For AmBank, CBS-1: Retail & Digital Banking is a customer-facing and system-intensive service that must remain available, secure, and compliant even under severe but plausible disruption scenarios.
This chapter applies the “Mapping of Processes and Resources” principle by decomposing CBS-1 into its Sub-CBS and systematically mapping each to its supporting processes, people, technology, third-party vendors, and upstream/downstream dependencies.
This mapping forms a foundational input for impact tolerance setting, vulnerability identification, and scenario testing, as described in operational resilience practices.
|
Sub-CBS Code |
Sub-CBS |
Key Processes |
People |
Technology (Applications & Infrastructure) |
Third-Party Vendors |
Upstream / Downstream Dependencies |
|
1.1 |
Customer Onboarding & KYC |
Customer registration, identity verification, KYC screening, risk profiling, and account activation |
Branch staff, Digital onboarding team, Compliance officers, AML analysts |
eKYC platforms, Core Banking System (CBS), Document management system, Identity verification tools, Secure databases |
Identity verification providers, Credit bureaus, AML screening vendors |
Upstream: Customer data inputs, national ID systems Downstream: Account opening, transaction enablement |
|
1.2 |
Digital Banking Platform Provisioning |
User access provisioning, credential issuance, device binding, and entitlement management |
Digital banking operations team, IT support, Cybersecurity team |
Internet & Mobile Banking platforms, IAM systems, API gateways, Cloud/on-prem infrastructure |
Cloud service providers, App store platforms, Security solution vendors |
Upstream: Successful onboarding & KYC Downstream: Transactions, payments, customer self-service |
|
1.3 |
Transaction Processing Services |
Funds transfer processing, balance updates, posting & clearing, exception handling |
Operations processing staff, IT operations, Fraud monitoring analysts |
Core Banking System, Transaction processing engines, Middleware, Databases, Network infrastructure |
Payment processors, SWIFT network, System integrators |
Upstream: Digital channels, customer instructions Downstream: Payments, account statements, reconciliation |
|
1.4 |
Digital Payments & Settlement |
Payment initiation, validation, clearing, settlement, and dispute handling |
Payments operations team, Treasury staff, Compliance team |
Payment gateways, Real-time payment systems (e.g. DuitNow), Settlement engines, Monitoring tools |
National payment networks, Card schemes, and clearing houses |
Upstream: Transaction processing services Downstream: Merchant settlement, customer confirmations |
|
1.5 |
Loan & Credit Product Management |
Credit assessment, approval workflows, loan disbursement, and repayment processing |
Relationship managers, Credit officers, Risk analysts |
Loan origination systems, Credit scoring engines, CBS, Document systems |
Credit bureaus, Valuation service providers |
Upstream: Customer data, credit information Downstream: Loan servicing, collections |
|
1.6 |
Deposit & Savings Product Management |
Account maintenance, interest calculation, product configuration, and maturity handling |
Product managers, Operations staff, Finance team |
Core Banking System, Product configuration modules, Interest engines |
IT vendors supporting CBS, Regulatory reporting vendors |
Upstream: Account opening processes Downstream: Customer balances, financial reporting |
|
1.7 |
Customer Support & Service Resolution |
Enquiry handling, complaint resolution, service requests, and incident escalation |
Contact centre agents, Branch service staff, Service quality managers |
CRM systems, Ticketing tools, Call centre platforms, Knowledge bases |
Call centre service providers, CRM vendors |
Upstream: Customer issues & incidents Downstream: Retention, regulatory complaints handling |
|
1.8 |
Compliance, Risk & Security Monitoring |
Transaction monitoring, fraud detection, cyber monitoring, regulatory reporting |
Risk management team, Compliance officers, SOC analysts |
Fraud monitoring systems, SIEM tools, GRC platforms, and data warehouses |
Cybersecurity vendors, RegTech providers |
Upstream: Transactions, customer behaviour data Downstream: Incident response, regulatory action |
|
1.9 |
Data Analytics & Personalisation |
Data aggregation, customer segmentation, analytics modelling, and offer personalisation |
Data analysts, Data scientists, Marketing team |
Data lakes, Analytics platforms, AI/ML tools, BI dashboards |
Cloud analytics providers, Data enrichment vendors |
Upstream: Transaction & customer data Downstream: Product offers, customer engagement |
|
1.10 |
Back-office Support & Reconciliation |
End-of-day processing, reconciliation, reporting, exception resolution |
Back-office operations staff, Finance team, Internal audit |
Reconciliation tools, Reporting systems, CBS, Data warehouses |
Financial reporting solution providers, Auditors |
Upstream: Transaction & payment systems Downstream: Financial statements, regulatory submissions |
The mapping of processes and resources for CBS-1 Retail & Digital Banking enables AmBank to clearly understand how critical services are delivered, where concentration risks exist, and which dependencies could amplify disruption.
By identifying the people, technology, and third-party components supporting each Sub-CBS, AmBank is better positioned to assess vulnerabilities and operational fragilities.
This mapping directly supports scenario testing, allowing AmBank to simulate severe but plausible disruptions—such as system outages, third-party failures, or cyber incidents—and evaluate whether impact tolerances can be met.
As such, this chapter provides a crucial bridge between service identification and resilience validation, reinforcing AmBank’s ability to protect customers, maintain trust, and meet regulatory expectations under stressed conditions.
|
Operational Resilience Framework: A Case Study of AmBank Malaysia |
|||||
| eBook 3: Starting Your OR Implementation |
|||||
| CBS-1 Retail & Digital Banking | |||||
| CBS-1 DP | CBS-1 MD | CBS-1 MPR | CBS-1 ITo | CBS-1 SuPS | CBS-1 ST |
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|