
• Cyber resilience testing.
• Clear governance and accountability at the board level.

For example, a Malaysian insurer would likely classify the following as CBS:

• Claims processing and payout
• Policy issuance and servicing
• Premium collection
• Customer access to digital policy platforms

Disruption to claims processing during a catastrophe would cause immediate customer harm and reputational damage — clearly meeting the CBS definition.

Proposed Critical Business Services for Agrobank

Based on the CBS definition and Agrobank’s mandate, the following services are likely to qualify as Critical Business Services:

Disbursement of Financing Facilities

Agrobank provides financing to farmers, agro-entrepreneurs, and SMEs. The disbursement of approved financing is a CBS because:

• Delay could affect planting cycles and livestock operations.
• Cash flow disruptions could jeopardise borrower survival.
• It may impact national food supply chains.

Under BNM expectations, Agrobank would need to define:

• Maximum tolerable downtime (e.g., X hours/days).
• Dependency on core banking systems, payment systems, credit processing teams, and third-party service providers.

Repayment Processing and Loan Servicing

The ability for customers to:

• Make repayments,
• View outstanding balances,
• Restructure facilities,

is critical. Prolonged disruption could lead to:

• Incorrect delinquency classification,
• Regulatory reporting inaccuracies,
• Customer distress.

Impact tolerances must reflect peak periods (e.g., harvest season repayments).

Customer Deposit Services

If Agrobank offers deposit-taking services, then:

• Account access,
• Fund transfers,
• Cash withdrawals,
• ATM and digital banking services

would qualify as CBS.

Disruption could:

• Trigger liquidity concerns,
• Erode depositor confidence,
• Cause broader reputational damage.

BNM would expect resilience testing of digital banking channels and interbank payment dependencies.

Payment and Fund Transfer Services

Participation in national payment systems (e.g., interbank GIRO or instant payment platforms) is typically considered critical.

A disruption may:

• Prevent supplier payments,
• Interrupt government subsidy flows,
• Causes cascading supply chain issues.

Under the 2025 discussion paper, institutions must consider systemic impact — not just institutional inconvenience.

Government-Linked or Subsidy Distribution Programs

If Agrobank administers government-backed agricultural schemes or subsidies, these programs may qualify as CBS due to:

• Public interest implications,
• Political and social sensitivity,
• Direct impact on rural livelihoods.

Such services often attract heightened regulatory scrutiny.

Applying the CBS Identification Criteria

When determining whether a service is “critical,” Agrobank should assess:

• Customer Harm
  Would disruption cause immediate financial distress to farmers or SMEs?
• Market/ Systemic Impact
  Would disruption affect Malaysia’s agricultural supply chain?
• Regulatory Consequence
  Would failure breach BNM obligations or statutory requirements?
• Reputational and Public Confidence Impact
  Would disruption erode trust in Agrobank as a development financial institution?
• Substitutability
  Can customers easily obtain the same service elsewhere?

A service becomes “critical” when disruption would result in intolerable harm under severe but plausible scenarios.

Mapping Dependencies for Agrobank’s CBS

Once CBS are identified, Agrobank must map end-to-end dependencies, including:

• Core banking system
• Credit processing platforms
• Data centres and cloud services
• Telecommunications providers
• Payment gateway providers
• Outsourced service providers
• Key personnel and operational teams

For example:

CBS: Financing Disbursement

Dependencies may include:

• Credit approval workflow system
• Core banking ledger
• Payment clearing network
• Treasury liquidity management
• IT infrastructure
• Third-party data providers

BNM expects this mapping to be sufficiently granular to support scenario testing.

Setting Impact Tolerances

Under the 2025 BNM Discussion Paper, institutions must define the maximum tolerable level of disruption, such as:

• Maximum duration of outage (e.g., 4 hours, 24 hours, 48 hours).
• Maximum number of customers impacted.
• Maximum financial exposure threshold.

For Agrobank:

These tolerances must be approved by the Board and regularly tested.

Scenario Testing and Assurance

Agrobank should test CBS resilience against severe but plausible scenarios such as:

• Major cyberattack on the core banking system
• Cloud service provider outage
• Pandemic-related workforce disruption
• Ransomware is affecting payment processing
• Natural disaster affecting the primary data centre

For comparison, Malaysian insurers are expected to test:

• Catastrophic event claims surge,
• System-wide IT failure,
• Third-party administrator disruption,
• Cyber breach affecting customer data.

The objective is not to eliminate disruption, but to ensure the institution remains within its defined impact tolerances.

Governance and Accountability

The Board of Agrobank must:

• Approve the identified CBS.
• Approve impact tolerances.
• Oversee resilience testing results.
• Ensure remediation plans are funded and implemented.

Senior management must demonstrate that resilience is embedded in:

• Product design,
• Outsourcing arrangements,
• Technology architecture,
• Change management processes.

Operational resilience is therefore a strategic capability — not merely an IT or BCM exercise.

Proposed Critical Business Services (CBS) for Agrobank

These CBS reflect services delivered externally that would be disrupted, causing intolerable harm to customers, rural communities, or the broader financial system.

For Agrobank, identifying Critical Business Services is the foundation of a credible operational resilience program.

Services such as financing disbursement, repayment processing, deposit access, payment transfers, and government-linked programs are likely to qualify due to their direct impact on customers, rural livelihoods, and national economic stability.

Aligned with the 2025 BNM Discussion Paper and broader regulatory expectations for Malaysian financial institutions — including insurers — Agrobank must move beyond traditional business continuity planning toward a service-centric resilience model.

By clearly defining CBS, mapping dependencies, setting impact tolerances, and conducting rigorous scenario testing, Agrobank can strengthen its resilience while continuing to serve Malaysia’s agricultural ecosystem with confidence and reliability.

Blogs marked [x] are under construction.

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.