[OR] [AmB] [E3] [CBS] [2] [ST] Perform Scenario Testing

CBS-2 Payment Processing & Settlement

Introduction

Scenario testing is a core practice in operational resilience, enabling financial institutions such as AmBank to assess whether critical business services can remain within defined impact tolerances under severe but plausible conditions.

For CBS-2 Payment Processing & Settlement, scenario testing focuses on end-to-end payment flows, interbank connectivity, data integrity, and regulatory obligations.

In line with the principles described in “What is Scenario Testing in Operational Resilience?”, the scenarios below are designed to go beyond traditional business continuity testing by integrating cyber, ICT, third-party, and operational risks, and by examining real customer, market, and regulatory impacts rather than system recovery alone.

The table below outlines recommended scenario testing themes for each Sub-CBS, highlighting expected impacts and demonstrating how AmBank can evidence proactive risk management actions, including the integration of Cyber and ICT risk considerations into resilience testing.

Table P6: Perform Scenario Testing for CBS-2

Sub-CBS Code

Sub-CBS

Recommended Scenario Test Themes (incl. Cyber & ICT Risk Integration)

Impact / Effect

Evidence of Proactive Risk Management Action

2.1

Payment Initiation & Capture

• Cyberattack on digital banking channels (DDoS/malware) during peak payment period

• Front-end payment application outage due to an ICT configuration error

• Customers are unable to initiate payments

• Transaction backlog and reputational impact

• Increased call centre volumes

• Regular cyber stress testing of channels

• Load and failover testing for digital platforms

• Customer communication playbooks and alternative initiation channels

2.2

Authorisation & Verification

• Compromise of authentication services (IAM/MFA failure)

• Real-time fraud detection engine unavailable due to data corruption

• Payments delayed or rejected

• Increased fraud risk or false declines

• Breach of security expectations

• Redundant authentication infrastructure

• Manual override and stepped-up verification procedures

• Cyber incident response drills involving fraud and operations teams

2.3

Clearing & Message Exchange

• Failure of payment messaging network (e.g. SWIFT/IBG) due to third-party ICT outage

• Cyber-induced message tampering or duplication

• Inability to clear interbank payments

• Settlement delays across the financial system

• Regulatory scrutiny

• Alternate clearing routes tested

• Message integrity controls and reconciliation checks

• Third-party resilience assessments and joint scenario exercises

2.4

Settlement Execution

• Core banking system unavailable during end-of-day settlement

• Ransomware attack encrypting settlement processing servers

• Failed or delayed settlement obligations

• Liquidity stress and counterparty exposure

• Potential regulatory breach

• Segregated and offline backups tested

• Cyber recovery time objectives aligned to settlement cut-offs

• Pre-funding and contingency liquidity arrangements

2.5

Reconciliation & Exception Handling

• Data integrity loss due to ICT batch processing failure

• Insider cyber risk causing manipulation of reconciliation files

• Unreconciled items accumulate

• Financial misstatement risk

• Delayed issue resolution

• Automated reconciliation controls with exception thresholds

• Segregation of duties and access monitoring

• Periodic data integrity and recovery testing

2.6

Fees, Charges & Accounting Posting

• Accounting engine misconfiguration after system patch

• Cyber breach affecting general ledger interfaces

• Incorrect fee charging

• Misposted accounting entries

• Customer complaints and audit findings

• Pre-deployment testing and rollback procedures

• Dual controls over accounting rules

• Regular ICT change management and cyber assurance reviews

2.7

Reporting & Regulatory Compliance

• Regulatory reporting system unavailable near submission deadlines

• Cyber incident affecting the accuracy of payment reports

• Late or inaccurate regulatory submissions

• Potential penalties and supervisory actions

• Backup reporting systems tested

• Manual reporting procedures exercised

• Data lineage and validation controls reviewed under cyber scenarios

2.8

Customer Notification & Statement Updating

• Notification services disrupted by cloud service provider outage

• Cyber incident causing unauthorised disclosure risk

• Customers not informed of payment status

• Loss of trust and increased enquiries

• Data protection concerns

• Multi-channel notification testing (SMS, email, app)

• Data masking and encryption controls

• Customer communication templates pre-approved for incidents

By performing scenario testing across all Sub-CBS components of CBS-2 Payment Processing & Settlement, AmBank can gain a realistic understanding of how severe but plausible disruptions—particularly those driven by cyber and ICT risks—could impact customers, market confidence, and regulatory compliance.

Importantly, these scenarios demonstrate a shift from purely technical recovery testing to service-centric resilience validation, supported by tangible evidence of proactive risk management.

This approach strengthens AmBank’s ability to remain within impact tolerances, meet supervisory expectations, and maintain trust in its payment and settlement services under stress.

Operational Resilience Framework: A Case Study of AmBank Malaysia
eBook 3: Starting Your OR Implementation
CBS-2 Payment Processing & Settlement
CBS-2 DP	CBS-2 MD	CBS-2 MPR	CBS-2 ITo	CBS-2 SuPS	CBS-2 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About Blended Learning OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.