[OR] [BC] [E1] [C5] Identifying Critical Business Services

Chapter 5

What Are the Critical Operations (Business Services) of Bank of Commerce for Operational Resilience?

Introduction

A core step in implementing operational resilience is identifying the services that the organisation must continue to deliver, even during severe disruption.

BCM Institute defines a Critical Business Service (CBS) as a service provided to clients which, if disrupted, could cause intolerable harm to customers or pose a risk to the stability and orderly functioning of the financial system.

For a Philippine bank such as Bank of Commerce, the same principle aligns closely with BSP Circular No. 1203, which requires BSP-supervised financial institutions to identify their critical operations, set tolerances for disruption, map interconnections and dependencies, and test their ability to continue delivering services through severe but plausible scenarios. (Bangko Sentral ng Pilipinas)

Bank of Commerce describes itself as a universal bank offering deposit products, commercial loans, credit cards, consumer banking, corporate banking, treasury services, asset management, transaction banking, and trust and investment services.

It also provides online banking for retail and corporate clients, a mobile banking app, and a nationwide branch and ATM network. (bankcom.com.ph)

Against that backdrop, the chapter below sets out the recommended critical business services that Bank of Commerce should prioritise when building its operational resilience programme.

Purpose of the Chapter

The purpose of this chapter is to identify the business services of Bank of Commerce that are most likely to meet the threshold of being “critical” from an operational resilience perspective.

The chapter also explains why these services matter, how they relate to BSP expectations, and which regulatory requirements a Philippine bank should consider when defining and protecting them. (BCM Institute Blog)

What Makes a Banking Service “Critical”?

A banking service is generally considered critical when its disruption would materially affect customers, prevent access to funds, interrupt high-volume or time-sensitive transactions, create regulatory breaches, or undermine confidence in the bank.

This is consistent with the BCM Institute's definition of CBS and with BSP Circular No. 1203, which focuses on maintaining the delivery of critical operations during disruption.

For Bank of Commerce, a service is more likely to be considered critical when it has one or more of these characteristics:

• It supports customer access to deposits or funds.
• It enables payments, transfers, or settlement activity.
• It is delivered through major customer channels such as branches, ATMs, online banking, or mobile banking.
• It supports large-scale retail or corporate transactions.
• It has significant dependencies on technology, people, third parties, or public infrastructure. 
  
  

Recommended Critical Business Services for Bank of Commerce

Because Bank of Commerce has not publicly listed its operational resilience CBS inventory on its website, the following CBS candidates are recommended and reasonable based on its published products, channels, and service model.

This is therefore an informed operational resilience assessment, not a statement that these have already been formally approved by the Bank’s Board.

CBS-1: Deposit and Account Services

This should be treated as a primary CBS. Bank of Commerce offers savings, checking, time deposit, payroll, pension, and corporate deposit accounts.

Disruption to this service would directly affect customers’ ability to hold funds, access balances, receive salaries or pension credits, and maintain basic banking relationships. 

Typical activities within this CBS include account opening, account maintenance, balance inquiry, posting of deposits and withdrawals, statement generation, passbook or account record updates, and reconciliation.

If these activities fail for an extended period, customers may be unable to access funds or verify their account status, causing immediate harm. This strongly fits the definition of a CBS.

CBS-2: Payments and Funds Transfer Services

Payments and transfer services should also be identified as critical. Bank of Commerce publicly offers PESONet and InstaPay services, online banking fund transfer capabilities, and remittance-related payment flows. 

This CBS is critical because customers and businesses rely on it for day-to-day financial activity, including person-to-person transfers, interbank transfers, corporate disbursements, and payment obligations.

A major outage could affect transaction volumes, customer confidence, and counterparties, and may also trigger broader market and ecosystem effects if the disruption is prolonged.

That aligns with the CBS concept of customer harm and the broader financial system impact.

CBS-3: Digital Banking and Electronic Customer Access

Bank of Commerce provides BankCom [Personal], BankCom [Business], a mobile banking app, ATMs, and point-of-sale related access channels.

These channels are not merely support tools; they are customer-facing service delivery mechanisms for balance inquiry, transfers, bill payment, and account servicing. 

For many customers, especially during branch closures or mobility restrictions, digital and electronic access is the practical means of obtaining banking services.

If these channels are disrupted, the underlying deposit and payment services may become inaccessible even if the back-office systems remain available.

For that reason, digital channel access should be treated as a standalone CBS or, at a minimum, as a critical component of the deposit-and-payment CBS structure. 

CBS-4: Cash Management and Transaction Banking Services

Bank of Commerce’s transaction banking offerings include cash management solutions such as BankCom PAY, BankCom COLLECT, and BankCom CONNECT / BankCom [Business].

These services support business collections, disbursements, and corporate transaction flows. 

This should be considered critical because business customers depend on these services to pay suppliers, employees, and government obligations, and to receive funds from customers or counterparties.

A prolonged disruption could affect payroll, collections, business liquidity, and commercial obligations. For a universal bank serving corporate clients, this is usually a high-priority CBS.

CBS-5: Branch, ATM, and Cash Access Services

Bank of Commerce states that it has a nationwide network of branches and ATMs.

For many customers, especially those dependent on cash, branch and ATM access remain essential for withdrawals, deposits, account servicing, and customer assistance. (bankcom.com.ph)

This service is critical because customer harm can arise quickly when cash access is lost, particularly during natural disasters, system outages, or telecom failures.

In the Philippine context, where public infrastructure disruption is a credible scenario, physical access channels remain central to resilience planning.

BSP Circular No. 1203 expressly says dependencies on public infrastructure, such as telecommunications, transportation, and energy, should be assessed for their impact on critical operations.

