[OR] [AmB] [E3] [CBS] [4] [SuPS] Identify Severe but Plausible Scenarios

CBS-4 Treasury & Capital Markets

Introduction

Treasury & Capital Markets functions are inherently exposed to high-impact operational, market, and technology-driven risks due to their reliance on real-time trading systems, external market infrastructures, complex products, and strict regulatory obligations.

In line with the operational resilience principle of “severe but plausible scenarios”, this chapter identifies scenarios that test AmBank’s ability to continue delivering CBS-4 Treasury & Capital Markets services under extreme yet credible disruptions.

These scenarios go beyond traditional risk events and focus on service disruption, harm to customers, market integrity, and financial stability.

Consistent with the guidance outlined in the BCM Institute blog “What are Severe but Plausible Scenarios in Operational Resilience”, the scenarios below integrate operational, cyber, ICT, third-party, and people risks, enabling AmBank to assess vulnerabilities, set impact tolerances, and strengthen end-to-end resilience across Treasury & Capital Markets value chains.

Table P5: Identify Severe but Plausible Scenarios for CBS-4

Sub-CBS Code	Sub-CBS	Severe but Plausible Scenario	Impact / Effect	Proactive Risk Management Action	Link to Integration of Cyber and ICT Risks
4.1	Foreign Exchange (FX) Trading	Core FX trading platform outage during volatile market conditions due to a cyber intrusion	Inability to execute FX trades, client losses, market exposure, and reputational damage	Active-active trading platforms, dealer manual fallback procedures, and regular cyber penetration testing	Trading system cyber resilience, DDoS protection, and real-time SIEM monitoring
4.2	Interest Rate & Money Market Trading	Market data feed corruption from a third-party provider	Incorrect pricing, erroneous trades, and financial loss	Dual market data vendors, automated data validation controls	Third-party ICT risk assessment, data integrity controls
4.3	Derivatives & Structured Products	Unauthorized system access leading to the manipulation of derivatives valuation models	Mispricing, regulatory breach, client disputes	Strong access controls, model governance, segregation of duties	Privileged access management (PAM), cyber anomaly detection
4.4	Fixed Income & Debt Instruments Trading	Failure of the electronic trading platform during bond market stress	Trade execution delays, liquidity risk	Pre-approved voice trading fallback, alternate execution venues	Platform resilience testing, network redundancy
4.5	Capital Markets Origination & Syndication	Document management system unavailable during deal closing	Delayed issuance, client dissatisfaction, revenue impact	Secure offline document repositories, crisis playbooks	Secure document platforms, ransomware protection
4.6	Debt Capital Market (DCM) Solutions & Advisory	Loss of key deal team due to pandemic or coordinated cyber-physical incident	Advisory disruption, execution delays	Cross-trained teams, succession planning, and remote working readiness	Secure remote access, endpoint protection
4.7	Asset Liability & Balance Sheet Management (ALM)	ALM system failure during liquidity stress scenario	Inaccurate liquidity positions, regulatory breaches	Parallel ALM systems, spreadsheet-based contingency models	Core banking integration resilience, data backup integrity
4.8	Market Risk Analytics & Reporting	Market risk engine unavailable at regulatory reporting deadline	Late or inaccurate risk reports, supervisory action	Pre-run reports, manual calculation procedures	Risk engine cyber hardening, batch job monitoring
4.9	Post-Trade & Settlement Operations	Settlement system disruption due to a SWIFT-related cyber incident	Failed settlements, counterparty disputes, and financial penalties	SWIFT CSP compliance, alternate settlement arrangements	SWIFT security controls, transaction monitoring
4.10	Regulatory & Compliance Governance	Regulatory reporting platform compromised by malware	Data leakage, non-compliance, and enforcement actions	Immutable backups, regulatory reporting rehearsals	Malware protection, secure regulatory data transmission
4.11	Client Relationship & Sales Support	CRM system outage during market volatility	Client communication breakdown, reputational harm	Crisis communication protocols, manual client contact lists	CRM cyber resilience, cloud availability management

Banner [Summing] [OR] [E3] Identify Severe but Plausible Scenarios

The identification of severe but plausible scenarios for CBS-4 Treasury & Capital Markets enables AmBank to move beyond traditional risk management and toward a service-centric operational resilience framework. These scenarios deliberately stress critical dependencies—technology, people, third parties, and data—under conditions that could realistically occur during market turbulence or systemic disruption.

By explicitly linking each scenario to proactive risk management actions and the integration of cyber and ICT risks, AmBank strengthens its ability to remain within impact tolerances, protect clients and market confidence, and meet regulatory expectations. This approach supports Bank Negara Malaysia’s operational resilience objectives and positions Treasury & Capital Markets as a resilient, well-governed, and trusted function even under extreme but credible disruption scenarios.

Operational Resilience Framework: A Case Study of AmBank Malaysia
eBook 3: Starting Your OR Implementation
CBS-4 Treasury & Capital Markets
CBS-4 DP	CBS-4 MD	CBS-4 MPR	CBS-4 ITo	CBS-4 SuPS	CBS-4 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.