[OR] [BC] [E3] [CBS] [1] [MPR] Map Processes and Resources

CBS-1 Deposit & Account Services

Introduction

[OR] [BC] [PH] [E3] [CBS] [1] [MPR] Deposit and Account Services

For Bank of Commerce, mapping Processes and Resources for CBS-1 Deposit and Account Services is a critical step in operational resilience implementation.

This mapping translates the earlier dependency view into a more granular, actionable structure by identifying end-to-end processes and the specific resources (people, technology, third parties) required to deliver each sub-service.

In line with the BCM Institute’s guidance on mapping processes and resources, this exercise enables the bank to understand how each component contributes to service delivery and where vulnerabilities, single points of failure, or resource constraints may exist.

Aligned with BSP Circular No. 1203 (2024), Philippine banks are required to identify critical operations, map their supporting resources, and ensure that these can remain within defined impact tolerances during disruptions.

For Bank of Commerce, CBS-1 is inherently critical due to its direct impact on customer access to funds, transaction processing, and financial stability.

The following table provides a structured mapping of each Sub-CBS to its supporting processes and resources, forming the foundation for scenario testing, resilience improvement, and regulatory compliance.

Table P3: Map Processes and Resources for CBS-1

Sub-CBS Code	Sub-CBS	Processes	People	Technology (Applications & Infrastructure)	Third-Party Vendors	Upstream / Downstream Dependencies
1.1	Customer Onboarding and Account Application	Application intake, document capture, CIF creation, customer consent	Branch officers, relationship managers, and customer service	Onboarding system, CIF, document management, branch network	ID verification providers, telecom providers	Upstream: Customer request; Downstream: KYC (1.2), Account Opening (1.3)
1.2	Customer Identification and Verification (KYC/CDD)	Identity verification, sanctions screening, risk classification	Compliance officers, AML analysts	KYC/AML system, screening tools, databases	External screening providers, government databases	Upstream: Onboarding (1.1); Downstream: Approval (1.3), Fraud Monitoring (1.15)
1.3	Account Approval and Opening	Approval workflow, account number generation, and activation	Branch managers, operations approvers	Core banking system, workflow engine	Network/infrastructure providers	Upstream: KYC (1.2); Downstream: Funding (1.4), Servicing (1.8)
1.4	Initial Funding and Deposit Booking	Cash/check deposit, transaction posting, receipt issuance	Tellers, branch operations	Teller system, core banking, clearing system	Clearing houses, payment networks	Upstream: Account Opening (1.3); Downstream: Transactions (1.6), Reporting (1.10)
1.5	Product Setup and Account Parameter Maintenance	Product configuration, rate updates, parameter controls	Product managers, IT support	Core banking configuration modules, rate engines	Core banking vendor	Upstream: Product governance; Downstream: Transactions (1.6), Fees (1.9)
1.6	Deposit Transactions Processing	Deposit posting, transfers, batch processing	Tellers, operations staff	Core banking, transaction processing engine, channels	Payment rails (PESONet/InstaPay), telecom providers	Upstream: Funding (1.4); Downstream: Reporting (1.10), Reconciliation (1.13)
1.7	Withdrawal and Funds Access Processing	Cash withdrawal, balance validation, authorization	Tellers, ATM support staff	ATM system, core banking, card switch	ATM vendors, cash logistics providers, BancNet/Mastercard	Upstream: Account status (1.14); Downstream: Fraud Monitoring (1.15)
1.8	Account Servicing and Customer Maintenance	Profile updates, account changes, customer requests	Customer service, branch staff	CRM, CIF, servicing platform	Telecom providers, messaging services	Upstream: Active accounts; Downstream: Reporting (1.10), Compliance (1.17)
1.9	Interest, Fees, and Charges Processing	Interest calculation, fee charging, adjustments	Finance team, operations staff	Core banking batch engine, rate tables	Tax/regulatory data providers	Upstream: Product setup (1.5); Downstream: Reporting (1.10), Complaints (1.16)
1.10	Statement, Passbook, and Balance Reporting	Statement generation, balance inquiry, and report distribution	Operations team, customer service	Statement engine, mobile/web banking, print systems	Email/SMS providers, print vendors	Upstream: Transactions (1.6), Fees (1.9); Downstream: Complaints (1.16)
1.11	Digital Account Access and Channel Integration	Online banking login, authentication, transactions	Digital banking team, IT support	Mobile app, online banking, IAM, API gateway	ISP providers, OTP/SMS vendors	Upstream: Account data (core banking); Downstream: Transactions (1.6), Fraud (1.15)
1.12	ATM and Card-Based Access Management	Card issuance, PIN management, and ATM transactions	Card operations, ATM support	Card management system, ATM network, switch	NCR, Mastercard, BancNet	Upstream: Account linking (1.3); Downstream: Withdrawal (1.7), Fraud (1.15)
1.13	Account Reconciliation and Exception Handling	Reconciliation, break resolution, adjustments	Finance, operations control	Reconciliation systems, GL interface	Payment networks, ATM/card schemes	Upstream: Transactions (1.6); Downstream: Reporting (1.17), Complaints (1.16)
1.14	Dormancy, Holds, and Account Restrictions Management	Dormancy tagging, account freezing, restrictions	Compliance, operations staff	Core banking controls, compliance tools	Legal/government authorities	Upstream: Account activity; Downstream: Withdrawal (1.7), Fraud (1.15)
1.15	Fraud Monitoring and Transaction Surveillance	Alert monitoring, investigation, escalation	Fraud analysts, AML team	Fraud detection systems, SIEM, analytics tools	Card networks, fraud intelligence providers	Upstream: Transactions (1.6, 1.7); Downstream: Reporting (1.17), Recovery (1.16)
1.16	Complaints, Disputes, and Service Recovery	Complaint intake, investigation, resolution	Customer care, dispute officers	CRM, case management systems	Card networks, merchants, telecom providers	Upstream: Reporting (1.10), Fraud (1.15); Downstream: Compliance (1.17)
1.17	Regulatory Reporting and Compliance Monitoring	Regulatory reporting, compliance checks, and audits	Compliance, finance, and audit teams	Reporting systems, data warehouse, and MIS	Regulators, auditors	Upstream: All sub-CBS; Downstream: Governance, Board reporting
1.18	Business Continuity and Service Recovery for Deposit Services	Incident response, DR activation, service recovery	BCM team, IT DR team, crisis management team	DR site, backup systems, communication tools	Data centre providers, telecom, cloud vendors	Upstream: All sub-CBS dependencies; Downstream: Full service restoration

