---
title: [OR] [BI] [E3] [CBS] [2] [SuPS] Identify Severe but Plausible Scenarios
description: [OR] [BI] [E3] [CBS] [2] [SuPS] Identify Severe but Plausible Scenarios
image: https://blog.bcm-institute.org/hubfs/Bank%20Islam%20Graphic%20Folder/Bank%20Islam%20CBS%202%20Morepost/%5BOR%5D%20%5BBI%5D%20%5BE3%5D%20%5BCBS%5D%20%5B2%5D%20%5BSuPS%5D%20Payments%20and%20Funds%20Transfer%20Services.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Implementing Operational Resilience for Bank Islam: Aligning with BNM and Global Best Practices
# \[OR\] \[BI\] \[E3\] \[CBS\] \[2\] \[SuPS\] Identify Severe but Plausible Scenarios
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/76433f14-9236-4de8-a727-6b82d5d09a9b)For Bank Islam Malaysia, Payments and Funds Transfer Services (CBS-2) is a mission-critical capability that underpins customer trust, liquidity flow, and regulatory compliance.
In line with operational resilience principles, identifying severe but plausible scenarios enables the Bank to test its ability to remain within defined impact tolerances under extreme stress.
These scenarios are not routine operational incidents but high-impact events that are credible in today’s threat landscape—ranging from cyberattacks and ICT infrastructure failures to regulatory breaches and third-party disruptions.
The table below maps each Sub-CBS to representative severe but plausible scenarios, outlines their impact, and demonstrates proactive risk management actions aligned with cyber and ICT risk integration.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Feb 16, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![\[OR\] \[BI\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/b78af26b-21f2-4eb5-be89-d10901d460fb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b78af26b-21f2-4eb5-be89-d10901d460fb)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)**CBS-2 Payments and Funds Transfer Services**
#### Introduction
[![\[OR\] \[BI\] \[E3\] \[CBS\] \[2\] \[SuPS\] Payments and Funds Transfer Services](https://no-cache.hubspot.com/cta/default/3893111/4970a79b-1480-4204-8d7d-93650ff87efe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4970a79b-1480-4204-8d7d-93650ff87efe)For Bank Islam Malaysia, Payments and Funds Transfer Services (CBS-2) is a mission-critical capability that underpins customer trust, liquidity flow, and regulatory compliance.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b82f4b68-92a3-4741-a22a-c2df4a0479f2)In line with operational resilience principles, identifying severe but plausible scenarios enables the Bank to test its ability to remain within defined impact tolerances under extreme stress.
These scenarios are not routine operational incidents but high-impact events that are credible in today’s threat landscape—ranging from cyberattacks and ICT infrastructure failures to regulatory breaches and third-party disruptions.
The table below maps each Sub-CBS to representative severe but plausible scenarios, outlines their impact, and demonstrates proactive risk management actions aligned with cyber and ICT risk integration.
[![Banner \[Table\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86)
###### Table P5: Identify Severe but Plausible Scenarios for CBS-2
| Sub-CBS Code | Sub-CBS | Severe but Plausible Scenario | Impact / Effect | Proactive Risk Management Action | Link to Integration of Cyber and ICT Risks |
| --- | --- | --- | --- | --- | --- |
| 2-1 | Customer Payment Initiation | Distributed Denial-of-Service (DDoS) attack on internet/mobile banking channels during the peak period | Customers unable to initiate payments; reputational damage | DDoS mitigation services, traffic filtering, alternate channel routing, and customer communication protocol | Cybersecurity operations centre (SOC) monitoring, network resilience, secure digital channel architecture |
| 2-2 | Funds Transfer Processing (Intra-bank) | Core banking interface failure due to database corruption | Internal transfers delayed; account imbalance risk | Real-time database replication, automated failover, periodic recovery testing | ICT resilience, high-availability infrastructure, backup data integrity controls |
| 2-3 | Interbank Transfer Processing (IBFT & RENTAS) | National payment gateway outage affecting IBFT and RENTAS connectivity | Interbank transfers halted; liquidity and settlement delays | Contingency connectivity, manual fallback procedures, liquidity buffer planning | Third-party ICT dependency management, secure network connectivity, SWIFT/network redundancy |
| 2-4 | DuitNow & Instant Payment Services | Malware infiltration is affecting the instant payment API gateway | Fraudulent transactions; financial loss | API gateway hardening, endpoint detection and response (EDR), transaction anomaly detection | Secure API framework, cyber threat intelligence integration, and continuous vulnerability scanning |
| 2-5 | Payment Clearing & Settlement | Settlement file corruption before the clearing cycle | Incorrect clearing positions; regulatory breach | File validation controls, checksum verification, dual control approval | Secure file transfer protocol (SFTP), encryption, and ICT integrity monitoring |
| 2-6 | Corporate & Bulk Payment Processing | Ransomware attack on the bulk payment processing server | Corporate salary/vendor payments disrupted | Network segmentation, immutable backups, ransomware response playbook | Enterprise cybersecurity posture, backup isolation, and incident response orchestration |
| 2-7 | Cross-Border Payment Processing | Sanctioned country restriction update not reflected in system rules | Regulatory non-compliance; sanctions breach | Automated sanctions list updates, periodic rules validation testing | AML system integration, secure data feeds, ICT change management, and governance |
