[OR] [BI] [E3] [CBS] [3] [SuPS] Identify Severe but Plausible Scenarios

Sub-CBS Code

Sub-CBS

Severe but Plausible Scenario

Impact / Effect

Proactive Risk Management Action (Evidence)

Link to Integration of Cyber and ICT Risks

3.1

Product Structuring & Shariah Governance

Shariah non-compliance was identified post-product launch due to a system configuration error affecting profit calculation logic

Reputational damage, suspension of product, financial restitution, and regulatory scrutiny

Pre-launch Shariah validation checklist, automated rule validation testing, Shariah audit trails, annual independent Shariah review

ICT change management failure, configuration error risk, inadequate system testing controls

3.2

Customer Application Intake & Submission

Prolonged digital channel outage (mobile/web financing application portal) due to Distributed Denial of Service (DDoS) attack

Inability to submit applications, customer dissatisfaction, and revenue delay

DDoS protection, traffic monitoring, alternate manual/branch submission workflow, BCP-tested failover environment

Cybersecurity monitoring, network resilience, and cloud hosting redundancy

3.3

Credit Assessment & Approval

Core credit scoring engine unavailable following ransomware infection

Delayed approvals, backlog accumulation, and credit risk misjudgment if manual override is used

Segregated credit systems, regular data backups, endpoint detection response (EDR), and ransomware playbook exercises

Malware protection, secure data backup, privileged access management

3.4

Financing Documentation & Legal Perfection

Nationwide disruption to the e-signature platform or the third-party legal documentation vendor

Inability to perfect security documents, legal unenforceability risk

Dual-vendor legal panel, offline documentation fallback, periodic vendor resilience assessment

Third-party ICT risk management, vendor system integration dependency

3.5

Disbursement Processing

Payment interface failure between the financing system and the core banking system

Delayed or erroneous disbursement, financial loss, and customer complaints

Interface monitoring dashboards, reconciliation automation, and pre-disbursement control checks

API integration controls, system interface resilience testing

3.6

Account Setup & Maintenance

Data corruption during batch processing is affecting newly onboarded accounts

Incorrect balances, customer disputes, and operational rework

Automated data validation scripts, maker-checker controls, and daily reconciliation reporting

Database integrity monitoring, batch job resilience, disaster recovery testing

3.7

Instalment Collection & Payment Processing

Failure of auto-debit processing due to core banking outage during the peak cycle

Missed collections, liquidity mismatch, customer penalty disputes

Payment cycle contingency plan, grace-period policy activation, customer notification protocol

Core banking availability, real-time system monitoring, and recovery time objective (RTO) testing

3.8

Profit Calculation & Statement Generation

Incorrect profit computation due to a system patch defect

Financial misstatement, Shariah breach risk, regulatory reporting impact

Parallel run testing post-system patch, automated reconciliation of profit tables, and internal audit review

ICT patch management, change governance, and regression testing

3.9

Arrears Monitoring & Early Intervention

Failure of the early warning trigger system due to data feed disruption

Delayed arrears action, higher impairment levels

Automated exception reporting, manual watchlist review trigger, periodic stress testing

Data integration risk, data warehouse availability

3.10

Recovery & Collection Management

Cyber breach exposing customer recovery data

Confidentiality breach, regulatory penalties, litigation risk

Data encryption, restricted access controls, regular penetration testing, and incident response drills

Data protection controls, SOC monitoring, cyber incident management

3.11

Customer Service & Complaint Handling

CRM system outage during a high complaint surge following a financing disruption

Inability to log/track complaints, reputational impact

CRM backup system, manual complaint register protocol, overflow call centre arrangement

Cloud CRM resilience, third-party SaaS dependency risk

3.12

Regulatory, Risk & Shariah Reporting

Inaccurate regulatory submission due to data aggregation failure

Regulatory breach, supervisory action from BNM

Pre-submission validation scripts, independent risk review, regulatory reporting contingency process

Data governance controls, reporting system redundancy