CBS-6: Lending and Credit Servicing

Bank of Commerce offers commercial loans, consumer loans, and credit card services. (bankcom.com.ph)

Not every aspect of lending is equally critical for immediate resilience. New loan origination may, in some cases, be less urgent than deposit withdrawals or payment transfers.

However, certain lending-related services are likely to be critical, especially loan drawdowns already committed, repayment processing, credit card transaction support, delinquency management, and customer servicing for existing credit obligations.

Disruption here can materially affect both retail and business customers.

This makes lending and credit servicing a likely CBS, although often secondary to deposits and payments in priority ranking.

That prioritisation is an inference based on customer harm and time sensitivity rather than a published BankCom designation.

CBS-7: Trade Finance and Selected Corporate Support Services

Bank of Commerce offers trade finance, letters of credit, export packing credit, export bills purchase, and domestic bills purchase. (bankcom.com.ph)

These may qualify as critical for certain corporate and commercial segments, particularly where disruption could block trade settlement, shipment release, or contractual performance.

Whether this becomes a top-tier CBS depends on the scale, customer concentration, and potential harm if unavailable.

For some banks, trade finance is critical because it directly affects client operations and liquidity; for others, it may sit just below the top tier.

Under BSP Circular No. 1203, the identification should be proportionate to the bank’s nature, scale, and complexity.

CBS-8: Trust, Treasury, and Investment Services

Bank of Commerce also offers trust, treasury, foreign exchange, government securities, corporate bonds, and other fiduciary or investment-related services.

These services may be critical for specific client groups, but they are not always the first services chosen in a bank-wide CBS inventory.

Their classification should depend on the degree of customer harm, market impact, regulatory exposure, settlement sensitivity, and substitutability.

For Bank of Commerce, these may be designated either as critical business services or as important business services requiring strong resilience controls.

This is another area where the final classification should be based on formal impact analysis and Board-approved criteria.

Suggested Priority CBS List for Bank of Commerce

BSP Operational Resilience Requirements Relevant to CBS Identification

BSP Circular No. 1203 sets out several requirements that directly affect how a Philippine bank should identify and manage its CBS, or critical operations.

First, the Board should approve the identified critical operations, and the identification must be proportionate to the bank’s nature, scale, and complexity.

The identified critical operations then drive the subsequent steps of setting disruption tolerances and mapping interconnections and interdependencies.

Second, banks must set a tolerance for disruption for each identified critical operation. BSP says this should include at least a time-based metric and may also include the maximum number of affected customers or the volume and value of affected transactions.

Third, banks must map interconnections and interdependencies involving critical operations.

The BSP self-assessment questionnaire asks whether the bank has identified responsible personnel, mapped interconnections and interdependencies, identified key resources that support the mapping, and addressed third-party providers involved in service delivery.

Fourth, banks must assess the impact of public infrastructure dependencies, such as telecommunications, transportation, and energy, on their critical operations.

Fifth, the bank’s technology and security environment must support resilience.

BSP specifically highlights risk-based strategies, multilayer security, and regular testing of ICT protection, detection, response, and recovery processes, especially against severe but plausible scenarios.

Sixth, business continuity management must be integrated into the operational resilience framework.

BSP requires business impact analyses, recovery strategies, incident recovery plans, communication and crisis management programs, and periodic exercises covering identified critical operations and their dependencies under severe but plausible scenarios.

Examples of How These Requirements Apply to Bank of Commerce

For Deposit and Account Services, Bank of Commerce would need to determine how long account access, posting, and servicing can be unavailable before causing unacceptable harm to customers.

It would also need to map dependencies on branches, ATMs, core banking systems, online banking, telecom links, and customer support teams.

This is a direct application of BSP’s requirements on tolerance for disruption and interdependency mapping. 

For Payments and Funds Transfer Services, the Bank should define time-based and transaction-based tolerances, such as how long PESONet, InstaPay, or internal transfer services can be interrupted before the disruption becomes unacceptable.

It should also assess dependencies on payment rails, network connectivity, cyber controls, and any third-party service arrangements.

For Digital Banking and Electronic Access, the Bank should consider severe but plausible scenarios such as a cyberattack, a mobile app outage, an internet banking failure, or a telecom disruption.

BSP explicitly notes that scenario-based testing should use realistic assumptions and may include major cyber incidents and failure of key service providers.

For Cash Management and Transaction Banking, the Bank should assess the effect of system failure on corporate disbursements, collections, and business continuity for clients.

This would include mapping key personnel, applications, host-to-host connectivity, approval workflows, and fallback procedures. (bankcom.com.ph)

For Branch, ATM, and Cash Access Services, the Bank should assess dependencies on public infrastructure, such as power, telecommunications, and transport access, since BSP explicitly requires these to be considered in relation to critical operations.

For Bank of Commerce, the most credible starting point for operational resilience is to identify a focused set of customer-facing services whose disruption would cause immediate and unacceptable harm.

Based on the Bank’s public service profile, the strongest CBS candidates are deposit and account services, payments and funds transfer services, digital banking and electronic access, cash management and transaction banking, branch and ATM cash access, and selected lending and credit servicing activities.

BSP Circular No. 1203 makes clear that identifying critical operations is not a standalone exercise. It must lead to Board-approved classifications, disruption tolerances, dependency mapping, third-party and infrastructure assessments, integrated BCM, and severe-but-plausible scenario testing.

For Bank of Commerce, this means the CBS inventory should become the backbone of the operational resilience programme and the basis for all later work in mapping, impact tolerance, scenario design, testing, and continual improvement.

Blogs marked [x] are under construction

eBook 1: Understanding Your Organisation: Bank Of Commerce
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

 

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.