In an operational resilience program, the starting point is to identify the business services that must remain within tolerable levels of disruption, even when the institution is under stress.
BCM Institute defines a Critical Business Service (CBS) as a service provided by an organisation, or by another party on its behalf, which, if disrupted, could cause intolerable harm to customers or pose a risk to the soundness, stability, or orderly operation of the financial system.
For a Philippine bank such as Asia United Bank Corporation (AUB), this concept aligns closely with BSP Circular No. 1203, Series of 2024, which requires BSFIs to identify critical operations, set tolerance for disruption, map interconnections and interdependencies, and test resilience under severe but plausible scenarios.
The Circular also emphasises governance, cyber resilience, third-party risk management, and the integration of business continuity.
AUB is a Philippine universal bank. Its official website shows that its business lines include deposit products, prepaid accounts such as HelloMoney, loans, treasury and trust products, cash management through BizKit, credit cards, remittance, trade financing, InstaPay, PESONet, and QRPh-linked payment services.
Accordingly, the critical business services identified below are a recommended operational resilience view of AUB’s services, based on its public business profile and the BSP’s operational resilience requirements.
They are not presented as AUB’s officially published internal CBS inventory.
The purpose of this chapter is to identify the business services of AUB that are most likely to be treated as critical from an operational resilience perspective.
This gives management and implementation teams a practical basis for the next stages of the program: setting disruption tolerances, mapping people-process-technology-third-party dependencies, identifying severe but plausible scenarios, and designing scenario tests.
For a Philippine bank, the following operational resilience requirements are especially relevant when identifying CBS:
|
BSP Requirement |
What It Means in Practice |
Example for AUB |
|
Identify critical operations |
The bank must determine which operations are so important that disruption would materially affect customers, the bank, or the financial system. Board approval is expected. |
AUB identifies deposit access, payments, digital banking access, and cash management as services requiring priority protection. |
|
Set tolerance for disruption |
Each identified critical operation should have defined quantitative and/or qualitative tolerance metrics, including at a minimum a time-based measure. |
For fund transfers, AUB may define the maximum acceptable outage duration, transaction backlog, and affected-customer threshold. |
|
Map interconnections and interdependencies |
The bank must map the chain of activities, resources, third parties, and infrastructure that support the service. |
AUB maps dependencies across core banking, mobile app, network links, payment rails, vendors, and branches. |
|
Consider third-party risk |
Third parties supporting critical operations must maintain resilience levels equivalent to the bank’s requirements, with alternatives or exit strategies considered. |
Outsourced technology, payment gateways, telecoms, and remittance partners are assessed for failure scenarios and substitution options. |
|
Integrate cyber resilience |
Critical operations must be supported by secure, resilient IT environments with tested detection, response, and recovery capabilities. |
AUB evaluates how ransomware or an authentication platform failure would affect digital banking, payments, and customer access. |
|
Test through severe but plausible scenarios |
Periodic exercises must cover identified critical operations, dependencies, and realistic scenarios, such as cyber incidents, service provider failures, or natural disasters. |
AUB tests outage scenarios involving mobile banking, data centre disruption, a payment network failure, or branch/facility denial. |
|
Integrate BCM into OR |
Business continuity, recovery strategies, incident response, crisis communication, and exercises must support continued delivery of critical operations. |
AUB aligns BCPs and incident plans to each critical business service rather than treating BCM as a separate silo. |
|
CBS Code |
Critical Business Service |
Why It Is Critical |
|
CBS-1 |
Deposit and Account Services |
Customers must be able to reliably open, maintain, access, and use deposit accounts. Disruption directly harms retail and corporate customers. |
|
CBS-2 |
Payments and Funds Transfer Services |
Timely transfer of funds is essential to customers, counterparties, and the wider financial system. |
|
CBS-3 |
Digital Banking and Customer Access Channels |
AUB’s mobile, online, and app-based access channels are key service delivery mechanisms for account access and transactions. |
|
CBS-4 |
Cash Management and Corporate Collections/Disbursements |
AUB BizKit supports the collection, disbursement, and reconciliation processes critical to business customers. |
|
CBS-5 |
Remittance Services |
AUB publicly offers remittance and account-crediting services, including cash pick-up and credit to AUB and other bank accounts. |
|
CBS-6 |
Card and Merchant Payment Services |
Card usage and merchant payment capabilities are critical to the continuity of everyday retail payments. |
|
CBS-7 |
Lending and Loan Servicing |
Loan drawdown, repayment processing, and servicing are important to customer obligations and bank operations. |
|
CBS-8 |
Treasury and Investment Transaction Services |
Treasury products and related transaction processing support liquidity, customer access to investment, and market-facing obligations. |
|
CBS-9 |
Trade Finance and Related Corporate Banking Services |
Trade-related instruments and processing are important to business continuity for commercial clients engaged in domestic and cross-border trade. |
This should be considered one of AUB’s primary critical business services. AUB publicly offers savings accounts, current accounts, time deposits, and other currency accounts.
