[OR] [BDO] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Critical Business Services of BDO Unibank for Operational Resilience

Introduction

 Operational resilience begins with identifying the services that must continue, or be restored within an acceptable period, because disruption would cause unacceptable harm to customers, threaten the bank’s safety and soundness, or affect the wider financial system.

BCM Institute defines a Critical Business Service (CBS) as a service provided to clients which, if disrupted, could cause intolerable harm to clients or pose a risk to the stability or orderly operation of the financial system.

 Note that for global delivery of BCM Institute's OR training, CBS is used synonymously with Critical Operations and Important Business Services. 

For BDO Unibank, this exercise should be conducted through an end-to-end service lens rather than focusing solely on internal departments or systems.

That approach is especially relevant because BDO is a full-service universal bank with a wide range of products and channels, including lending, deposit-taking, foreign exchange, trust and investments, credit cards, retail cash cards, corporate cash management, remittances, and digital banking.

BDO also operates the Philippines’ largest branch and ATM footprint and offers extensive digital and international banking capabilities.

What is a ‘Critical Business Service’?

A service should generally be classified as critical when prolonged disruption would likely:

• materially harm retail or corporate customers,
• impair access to money, deposits, payments, or credit,
• disrupt market or liquidity activities,
• create contagion across interconnected institutions or payment systems, or
• threaten regulatory compliance and the bank’s safe and sound operation.

In practice, a bank should distinguish between:

• business services delivered to customers or the market,
• underpinning services such as IT, facilities, and third parties, and
• internal activities that support delivery but are not themselves the CBS presented to the regulator.

Understanding Critical Business Services (CBS)

A Critical Business Service is a service whose disruption would cause material harm to customers, financial stability, or the institution itself.

Regulators require institutions to identify these services, define tolerance for disruption, and ensure they can continue during severe but plausible scenarios.

Critical Business Services for BDO Unibank

The following CBS are a reasoned chapter-level proposal based on BDO’s published products, channels, and business model.

They are not an official BDO-issued CBS inventory, but they are suitable starting points for an operational resilience program.

This proposed list is grounded in BDO’s published service portfolio, including deposit-taking, lending, corporate cash management, remittances, credit cards, treasury-related products, and digital banking.

Recommended Priority CBS for BDO Unibank

For a first implementation cycle, BDO could prioritise the following as its initial top-tier CBS:

Retail Deposit and Account Services

This should almost certainly be in scope because BDO is a major deposit-taking institution and the largest bank in the Philippines by deposits and branch footprint.

An extended inability of customers to access balances, withdraw cash, or maintain accounts would create immediate customer harm and reputational damage.

Payments and Funds Transfer Services

This is a natural CBS because BDO’s published digital services allow customers to send money to BDO accounts, other banks, and wallets, while its business offerings include day-to-day cash management and payment capabilities for firms.

These are services whose disruption could affect the broader financial ecosystem.

Corporate and SME Lending Services

For many business customers, access to lending, drawdowns, and servicing is essential to operations, payroll, inventory, and contractual obligations.

Given BDO’s broad lending franchise, this should be treated as a likely CBS.

Treasury and Liquidity Management

Treasury is critical not only as a customer-facing capability in FX and investment products, but also as a core internal capability that supports liquidity, funding, and market continuity.

For a large universal bank, disruption here can quickly escalate into prudential and systemic concerns.

Remittance Services

Given BDO’s international offices and the 24/7 positioning of BDO Remit, this service is highly relevant in the Philippine context, where many customers and households depend on remittance flows.

How BDO Should Identify and Validate its CBS

Using the BCM Institute approach, BDO should start with the customer journey and then assess which services, if disrupted, would create intolerable customer harm or systemic consequences.

Useful inputs include risk registers, critical asset lists, third-party inventories, and existing business continuity and recovery plans.

A practical identification process for BDO would be:

• List all externally delivered banking services across retail, corporate, institutional, treasury, cards, remittance, and digital channels.

• Assess the impact of disruption using customer harm, volume/value of transactions, regulatory consequences, financial stability implications, and reputational damage.

• Separate customer-facing services from underpinning services such as core banking, data centres, telecoms, cloud, and vendors.

• Rank the services according to criticality.

• Validate with business heads and control functions, including operations, technology, risk, compliance, treasury, branch banking, payments, and BCM.

• Approve the CBS inventory through governance channels and use it to drive impact tolerances, mapping, and scenario testing.

Philippine Regulatory Requirements Relevant to CBS Identification

For Philippine banks, BSP Circular No. 1203, series of 2024, is the key reference. It states that the guidelines are intended to strengthen supervised financial institutions’ ability to manage and mitigate disruptions, particularly on their critical operations.