BSP Circular No. 1203 - Operational Resilience Requirement and Examples

In compliance with BSP Circular No. 1203, Bank of Commerce must ensure the following:

Identification of Critical Operations

- CBS-1 (Deposit and Account Services) qualifies as a critical operation.
- Example: Define criticality for services such as ATM withdrawals, online balance access, and deposit posting.

Mapping of Processes and Resources

- The above table satisfies the requirement to map interconnections and dependencies.
- Example: Identifying reliance on telecom providers for digital banking and ATM connectivity.

Setting Impact Tolerances

- Define maximum tolerable downtime (e.g., 2 hours for ATM withdrawals, 4 hours for online banking).
- Example: If exceeded, trigger escalation and regulatory reporting.

Third-Party Risk Management

- Assess vendors such as ATM providers, payment networks, and telecom services.
- Example: Ensure SLAs and fallback arrangements for BancNet or Mastercard disruptions.

Scenario Testing (Severe but Plausible Scenarios)

- Required to test the resilience of mapped resources.
- Examples:
  - Core banking system outage during peak payroll processing
  - Cyberattack affecting online banking login
  - ATM network failure due to telecom outage
  - Third-party payment network disruption

Business Continuity Integration

Ensure CBS-1 can continue or recover within tolerance using DR sites and alternate processes.
Example: Manual branch processing when digital systems are unavailable.

The Map Processes and Resources for CBS-1 Deposit and Account Services provides Bank of Commerce with a comprehensive view of how each sub-service is delivered and supported.

By linking processes with people, technology, and third-party vendors, the bank gains visibility into critical operational dependencies and potential points of failure.

This structured mapping is essential for identifying vulnerabilities, prioritising resilience investments, and ensuring that services can be maintained or restored within acceptable limits during disruptions.

More importantly, this mapping directly supports compliance with BSP Circular No. 1203, enabling Bank of Commerce to demonstrate that it understands its critical operations, has mapped the necessary resources, and is prepared to conduct scenario testing and resilience improvements.

As the next step, the bank should use this mapping to define impact tolerances, conduct severe but plausible scenario testing, and continuously refine its operational resilience capabilities to safeguard customers, maintain trust, and ensure the stability of the financial system.

eBook 3: Starting Your OR Implementation
CBS-1 Deposit & Account Services
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.