---
title: [OR] [BC] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios
description: [OR] [BC] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios
image: https://blog.bcm-institute.org/hubfs/PH%20Bank%20Graphic%20Folder/%5BPH%5D%20Bank%20of%20Commerce%20Graphic%20Folder/BC%20CBS%201%20Morepost/%5BOR%5D%20%5BBC%5D%20%5BPH%5D%20%5BE3%5D%20%5BCBS%5D%20%5B1%5D%20%5BSuPS%5D%20Deposit%20and%20Account%20Services%20(2).jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### A Practical Guide to Operational Resilience for Bank of Commerce
# \[OR\] \[BC\] \[E3\] \[CBS\] \[1\] \[SuPS\] Identify Severe but Plausible Scenarios
[![x \[OR\] \[BC\] Title Banner](https://no-cache.hubspot.com/cta/default/3893111/2922ffed-6e42-4c46-b0e8-489f39a4a569.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2922ffed-6e42-4c46-b0e8-489f39a4a569)
For **Bank of Commerce**, identifying **Severe but Plausible Scenarios (SbPS)** for **CBS-1 Deposit and Account Services** is a critical step in operational resilience.
These scenarios are not hypothetical extremes but **credible disruption events** that could realistically occur and significantly impact the bank’s ability to deliver essential deposit services.
According to BCM Institute guidance, SbPS should test the resilience of critical business services against a combination of **operational, cyber, third-party, and environmental disruptions**, ensuring that the organisation can remain within its defined **impact tolerances**.
Aligned with **BSP Circular No. 1203 (2024)**, banks in the Philippines are required to conduct **scenario testing using severe but plausible disruptions**, including cyber incidents, technology failures, and third-party outages.
The scenarios below are designed to reflect Bank of Commerce’s operating environment, including reliance on **core banking systems, digital banking channels, ATM/card networks (e.g., BancNet/Mastercard), telecom infrastructure, and third-party vendors**.
Each scenario also integrates **Cyber and ICT risks**, as required by regulators, and includes **proactive risk management actions** to demonstrate preparedness.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Apr 16, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![x \[OR\] \[BC\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/7a61d5e2-839c-40e6-b26f-6b288e5eb16f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7a61d5e2-839c-40e6-b26f-6b288e5eb16f)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)**CBS-1 Deposit & Account Services**
#### Introduction
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b82f4b68-92a3-4741-a22a-c2df4a0479f2)
[![\[OR\] \[BC\] \[PH\] \[E3\] \[CBS\] \[1\] \[SuPS\] Deposit and Account Services (2)](https://no-cache.hubspot.com/cta/default/3893111/6f34529c-628a-451b-8c39-72d7da6efc6c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6f34529c-628a-451b-8c39-72d7da6efc6c)
For **Bank of Commerce**, identifying **Severe but Plausible Scenarios (SbPS)** for **CBS-1 Deposit and Account Services** is a critical step in operational resilience.
These scenarios are not hypothetical extremes but **credible disruption events** that could realistically occur and significantly impact the bank’s ability to deliver essential deposit services.
According to BCM Institute guidance, SBPS should test the resilience of critical business services against a combination of **operational, cyber, third-party, and environmental disruptions**, ensuring that the organisation can remain within its defined **impact tolerances**.
Aligned with **BSP Circular No. 1203 (2024)**, banks in the Philippines are required to conduct **scenario testing using severe but plausible disruptions**, including cyber incidents, technology failures, and third-party outages.
The scenarios below are designed to reflect Bank of Commerce’s operating environment, including reliance on **core banking systems, digital banking channels, ATM/card networks (e.g., BancNet/Mastercard), telecom infrastructure, and third-party vendors**.
Each scenario also integrates **Cyber and ICT risks**, as required by regulators, and includes **proactive risk management actions** to demonstrate preparedness.
