[OR] [BJB] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Identifying Critical Business Services for Bank Julius Bear

Introduction

Operational resilience requires a financial institution to understand not merely which departments, systems or processes are important, but which business services must continue to be delivered to customers and other stakeholders when disruption occurs.

For Bank Julius Baer (BJB) in Singapore, this distinction is particularly important. Julius Baer operates as an international wealth manager, with Singapore forming part of its global network.

Its services include wealth management and investment-related activities, including investment advisory and securities execution. 

A disruption affecting BJB may therefore extend beyond the failure of an individual application or department.

An outage could prevent clients from accessing their assets, submitting or executing investment instructions, receiving liquidity, completing securities transactions, or communicating urgent instructions during periods of market stress.

Identifying Critical Business Services (CBS) therefore provides the starting point for implementing an operational resilience programme from an end-to-end service perspective.

For BJB, the objective should be to identify a manageable set of services whose disruption could significantly affect:

• clients and their ability to manage or access their wealth;
• BJB's safety and soundness;
• counterparties and other financial institutions dependent upon the service;
• financial-market transactions or settlement obligations; or
• BJB's ability to meet significant legal and regulatory obligations.

The proposed CBS catalogue in this chapter is an illustrative implementation model.

It is based on the operating characteristics of a private bank and wealth manager and should ultimately be validated by BJB management against its actual legal entities, customer journeys, products, transaction volumes, technology architecture, outsourcing arrangements and regulatory obligations.

What Is a Critical Business Service (CBS)?

Consider a Critical Business Service from the perspective of the outcome delivered to the service recipient, rather than an internal organisational structure.

The BCM Institute describes a Critical Business Service as a service provided by an organisation, or by another party on its behalf, to one or more clients where disruption could cause intolerable harm to clients or pose a risk to the soundness, stability or resilience of the financial industry, its systems or the orderly operation of markets.

This distinction is fundamental.

A department is not necessarily a CBS. A technology application is not necessarily a CBS. An operational process is not necessarily a CBS. These components may instead be dependencies that enable the CBS to be delivered.

For example:

In this example, the service experienced by the client is the ability to submit and have an eligible securities transaction executed.

The employees, applications, market infrastructure, counterparties and information supporting that outcome are its interconnections and interdependencies.

This service-oriented view is consistent with the MAS approach.

MAS defines a critical business service in its BCM Guidelines as a business service whose disruption is likely to significantly impact the financial institution's safety and soundness, its customers, or other financial institutions dependent on that service. 

Consequently, BJB should avoid simply converting an existing list of critical business functions into a CBS catalogue.

Instead, it should start with the services and outcomes experienced by clients and other external recipients, then determine which internal functions enable those services.

Moving from Functions to Services

Traditional Business Continuity Management commonly starts by identifying critical functions and determining their recovery requirements.

Operational resilience adds an important perspective by asking:

What service must BJB continue delivering, and what happens to the client if the complete end-to-end service is disrupted?

Consider the following example:

Several BJB functions may participate in this journey. A disruption to any critical link could prevent the service outcome from being achieved.

This end-to-end perspective is important because resilience cannot be demonstrated solely by showing that individual departments have business continuity plans or that individual systems have disaster recovery arrangements.

BJB must understand whether the entire service can continue or be recovered within the required disruption tolerance.

Key Considerations for Identifying CBS at BJB

BJB should apply consistent criteria when deciding whether to designate a business service as critical.

Impact on Clients

The first consideration is the potential harm caused to clients.

BJB should consider whether disruption could prevent clients from:

• accessing funds or assets;
• executing time-sensitive investment instructions;
• responding to rapidly changing market conditions;
• meeting financial obligations;
• obtaining essential information concerning their portfolios;
• transferring funds or securities; or
• obtaining urgent assistance from BJB.

The assessment should consider both the number of clients affected and the characteristics of affected clients. MAS specifically identifies the number and profile of customers, and how those customers are affected, as relevant considerations in assessing criticality. (Integrium)

Safety and Soundness of BJB

A service should also be considered critical where prolonged disruption could materially affect the bank's ability to operate safely.

Potential consequences include:

• significant financial exposure;
• uncontrolled transaction backlogs;
• inability to complete settlement obligations;
• inaccurate positions or books and records;
• inability to monitor material exposures;
• significant operational losses; and
• escalation of liquidity, counterparty or market risk.

Dependency of Other Financial Institutions

Private banking services operate within an interconnected financial ecosystem.

BJB may depend upon, and in turn provide transactions to or through:

• correspondent banks;
• custodians and sub-custodians;
• brokers;
• exchanges;
• clearing organisations;
• settlement infrastructures;
• payment networks;
• market-data providers; and
• other financial institutions.

A disruption should therefore be assessed not only by its direct impact on BJB but also by the potential consequences for institutions dependent on the affected service.

