[OR] [AmB] [E2] [P2] [S1] [C9] Identifying Critical Business Services

Identifying Critical Business Services in Operational Resilience Planning for AmBank Malaysia

(Stage of the “Implement” Phase – Operational Resilience Planning Methodology for Metrobank)

Introduction

Operational resilience is essential for financial institutions like AmBank Malaysia to ensure that critical business services remain available during disruptions.

As part of the “Implement” phase of AmBank’s Operational Resilience Planning Methodology, the first crucial step is to identify critical business services (CBS).

This step involves recognising the services that, if disrupted, could significantly impact customers, financial stability, and regulatory compliance. Here’s an in-depth look at how AmBank Malaysia can systematically implement this stage, along with relevant examples.

Implementation Steps for Identifying Critical Business Services

Step 1: Define Critical Business Services (CBS)

A critical business service delivers essential financial functions to customers and the wider economy. These services must be end-to-end, spanning people, processes, technology, facilities, and third-party dependencies.

Example (Retail Banking)

• Online banking, ATM withdrawals, and payment processing are considered critical because they support daily financial transactions for customers.
• If AmBank’s mobile banking app experiences downtime, customers may be unable to transfer funds or pay bills, leading to reputational damage and regulatory concerns.

Refer to eBook 1, Chapter 5: Identifying Critical Business Services

Step 2: Engage Key Stakeholders for Service Identification

A cross-functional approach ensures that all perspectives are considered. Stakeholders should include:

• Business unit heads (e.g., retail banking, corporate banking, treasury operations)
• Risk management teams
• IT and cybersecurity teams
• Compliance and regulatory teams

Example (Corporate Treasury Services)

• AmBank’s corporate clients rely on real-time cash management and treasury services.
• The Treasury team identifies that SWIFT payments and interbank fund transfers are critical services because disruptions could impact large-scale corporate transactions.

Step 3: Map End-to-End Service Dependencies

Mapping out the full service delivery chain helps AmBank understand the key dependencies required for operational resilience.

Example (Trade Finance Services)

• Trade finance services require multiple components:
• Process: Trade document verification and approval
• Technology: Core banking system, secure payment gateways
• People: Relationship managers and trade finance officers
• Third-party: Correspondent banks and customs clearance systems

By mapping these dependencies, AmBank can identify single points of failure and develop contingency measures.

Step 4: Assess Impact of Service Disruptions

AmBank must evaluate the potential financial, reputational, and regulatory consequences of a service disruption.

Example (Card Payment Processing)

• If AmBank’s credit and debit card transaction processing fails, it could:
• Prevent customers from making purchases
• Led to regulatory scrutiny from Bank Negara Malaysia (BNM)
• Result in financial losses from declined transactions and customer attrition

By quantifying the impact of such disruptions, AmBank can prioritise resilience measures for high-risk services.

Step 5: Validate and Approve the CBS List

Once the critical business services are identified, AmBank should:

• Validate the list with senior management and the board.
• Ensure alignment with regulatory expectations (e.g., Bank Negara Malaysia’s Risk Management in Technology guidelines).
• Regularly update the CBS list to reflect changing business and risk environments.

Example (Digital Banking Services)

• As digital banking adoption increases, AmBank must validate that its internet banking platform, real-time payment services, and e-wallet integrations are classified as CBS.

Identifying critical business services is a strategic and operational imperative for Metrobank’s operational resilience journey.

By systematically mapping Metrobank’s CBS Codes (CBS-1 to CBS-12), assessing criticality, mapping dependencies, setting tolerance for disruption, prioritising resilience efforts, and embedding ongoing review and compliance reporting, Metrobank positions itself to weather disruptions—from natural disasters to cyber events—and to maintain uninterrupted delivery of services to its customers and the real economy.

With the BSP’s guidelines as a benchmark, this stage paves the way for robust continuity planning, testing, and recovery phases that follow in the operational resilience methodology.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.