It applies to BSFIs and expects an operational resilience framework proportionate to the institution’s nature, scale, and complexity.

The circular is especially relevant to CBS work because it requires banks to identify critical operations and makes clear that these operations drive the subsequent steps of setting tolerance for disruption and mapping interconnections and interdependencies.

Key Regulatory Requirements and Examples for BDO

Identify Critical Operations (Critical Business Services)

The BSP expects the Board to approve the identified critical operations in proportion to the bank’s nature, scale, and complexity.

Those critical operations become the foundation for the resilience program.

Example for BDO

BDO may designate “Retail Deposit and Account Services,” “Payments and Funds Transfer Services,” and “Treasury and Liquidity Management” as critical operations/CBS because their disruption could materially harm customers and affect the wider financial system.

Set Tolerance for Disruption (Impact Tolerance)

The circular requires a clearly defined tolerance for disruption using quantitative and/or qualitative indicators, with at least a time-based metric for restoring delivery before material risk arises.

Other metrics may include the maximum number of customers affected and the volume and value of transactions affected.

Example for BDO

For payments, BDO might define a disruption tolerance, such as a maximum outage duration, a maximum percentage of failed transactions, or a maximum customer impact threshold, before escalation to Board-level reporting.

Determine Severe but Plausible Scenarios

The BSP strongly encourages banks to consider scenarios such as a West Valley Fault “Big One,” severe typhoons, failure of a critical third-party service provider, disruptions to payment and settlement systems, and simultaneous or coordinated cyberattacks or ransomware affecting multiple banks.

Example for BDO

BDO should test how “Payments and Funds Transfer Services” would continue under a ransomware attack combined with a telecom outage, or how branch-led deposit services would operate after a severe typhoon affecting a region.

Map Interconnections and Interdependencies

The BSP’s self-assessment questions explicitly ask whether the bank has mapped interconnections and interdependencies among critical operations and identified the sources and resources that support them.

Example for BDO

For “Remittance Services,” BDO should map correspondent partners, remittance hubs, sanctions screening, branch payout capability, telecom connectivity, customer notification, and dependency on international offices.

Manage Third-party and Public Infrastructure Dependencies

The circular says that third-party service arrangements affecting critical operations must include details on how critical operations will be maintained during disruptions, or, where needed, an exit strategy if the provider cannot deliver.

It also says dependencies on public infrastructure, such as telecommunications, transportation, and energy, should be assessed for their impact on critical operations and disruption tolerances.

Example for BDO

For digital banking and cash management, BDO should assess dependencies on telecom, cloud/hosting, data centre, cybersecurity, and outsourced support, and document fallback arrangements or substitutability.

Integrate Business Continuity Management and Testing

The BSP requires BCM, including the business continuity plan, to be integrated into the operational resilience framework.

It expects business impact analyses, recovery strategies, incident recovery plans, communication and crisis management programs, and testing based on severe but plausible scenarios. Results of testing must be documented and reported to the Board.

Example for BDO

BDO should not stop at identifying CBS. It should test whether each CBS can remain within tolerance during cyber, branch, telecom, settlement, and third-party disruption scenarios, then feed gaps into investment and remediation plans.

CBS Narrative for BDO Unibank

A concise chapter statement for BDO could read:

BDO Unibank’s Critical Operations are customer-facing, market-relevant banking services whose disruption would cause intolerable harm to customers, materially impair confidence in the bank, or pose a risk to the wider Philippine financial system.

Based on BDO’s business model, these are likely to include Retail Deposit and Account Services, Payments and Funds Transfer Services, Corporate Cash Management, Remittance Services, Corporate and SME Lending Services, Treasury and Liquidity Management, Card and Merchant Payment Services, and Digital Banking Access.

These services should form the starting point for setting disruption tolerances, mapping dependencies, and conducting severe-but-plausible scenario testing.

 For BDO Unibank, identifying Critical Business Services is not simply a cataloguing exercise. It is the core design decision that shapes the rest of the operational resilience program.

BDO’s scale, universal banking model, digital reach, remittance footprint, and system relevance mean that services tied to deposits, payments, lending, treasury, remittances, cards, and digital access should be examined first.

BSP Circular No. 1203 makes this regulatory expectation clear: banks must identify critical operations, set tolerances for disruption, map dependencies, manage third-party and infrastructure risk, and test resilience under severe but plausible scenarios.

For BDO, the most practical starting point is to identify a prioritised set of CBS, validate them with senior management and the Board, and then build the mapping and scenario-testing program around them.

Blogs marked [x] are under construction. 

Implementing Operational Resilience for BDO Unibank: A Case Study for BDO Unibank
eBook 1: Understanding Your Organisation: BDO Unibank
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

 

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.