[OR] [AUB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios

Sub-CBS Code

Sub-CBS

Severe but Plausible Scenario

Impact / Effect

Proactive Risk Management Action

Link to Integration of Cyber and ICT Risks

1.1

Customer Onboarding and Account Application

Prolonged outage of the digital onboarding platform due to cloud service disruption

Inability to onboard customers; revenue loss; reputational damage

Multi-channel onboarding (branch fallback), cloud redundancy, and DR testing

Cloud outage, API failure, digital channel disruption

1.2

Customer Identification and Verification (KYC/CDD)

Failure of the KYC verification system due to a third-party data provider outage

Regulatory breach (AML/KYC), onboarding delays

Alternate KYC providers, manual verification procedures, and SLA monitoring

Third-party API failure, data integrity risks

1.3

Account Approval and Opening

Core banking system (CBS) approval module failure due to database corruption

Delayed account opening; operational backlog

Database replication, failover mechanisms, and approval workflow backup

Core banking outage, database integrity compromise

1.4

Initial Funding and Deposit Booking

Payment gateway failure is preventing initial funding transactions

Failed account activation; customer dissatisfaction

Multiple payment channels, transaction retry mechanisms

Payment system outage, integration failure

1.5

Product Terms Setup and Account Parameter Maintenance

Incorrect product configuration due to a system patch error

Financial misstatements; compliance issues

Change management controls, pre-production testing, and rollback capability

Configuration errors, system patch vulnerabilities

1.6

Deposit Transactions Processing

Cyberattack (e.g., ransomware) impacting transaction processing systems

Transaction halt; liquidity impact; financial loss

Endpoint security, network segmentation, and ransomware recovery drills

Malware/ransomware attack, system unavailability

1.7

Withdrawal and Funds Access Processing

ATM/POS network outage due to telecom failure

Customers unable to withdraw funds; reputational damage

Telecom redundancy, alternate channels (branch/online), failover routing

Network outage, telecom dependency risk

1.8

Account Servicing and Customer Maintenance

Unauthorised access due to compromised credentials (phishing attack)

Data breach, fraud, and regulatory penalties

MFA implementation, customer awareness, and fraud monitoring systems

Identity compromise, cyber fraud risk

1.9

Interest, Fees, and Charges Processing

Batch processing failure during end-of-day (EOD) processing

Incorrect balances; financial reporting errors

Automated reconciliation, batch monitoring, recovery scripts

Batch job failure, system processing errors

1.10

Statement, Passbook, and Balance Reporting

Data warehouse failure affecting statement generation

Customers unable to access statements; compliance issues

Data replication, alternate reporting channels, backup systems

Data storage failure, reporting system outage

1.11

Digital Account Access and Channel Integration

Mobile banking app outage due to application deployment failure

Customers unable to access accounts; service disruption

DevOps controls, rollback mechanisms, and app monitoring

Application failure, CI/CD deployment risks

1.12

ATM and Card-Based Access Management

Card management system breach leading to card cloning fraud

Financial losses; customer trust erosion

EMV controls, transaction monitoring, and card blocking mechanisms

Card system breach, fraud analytics failure

1.13

Account Reconciliation and Exception Handling

Failure of the reconciliation system due to corrupted transaction files

Unreconciled accounts; financial discrepancies

Reconciliation automation, exception management workflows

Data corruption, file transfer failures

1.14

Dormancy, Holds, Restrictions, and Account Control Administration

Erroneous account restrictions due to a system logic error

Customer complaints; legal disputes

Validation rules, audit controls, and exception overrides

System logic flaws, control breakdown

1.15

Fraud Monitoring and Transaction Surveillance

The AI-based fraud detection system failed due to a model malfunction

Undetected fraudulent transactions

Model validation, fallback rules-based detection

AI model failure, analytics disruption

1.16

Complaints, Disputes, and Service Recovery

CRM system outage during a high-complaint-volume incident

Delayed resolution; regulatory escalation

Manual case handling, CRM redundancy, escalation protocols

CRM system outage, service platform disruption

1.17

Regulatory Reporting and Compliance Monitoring

Failure to submit regulatory reports due to a system outage

Regulatory penalties; compliance breach

Regulatory reporting backup processes, submission tracking

Reporting system failure, data aggregation issues

1.18

Incident Response, Business Continuity, and Recovery

Failure of the disaster recovery site during a major system outage

Prolonged service disruption; systemic risk

Regular DR testing, secondary DR site, and crisis management activation

DR failure, infrastructure resilience weakness