[![Banner \[Table\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86)
###### Table P5: Identify Severe but Plausible Scenarios for CBS-1
| Sub-CBS Code | Sub-CBS | Severe but Plausible Scenario | Impact / Effect | Proactive Risk Management Action | Link to Integration of Cyber and ICT Risks |
| --- | --- | --- | --- | --- | --- |
| 1.1 | Customer Onboarding and Account Application | Branch system outage during peak onboarding period | Delayed account opening; backlog of applications | Implement offline onboarding forms and batch upload capability | ICT system outage, endpoint failure |
| 1.2 | Customer Identification and Verification (KYC/CDD) | KYC/AML screening system unavailable due to vendor outage | Inability to verify customers; onboarding halted | Maintain backup screening procedures and alternate provider access | Third-party system failure, cyber dependency |
| 1.3 | Account Approval and Opening | Workflow system failure or database corruption | Accounts cannot be activated; service delays | Enable manual approval and post-recovery reconciliation | Core system failure, data integrity risk |
| 1.4 | Initial Funding and Deposit Booking | Core banking outage during deposit transactions | Funds not credited; customer dissatisfaction | Activate manual receipting and deferred posting procedures | Core banking disruption, transaction integrity risk |
| 1.5 | Product Setup and Account Parameter Maintenance | Incorrect parameter deployment due to a system error | Wrong fees/interest applied across accounts | Enforce maker-checker controls and rollback procedures | Configuration risk, system change failure |
| 1.6 | Deposit Transactions Processing | The core banking system crashed during the peak transaction period | Inability to process deposits/transfers; systemic disruption | Implement active-active DR architecture and transaction replay | Critical ICT failure, high availability risk |
| 1.7 | Withdrawal and Funds Access Processing | ATM network outage due to telecom failure | Customers are unable to withdraw cash | Provide branch fallback withdrawals and alternate network routing | Telecom outage, ATM network dependency |
| 1.8 | Account Servicing and Customer Maintenance | CRM system unavailable due to a cyber incident | Customer requests are delayed; poor service experience | Enable manual servicing logs and prioritise high-risk requests | Cyberattack, data access disruption |
| 1.9 | Interest, Fees, and Charges Processing | Batch processing failure at the end of the day | Incorrect balances or missing interest postings | Re-run batch with validation controls and reconciliation checks | Batch processing risk, system integrity issue |
| 1.10 | Statement, Passbook, and Balance Reporting | Reporting system failure or data inconsistency | Customers are unable to view accurate balances/statements | Enable alternate reporting channels and regenerate statements | Data integrity risk, reporting system failure |
| 1.11 | Digital Account Access and Channel Integration | A Distributed Denial-of-Service (DDoS) attack on online banking | Customers are unable to log in or transact online | Deploy DDoS protection, traffic filtering, and failover channels | Cyberattack (DDoS), digital channel disruption |
| 1.12 | ATM and Card-Based Access Management | Card switch failure or BancNet/Mastercard outage | ATM and POS transactions unavailable | Establish alternate routing and contingency withdrawal processes | Third-party ICT dependency, network failure |
| 1.13 | Account Reconciliation and Exception Handling | The reconciliation system failure is causing a backlog of breaks | Unresolved discrepancies affecting financial integrity | Automate reconciliation recovery and prioritise high-value breaks | Data processing failure, system outage |
| 1.14 | Dormancy, Holds, and Account Restrictions Management | Failure to apply fraud hold due to system outage | Unauthorised transactions; potential fraud losses | Enable emergency manual hold procedures and escalation | Control system failure, fraud risk |
| 1.15 | Fraud Monitoring and Transaction Surveillance | Fraud monitoring system outage during cyberattack | Undetected fraudulent transactions; financial losses | Implement real-time alert backup and manual monitoring escalation | Cybersecurity failure, SIEM disruption |
| 1.16 | Complaints, Disputes, and Service Recovery | Call centre system outage during a major incident | Customers are unable to report issues or disputes | Activate alternate communication channels (email, branch) | Telecom failure, communication system outage |
| 1.17 | Regulatory Reporting and Compliance Monitoring | Data warehouse failure before the regulatory submission deadline | Inability to submit accurate regulatory reports | Maintain manual reporting templates and escalation protocols | Data system failure, reporting risk |
| 1.18 | Business Continuity and Service Recovery for Deposit Services | Data centre outage due to a natural disaster or a cyberattack | Multiple services are disrupted across CBS-1 | Activate the DR site, the crisis management team, and recovery procedures | Full ICT infrastructure failure, cyber/physical risk |
#### BSP Circular No. 1203 – Regulatory Requirements and Examples
Under **BSP Circular No. 1203**, banks are required to:
##### **Conduct Scenario Testing Using Severe but Plausible Events**
- Banks must test their ability to remain within impact tolerance during disruptions.
- **Example:** Simulate a **core banking outage (1.6)** during peak payroll processing to assess recovery capability.
