[OR] [BB] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5 What Are the Critical Business Services (CBS) of Boost Bank When Implementing an Operational Resilience Program?

In Operational resilience, a Critical Business Service (CBS) is defined as a service provided by an organisation, or by a third party on behalf of the organisation, that if disrupted would either:

• Cause intolerable harm to one or more of the organisation’s clients, or
• Pose a risk to the soundness, stability, or resilience of the broader industry (such as the financial system or orderly market operations).

For a digital bank like Boost Bank — a Malaysian digital bank operating through its app and digital platforms — identifying CBS is a central step in designing and implementing an operational resilience program.

It enables the bank to focus on the services essential to its customers and the financial ecosystem, ensuring they are protected, continuously available, and rapidly recoverable under stress.

Purpose of the Chapter

This chapter aims to establish a clear understanding of what constitutes Critical Business Services (CBS) within Boost Bank’s operational resilience programme.

As a licensed Malaysian digital bank operating in a fully technology-enabled environment, Boost Bank delivers financial services that customers depend on daily for payments, savings, lending, and digital financial access.

Disruptions to these services can result in significant customer harm, regulatory consequences, and broader financial system instability.

By defining CBS in line with operational resilience principles and regulatory expectations — including Bank Negara Malaysia’s (BNM) evolving Operational Resilience framework and Risk Management in Technology (RMiT) requirements — this chapter provides the foundation for prioritising resilience efforts where they matter most.

By the end of this chapter, readers are expected to understand how to identify and articulate Boost Bank’s Critical Business Services, distinguish them from supporting operational processes, and appreciate the regulatory rationale behind CBS identification.

Readers will also gain clarity on how CBS mapping enables the setting of impact tolerances, dependency analysis, scenario testing, and governance oversight — all of which are essential components of a robust operational resilience programme for a Malaysian digital bank.

Critical Business Services (CBS) of Maybank Investment Bank

Underpinning Operational Components

Identifying CBS also requires understanding the dependencies and “underpinning services” that support them, such as:

• Core banking systems and databases
• Cloud hosting, network infrastructure, and data centres
• Third-party service providers and outsourced operators
• Cybersecurity and incident detection tools
  These dependencies must be mapped to understand how disruptions propagate and to set appropriate impact tolerances.

Regulatory Expectations in Malaysia

Bank Negara Malaysia (BNM), Malaysia’s central bank and financial regulator, is advancing operational resilience requirements for financial institutions, including digital banks like Boost Bank.

BNM Discussion Paper on Operational Resilience (2025)

In December 2025, BNM issued a discussion paper outlining its emerging regulatory direction on operational resilience for financial institutions. Though still consultative pending final policy issuance, it emphasises:

• Maintaining critical financial services during stress as essential to preserving public confidence and financial stability.
• Resilience governance and accountability mechanisms, tailored to increasingly digitalised, interconnected operations.
• Focus on ability to prevent, respond, recover, and adapt to disruptions across people, processes, technology, and third-party relationships.

This reflects an evolution in BNM’s supervisory expectations, complementing existing risk and continuity frameworks.

Existing Regulatory Frameworks with Resilience Implications

While BNM’s dedicated operational resilience policy is forthcoming, related regulatory instruments currently reinforce resilience requirements:

• Risk Management in Technology (RMiT) — a BNM policy that mandates governance, cybersecurity controls, third-party risk management, incident reporting, and resilience measures for technology systems. The RMiT requirements are particularly relevant for digital banks that depend heavily on technology platforms and third-party outsourced solutions.
• Business Continuity Management (BCM) Expectations — through BNM’s supervisory framework, BCM policies require financial institutions to conduct business impact analyses, have recovery strategies, and ensure continuity of essential services.

Impact on Boost Bank

As a licensed digital bank, Boost Bank is required to demonstrate operational readiness (as part of its licensing and ongoing supervision).

Its regulatory approval from BNM and the Ministry of Finance was contingent on a “thorough operational readiness review,” which implicitly requires robust infrastructure and resilience capabilities, including those supporting CBS.

Operational Resilience Implementation: CBS Lens

For Boost Bank to operationalise resilience around CBS, it should:

• Identify and Document CBS
  Clearly map service flows and dependencies for core banking, payments, lending, and ecosystem integration.

• Conduct Business Impact Analysis (BIA)
  Establish impact tolerances — the maximum acceptable disruption duration or loss thresholds for each CBS.

• Configure Resilience Capabilities
  Embed redundancy, failover, disaster recovery, cybersecurity controls, and continuity playbooks for critical systems.

• Test and Validate
  Run scenario tests and simulations to gauge service resilience under stress and refine plans accordingly.

• Governance & Reporting
  Implement governance structures that align with BNM expectations for resilience oversight.

Embedding Resilience through Critical Business Services

Identifying and managing Critical Business Services is central to Boost Bank’s operational resilience program.

For a digital bank operating in Malaysia’s evolving regulatory environment, CBS not only support internal continuity objectives but also aligns with BNM’s emerging resilience expectations.

Through robust identification, dependency mapping, impact tolerance setting, and structured resilience planning, Boost Bank can strengthen its capacity to withstand and adapt to service disruptions — safeguarding customers, the organisation, and the broader financial system.

Blogs marked [x] are under construction.

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.