[OR] [BDO] [E3] [CBS] [1] [MPR] Map Processes and Resources

Written by Moh Heng Goh | Mar 25, 2026 11:24:00 AM

CBS-1 Retail Deposit & Account Services

Introduction

Mapping Processes and Resources is a critical step in the Operational Resilience implementation lifecycle under [Implement Phase – Stage 2: Map Processes and Resources (MPR)].

For BDO Unibank, this exercise ensures that each sub-component of CBS-1: Retail Deposit & Account Services is fully understood in terms of the process flows, supporting resources, and interdependencies that enable service delivery to customers.

In alignment with BSP Circular No. 1203 (2024) on Operational Resilience, banks are required to identify and map people, processes, technology, facilities, and third-party dependencies supporting their critical operations. This mapping allows BDO Unibank to:

Identify single points of failure
Understand interconnected risks across systems and vendors
Enable effective response and recovery strategies
Support impact tolerance setting and scenario testing

Purpose of the Chapter

The purpose of this chapter is to provide a comprehensive mapping of the processes and resources supporting each Sub-CBS within Retail Deposit & Account Services. Readers will gain:

A structured understanding of how each service is delivered
Visibility into critical dependencies across people, technology, and third parties
Insight into regulatory expectations under BSP Circular 1203
A foundation for subsequent stages, including impact tolerance setting and severe but plausible scenario testing

Table P3: Map Processes and Resources for CBS-1

Sub-CBF Code	Sub-CBS	Processes	People	Technology (Applications & Infrastructure)	Third-Party Vendors	Upstream / Downstream Dependencies
1.1	Customer Onboarding & Account Opening	Customer data capture, application processing, and KYC initiation	Branch staff, Relationship managers	Core Banking System (CBS), CRM, onboarding platform	ID verification providers	Upstream: Customer channels; Downstream: KYC, account setup
1.2	Customer Identity Verification & Compliance Screening	KYC checks, AML screening, and sanctions filtering	Compliance officers, KYC analysts	AML systems, sanctions screening tools	Watchlist providers	Upstream: Onboarding; Downstream: Account approval
1.3	Account Setup & Product Configuration	Account creation, product assignment, parameter setup	Operations staff	Core banking, product engine	—	Upstream: KYC clearance; Downstream: funding
1.4	Initial Funding & Deposit Acceptance	Cash/cheque deposit, electronic funding	Tellers, operations staff	Teller systems, payment gateways	Payment networks	Upstream: Account creation; Downstream: ledger posting
1.5	Cash Withdrawal & Funds Access	ATM withdrawal, branch withdrawal	Tellers, ATM support teams	ATM network, core banking	ATM network providers	Upstream: account balance; Downstream: ledger updates
1.6	Account Maintenance & Customer Information Update	Update customer records, profile maintenance	Customer service, operations	CRM, core banking	—	Upstream: customer requests; Downstream: compliance
1.7	Passbook, Debit Card, Chequebook & Credential Fulfilment	Card issuance, printing, and delivery	Card operations team	Card management system	Card vendors, printing vendors	Upstream: account setup; Downstream: access services
1.8	Digital Banking Access Management	User registration, authentication setup	IT security, digital banking team	Online banking platform, IAM systems	OTP/SMS providers	Upstream: account setup; Downstream: transactions
1.9	Balance Inquiry, Statement & Account Information Services	Generate statements, balance queries	Customer service, IT support	Core banking, digital channels	Email/SMS providers	Upstream: ledger data; Downstream: customer access
1.10	Internal & External Account Transfers	Fund transfer processing, validation	Operations, payment team	Payment systems, core banking	Payment networks (InstaPay/PESONet)	Upstream: account balance; Downstream: settlement
1.11	Bills Payment & Scheduled Debit Services	Bill processing, auto-debit execution	Operations staff	Billing platforms, payment gateways	Billers, aggregators	Upstream: customer instruction; Downstream: settlement
1.12	Transaction Posting & Ledger Update	Transaction recording, reconciliation	Finance ops, IT	Core banking ledger	—	Upstream: transactions; Downstream: reporting
1.13	Interest, Fees & Charges Processing	Interest calculation, fee deduction	Finance team	Core banking, pricing engine	—	Upstream: ledger data; Downstream: statements
1.14	Exception Handling, Dispute & Error Resolution	Investigations, adjustments, reversals	Customer service, dispute team	Case management systems	Payment networks	Upstream: transaction issues; Downstream: resolution
1.15	Fraud Monitoring & Protective Controls	Fraud detection, alerts, and blocking	Fraud analysts, risk team	Fraud monitoring systems, AI analytics	Fraud detection vendors	Upstream: transactions; Downstream: incident response
1.16	Reconciliation, Control & Financial Reporting Support	Account reconciliation, reporting	Finance, audit teams	Reconciliation tools, reporting systems	—	Upstream: ledger data; Downstream: financial reporting
1.17	Regulatory Reporting & Compliance Monitoring	Regulatory submissions, compliance checks	Compliance, regulatory team	Regulatory reporting systems	Regulators, reporting platforms	Upstream: financial data; Downstream: regulators
1.18	Service Continuity, Recovery & Incident Response	DR activation, incident management	BCM team, IT DR team	DR systems, backup infrastructure	DR site providers	Upstream: disruption event; Downstream: recovery
1.19	Dormancy, Restriction, Freeze & Closure Management	Account status updates, closures	Operations, compliance	Core banking	—	Upstream: compliance triggers; Downstream: reporting
1.20	Third-Party & Infrastructure Dependency Management	Vendor monitoring, SLA management	Vendor management team, IT	Vendor management systems	Outsourced vendors, cloud providers	Upstream: vendor inputs; Downstream: service delivery

Regulatory Alignment with BSP Circular No. 1203 (2024)

The above mapping demonstrates compliance with key regulatory expectations:

1. Identification of Critical Resources

BSP requires banks to identify the people, technology, facilities, and third parties that support critical services.

Example

Fraud monitoring (1.15) identifies AI systems, analysts, and third-party tools.

2. Mapping of Interdependencies

Banks must understand end-to-end dependencies across systems and external providers.

Example

Fund transfers (1.10) depend on payment networks such as InstaPay and PESONet.

3. Third-Party Risk Management

Critical third parties must be identified and monitored.

Example

Card issuance (1.7) and OTP services (1.8) rely on external vendors.

4. Resilience and Recovery Capabilities

Banks must ensure they can respond to and recover from disruptions.

Example

Sub-CBS 1.18 explicitly maps DR infrastructure and recovery teams.

5. Data and System Integrity

Accurate transaction processing and reporting are required.

Example

Ledger updates (1.12) and reconciliation (1.16) ensure financial integrity

The mapping of processes and resources for CBS-1 Retail Deposit & Account Services provides BDO Unibank with a holistic view of how services are delivered and sustained under normal and disrupted conditions.

By identifying the people, processes, technologies, and third-party dependencies, the bank strengthens its ability to anticipate risks, respond effectively to disruptions, and maintain service continuity.

This structured mapping is not merely a documentation exercise—it is a foundational component of operational resilience. It directly supports:

Impact tolerance setting
Severe but plausible scenario design
Testing and validation of resilience strategies

Ultimately, by aligning with BSP Circular No. 1203, BDO Unibank ensures that its retail deposit services remain robust, recoverable, and customer-centric, even amid evolving operational and cyber threats.

Building Operational Resilience: A Case Study of BDO Unibank
eBook 3: Starting Your OR Implementation
CBS-1 Deposit & Account Services
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.



	If you have any questions, click to contact us.

View full post