[OR] [BI] [E3] [CBS] [4] [ITo] Establish Impact Tolerances

CBS-4 SME and Corporate Financing Services

Introduction

Operational resilience requires financial institutions to determine the maximum level of disruption they can tolerate before causing intolerable harm to customers, the financial system, or regulatory compliance. In line with expectations outlined in the 2025 Discussion Paper on Operational Resilience issued by Bank Negara Malaysia (BNM), impact tolerances must be defined for each Critical Business Service (CBS), focusing on outcomes rather than internal recovery metrics alone.

For CBS-4 SME and Corporate Financing Services, impact tolerances are calibrated based on the potential effect of service disruption on SMEs, corporate clients, trade flows, liquidity management, Shariah compliance, and prudential soundness. The tolerances below reflect “severe but plausible” disruption scenarios such as system outages, cyber incidents, third-party failure, or unavailability of key decision-making personnel.

Purpose of the Chapter

This chapter defines measurable impact tolerances for each Sub-CBS under CBS-4. It clarifies the maximum tolerable downtime (MTD) and maximum tolerable data loss (MTDL), articulates customer and regulatory impact thresholds, and highlights current resilience posture and improvement priorities. The objective is to ensure that disruption to SME and corporate financing activities remains within acceptable boundaries aligned with BNM’s supervisory expectations and Shariah governance requirements.

Table P4: Establish Impact Tolerance for CBS-4

Alignment with BNM Operational Resilience Expectations

Consistent with BNM’s 2025 Discussion Paper examples, the tolerances above:

• Focus on harm-based thresholds, not just IT recovery times.
• Prioritise customer liquidity impact, especially for SMEs dependent on timely disbursement.
• Consider systemic and market stability implications for trade and working capital financing.
• Embed Shariah governance oversight as a critical resilience dimension.
• Differentiate between internal processing delays and external regulatory deadline breaches.

High-impact services such as disbursement, limit activation, and regulatory reporting are assigned stricter tolerances, including zero data loss and near-zero downtime thresholds.

Establishing impact tolerances for CBS-4 SME and Corporate Financing Services strengthens the institution’s ability to withstand severe but plausible disruptions while protecting SME and corporate customers, maintaining financial stability, and upholding Shariah and regulatory obligations.

By defining clear maximum tolerable downtime and data loss thresholds and identifying improvement priorities, Bank Islam Malaysia Berhad can progressively enhance resilience maturity. The next phase should focus on scenario testing, board-level validation of tolerances, and closing identified resilience gaps to ensure continued compliance with supervisory expectations set by Bank Negara Malaysia and evolving operational risk standards.

This structured approach positions CBS-4 not only as a compliant function but as a strategically resilient capability supporting sustainable SME and corporate growth.

Implementing Operational Resilience for Bank Islam: Aligning with BNM and Global Best Practices
eBook 3: Starting Your OR Implementation
CBS-4 SME and Corporate Financing Services
CBS-4 DP	CBS-4 MD	CBS-4 MPR	CBS-4 ITo	CBS-4 SuPS	CBS-4 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.