A disruption to deposit and account services can prevent customers from:
From a BSP operational resilience perspective, this service is critical because disruption can immediately cause customer harm and can also affect confidence in the institution. It is also the foundational service on which payments, remittances, cards, and digital access depend.
AUB offers real-time fund transfers through InstaPay, and its website also lists PESONet and QRPh among its services. InstaPay is available through AUB Preferred Online Banking, AUB Mobile App, HelloMoney, and Hello Pag-IBIG.
This makes payments and funds transfers among AUB’s most critical business services. In the Philippine banking context, disruption to payment services can affect customers’ ability to send or receive funds, settle obligations, and access essential commerce.
Such disruption can also create broader systemic effects when it impacts payment flows and connected institutions. BSP Circular 1203 expressly frames operational resilience around protecting critical operations from such harm.
Digital access should be treated as a separate CBS because, for many customers, the service is not merely a supportive technology but the actual customer-facing delivery channel for critical banking services.
AUB publicly promotes its mobile apps, HelloMoney and Hello Pag-IBIG, as well as its online/mobile transaction capabilities.
If digital banking channels fail, customers may lose the ability to:
BSP Circular 1203 places strong emphasis on technology security, confidentiality, integrity, availability, and the regular testing of ICT protection, detection, response, and recovery processes. This strongly supports treating digital access as a critical business service, or at a minimum as an essential customer-facing critical operation.
AUB’s BizKit is described by the bank as a cash management solution designed to simplify business processes, with collection, disbursement, and reconciliation capabilities.
For commercial and institutional clients, this service is likely critical because it supports:
If disrupted, business customers may be unable to pay employees, suppliers, or counterparties and may lose visibility into their cash positions. Under BSP Circular 1203, this would merit serious consideration as a critical operation because it could materially harm customers and affect broader financial flows.
AUB offers remittance services, including door-to-door peso cash deliveries, opening of peso and dollar accounts, cash pick-up at AUB branches and authorised centres, credit to AUB deposit accounts, and credit to other banks’ deposit accounts.
Its remittance page also refers to close-to-real-time and real-time service commitments for certain transactions.
Remittance should be treated as a CBS because it directly affects customers’ access to funds, often for day-to-day living needs.
In the Philippine context, remittance interruptions can cause immediate harm to customers, especially when beneficiaries depend on timely credit or cash pickup.
This aligns with the BCM Institute's and BSP's emphasis on services whose disruption would materially affect customers.
AUB lists credit cards and also provides payment-related services such as AUB PayMate.
Card and merchant payment services are likely critical, as customers and merchants rely on them to execute day-to-day transactions.
Prolonged disruption may prevent purchases, bill settlement, cash access, or merchant collections.
In operational resilience terms, these are often highly visible services whose failure causes immediate customer harm and reputational impact.
AUB’s website shows that it offers motor vehicle loans, home loans, salary loans, and commercial loans.
Not every element of lending is equally critical from an operational resilience viewpoint.
However, loan servicing functions are often critical because customers must be able to:
Commercial lending activities tied to working capital or trade may also have heightened criticality for business customers.
Under BSP Circular 1203, the assessment should focus on where disruption would cause material harm rather than assume that all loan functions are equally critical.
AUB publicly offers treasury products, including government securities and corporate bonds.
This service may qualify as critical, especially where AUB has obligations relating to customer investment transactions, liquidity-related market activity, or settlement-facing treasury operations.
The criticality will depend on the scale, customer base, and market significance of the activity, but treasury services should be assessed carefully because failures here can affect customers, counterparties, liquidity management, and market confidence.
AUB’s website includes trade financing among its service offerings.
For business customers, trade finance can be operationally critical because disruption may delay shipment release, documentary processing, settlement, or access to working capital.
Depending on AUB’s client profile, this may be a high-priority CBS for the corporate and commercial segment.
When AUB identifies its final CBS inventory, it should apply the BSP and BCM Institute approach by examining services through an end-to-end customer and market impact lens, rather than just through internal departmental structures.
In practice, this means AUB should prioritise services that:
For AUB, the strongest candidates are likely:
The remaining services should still be assessed carefully, but these five are the most clearly supported by AUB’s public service profile and the BSP’s operational resilience expectations.
For Asia United Bank Corporation, critical business services are those whose disruption would cause intolerable harm to customers or materially affect the stability and soundness of banking operations.
These CBS should then serve as the anchor points for the rest of the operational resilience program: defining tolerances, mapping dependencies, assessing vulnerabilities, integrating cyber and third-party risks, and conducting scenario testing.
That is the discipline required by BSP Circular No. 1203 and the practical pathway for building a defensible operational resilience framework for a Philippine bank.
Blogs marked [x] are under construction.
| eBook 1: Understanding Your Organisation | |||
| C1 | C2 [x] | C3 [x] | C4 [x] |
| C5 | C6 [x] | C7 [x] | C8 [x] |
| |
|
|
|
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|