##### **Integrate Cyber and ICT Risks into Operational Resilience**
- Cyber resilience is a key pillar of operational resilience.
- **Example:** Test a **DDoS attack on digital banking (1.11)** or a **fraud system outage (1.15)**.
##### **Address Third-Party and Public Infrastructure Dependencies**
- Banks must assess risks from vendors and infrastructure, such as telecom and payment networks.
- **Example:** Simulate **BancNet/Mastercard outage (1.12)** or **telecom failure affecting ATM services (1.7)**.
##### **Ensure Business Continuity and Recovery Capability**
- Banks must have plans to recover critical services within tolerance.
- **Example:** Test **data centre outage scenario (1.18)** with full DR activation.
##### **Protect Customers and Maintain Financial Stability**
- Scenarios must consider customer harm and systemic impact.
- **Example:** Evaluate the impact of **failed deposit posting (1.4)** or **fraud detection failure (1.15)**.
[![Banner \[Summing\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/446ccb83-e056-40d0-aae5-834d73c13f43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/446ccb83-e056-40d0-aae5-834d73c13f43)
The identification of **Severe but Plausible Scenarios** for CBS-1 Deposit and Account Services enables Bank of Commerce to move from static planning to **dynamic resilience testing**.
By linking each sub-service to realistic disruption scenarios, the bank can better understand how failures in **technology, cyber systems, third parties, or processes** may cascade across operations.
This approach ensures that resilience is not only documented but actively validated through testing and continuous improvement.
More importantly, this exercise aligns directly with **BSP Circular No. 1203**, which emphasises **scenario testing, cyber resilience, third-party risk management, and the integration of business continuity**.
For Bank of Commerce, the next step is to operationalise these scenarios through **structured testing exercises**, validate recovery capabilities against defined **impact tolerances**, and continuously refine controls to ensure that critical deposit services remain available, secure, and reliable—even under severe disruption conditions.
[![x \[OR\] \[BC\] Title Banner](https://no-cache.hubspot.com/cta/default/3893111/2922ffed-6e42-4c46-b0e8-489f39a4a569.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2922ffed-6e42-4c46-b0e8-489f39a4a569)
| **eBook 3: Starting Your OR Implementation** | | | | | |
| --- | --- | --- | --- | --- | --- |
| **CBS-1 Deposit & Account Services** | | | | | |
| **CBS-1 DP** | **CBS-1 MD** | **CBS-1 MPR** | **CBS-1 ITo** | **CBS-1 SuPS** | **CBS-1 ST** |
| [![\[OR\] \[BC\] \[PH\] \[E3\] \[CBS\] \[1\] \[DP\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/7896e48f-2c2c-4ca2-b6c3-52367a2403c9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7896e48f-2c2c-4ca2-b6c3-52367a2403c9) | [![\[OR\] \[BC\] \[PH\] \[E3\] \[CBS\] \[1\] \[MD\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/c6dc8baf-99d8-45c8-8672-e1160fd9d09d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c6dc8baf-99d8-45c8-8672-e1160fd9d09d) | [![\[OR\] \[BC\] \[PH\] \[E3\] \[CBS\] \[1\] \[MPR\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/ef57feb1-17e4-46c5-a61a-19dd399a0e0f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ef57feb1-17e4-46c5-a61a-19dd399a0e0f) | [![\[OR\] \[BC\] \[PH\] \[E3\] \[CBS\] \[1\] \[ITo\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/e90020ac-256e-4127-8607-ad544e9636c9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e90020ac-256e-4127-8607-ad544e9636c9) | [![\[OR\] \[BC\] \[PH\] \[E3\] \[CBS\] \[1\] \[SuPS\] Deposit and Account Services (2)](https://no-cache.hubspot.com/cta/default/3893111/6f34529c-628a-451b-8c39-72d7da6efc6c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6f34529c-628a-451b-8c39-72d7da6efc6c) | [![\[OR\] \[BC\] \[PH\] \[E3\] \[CBS\] \[1\] \[ST\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/4fb08be9-c33e-4c62-b11a-7094f5d4472d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4fb08be9-c33e-4c62-b11a-7094f5d4472d) |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)**Gain Competency:** For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-04-19T11:59:24.249Z",
"datePublished" : "2026-04-16T19:37:39.000Z",
"headline" : "[OR] [BC] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-bc-e3-cbs-1-sups-identify-severe-but-plausible-scenarios",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```