| 2-8 | Payment Authorization & Authentication | Compromise of the multi-factor authentication (MFA) system | Unauthorized payment approvals | Strong MFA configuration, adaptive authentication, and credential compromise monitoring | Identity & Access Management (IAM), privileged access management (PAM), cybersecurity monitoring |
| 2-9 | Sanctions Screening & AML Monitoring | Screening engine downtime during a high-volume transaction period | Transactions processed without screening; compliance breach | High-availability AML infrastructure, transaction queuing mechanism, and manual screening fallback | RegTech system resilience, secure database redundancy, and monitoring of screening logs |
| 2-10 | Transaction Posting & Core Banking Update | Core banking batch posting is delayed due to system overload | Customer balance discrepancies; complaints surge | Capacity planning, stress testing, performance monitoring dashboards | ICT capacity management, application performance monitoring (APM) |
| 2-11 | Exception Handling & Reversal Management | System logic error causing incorrect auto-reversals | Financial misstatement; reconciliation backlog | Change control testing, maker-checker validation, exception dashboards | Secure SDLC, system audit trails, and access control governance |
| 2-12 | Reconciliation & Nostro/Vostro Management | Failure in the reconciliation engine due to a corrupted settlement feed | Unreconciled items; liquidity exposure | Automated reconciliation alerts, daily exception reporting, contingency manual recon | Secure data exchange controls, system integrity checks |
| 2-13 | Customer Notification & Confirmation | SMS/email gateway outage during payment processing disruption | Customers are unaware of payment status; complaint escalation | Multi-channel notification redundancy, message queue monitoring | Third-party ICT vendor resilience assessment, API failover controls |
| 2-14 | Payment Reporting & Regulatory Submission | Regulatory reporting file not submitted due to system integration failure | Regulatory penalty; supervisory action | Pre-submission validation checks, reporting automation monitoring, and escalation matrix | Secure reporting interface, ICT integration testing, compliance system monitoring |
| 2-15 | Payment Channel Availability & Infrastructure Support | Data centre power failure affecting payment systems | Full payment service outage | Dual data centre architecture, disaster recovery (DR) site activation drills, RTO/RPO validation | Data centre resilience, DR orchestration, cyber-physical security integration |
[![Banner \[Summing\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/446ccb83-e056-40d0-aae5-834d73c13f43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/446ccb83-e056-40d0-aae5-834d73c13f43)
Identifying severe but plausible scenarios for CBS-2 enables Bank Islam Malaysia Berhad to move beyond theoretical risk assessments and into practical resilience validation.
By linking each Sub-CBS scenario to proactive controls and to explicit integration of cyber and ICT risks, the Bank strengthens its ability to withstand high-impact disruptions while maintaining customer confidence and regulatory compliance.
This structured approach ensures that operational resilience is not treated as a standalone compliance requirement, but as a dynamic capability embedded within technology governance, cybersecurity posture, third-party oversight, and enterprise risk management—positioning the Bank to operate confidently even under extreme but credible stress conditions.
| Implementing Operational Resilience for Bank Islam: Aligning with BNM and Global Best Practices | | | | | |
| --- | --- | --- | --- | --- | --- |
| **eBook 3: Starting Your OR Implementation** | | | | | |
| **CBS-2 Payments and Funds Transfer Services** | | | | | |
| **CBS-2 DP** | **CBS-2 MD** | **CBS-2 MPR** | **CBS-2 ITo** | **CBS-2 SuPS** | **CBS-2 ST** |
| [![\[OR\] \[BI\] \[E3\] \[CBS\] \[2\] \[DP\] Payments and Funds Transfer Services](https://no-cache.hubspot.com/cta/default/3893111/c898ee8d-2d4d-4cf4-9b2f-e97b84d91b3b.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c898ee8d-2d4d-4cf4-9b2f-e97b84d91b3b) | [![\[OR\] \[BI\] \[E3\] \[CBS\] \[2\] \[MD\] Payments and Funds Transfer Services](https://no-cache.hubspot.com/cta/default/3893111/e444b150-6d0f-45e3-b50f-3cdbfd8e22fb.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e444b150-6d0f-45e3-b50f-3cdbfd8e22fb) | [![\[OR\] \[BI\] \[E3\] \[CBS\] \[2\] \[MPR\] Payments and Funds Transfer Services](https://no-cache.hubspot.com/cta/default/3893111/3446a398-dce9-49f3-bde2-cdff67689b39.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3446a398-dce9-49f3-bde2-cdff67689b39) | [![\[OR\] \[BI\] \[E3\] \[CBS\] \[2\] \[ITo\] Payments and Funds Transfer Services](https://no-cache.hubspot.com/cta/default/3893111/9597f74e-1b94-4502-a538-b81ce691da68.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9597f74e-1b94-4502-a538-b81ce691da68) | [![\[OR\] \[BI\] \[E3\] \[CBS\] \[2\] \[SuPS\] Payments and Funds Transfer Services](https://no-cache.hubspot.com/cta/default/3893111/4970a79b-1480-4204-8d7d-93650ff87efe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4970a79b-1480-4204-8d7d-93650ff87efe) | [![\[OR\] \[BI\] \[E3\] \[CBS\] \[2\] \[ST\] Payments and Funds Transfer Services](https://no-cache.hubspot.com/cta/default/3893111/b941dc6b-846d-4718-9c2b-6494f06c7ba6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b941dc6b-846d-4718-9c2b-6494f06c7ba6) |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)Gain Competency:** For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-03-14T07:18:03.911Z",
"datePublished" : "2026-02-16T05:45:15.000Z",
"headline" : "[OR] [BI] [E3] [CBS] [2] [SuPS] Identify Severe but Plausible Scenarios",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-bi-e3-cbs-2-sups-identify-severe-but-plausible-scenarios",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```