Time Criticality

The consequences of disruption normally increase with time.

For example, the temporary unavailability of a periodic client report may initially cause inconvenience.

Failure to execute a time-sensitive investment instruction during extreme market volatility may produce much more immediate consequences.

BJB should therefore assess:

The time dimension should support establishing the MAS Service Recovery Time Objective (SRTO) for each identified CBS.

Transaction and Asset Criticality

The assessment should consider the nature and value of transactions supported by the service.

A relatively small number of transactions may still represent significant financial exposure. This is especially relevant in private banking, where transaction values and portfolio sizes can be substantial.

Criticality should therefore not be determined by transaction volume alone.

Regulatory Significance

Services supporting regulated banking and investment activities should be evaluated for the consequences of prolonged unavailability, including whether disruption could compromise BJB's ability to meet material obligations relating to:

• safeguarding client assets;
• transaction execution;
• settlement;
• books and records;
• risk management;
• financial-crime controls;
• client communications; and
• regulatory reporting.

Cross-Border Dependencies

As an international wealth manager, BJB should pay particular attention to services delivered through global operating models.

The delivery chain may include:

This creates the possibility that a disruption outside Singapore could prevent BJB Singapore from delivering a CBS even where local staff and facilities remain available.

Third-Party and Concentration Risk

BJB should identify whether a CBS depends upon a small number of providers or upon a common technology or infrastructure component.

MAS expects financial institutions to identify end-to-end dependencies supporting critical business services, including people, processes, technology, data and third parties, and to address gaps that could impede safe recovery.

MAS also expects measures proportionate to the criticality of third parties and their impact on CBS.

Proposed Critical Business Services for BJB

Based on the operating characteristics of a private bank and international wealth manager, the following CBS catalogue provides a practical starting point for BJB.

Practical Note

The table should not automatically become BJB's final CBS inventory.

Each proposed service should undergo formal validation involving:

• Business Owners;
• Operations;
• Technology;
• Operational Risk;
• Business Continuity;
• Cyber Security;
• Compliance;
• Legal;
• Third-Party Risk Management; and
• Crisis Management.

Senior management should approve the final CBS catalogue and establish clear ownership for each service.

Illustrative End-to-End CBS Structure

The purpose of identifying CBS becomes clearer when you decompose a service into its supporting components.

For example:

CBS-3 Securities Trading and Order Execution

Operational resilience concerns whether this whole chain can withstand disruption sufficiently to preserve the required service outcome.

A highly resilient order-management application alone does not make CBS-3 resilient if telecommunications, authentication, market connectivity, personnel or execution counterparties remain single points of failure.

From CBS Identification to Dependency Mapping

Identification of CBS is only the first stage.

Once the services have been approved, BJB should identify their end-to-end interconnections and interdependencies across:

The resulting dependency map should enable BJB to identify:

• single points of failure;
• common dependencies across multiple CBS;
• technology concentration;
• third-party concentration;
• geographic concentration;
• key-person dependencies;
• data dependencies;
• cross-border dependencies;
• manual workaround limitations; and
• dependencies whose recovery capabilities are inconsistent with the CBS recovery requirement.

This approach directly supports MAS expectations concerning end-to-end dependency mapping.

Example Severe but Plausible Scenarios Affecting BJB CBS

CBS identification should also underpin scenario testing.

The BNM 2025 Operational Resilience Discussion Paper is a useful comparative regional reference because it emphasises that isolated failure testing may be insufficient.

It defines operational resilience as the ability of critical operations or services to withstand disruption within acceptable and tolerable levels under severe but plausible scenarios, and highlights the need to challenge assumptions and consider multi-layered failures.

For BJB, relevant scenarios could include:

These scenarios should not merely test whether systems can technically recover. They should determine whether the CBS can continue or recover at an acceptable service level under stress.

The BNM discussion paper similarly highlights cyber incidents, technology failures, third-party outages, compromised data, power outages, cloud dependencies and shared infrastructure as sources of potentially widespread disruption.

Regulatory Alignment with MAS

For BJB's Singapore operations, the principal regulatory reference for the CBS approach should be the MAS Guidelines on Business Continuity Management, rather than the BNM Operational Resilience Discussion Paper.

MAS places explicit emphasis on Critical Business Services and Functions, Service Recovery Time Objectives, dependency mapping, concentration risk, testing, audit, incident and crisis management, and Board and senior-management responsibilities. 

Identification of Critical Business Services

MAS expects financial institutions to prioritise services by criticality and consider the consequences of service unavailability for the institution's safety and soundness, its customers, and other financial institutions dependent on the service. 

For BJB, the CBS identification methodology should therefore document why each selected service satisfies these criteria.

Service Recovery Time Objective

Once BJB identifies a CBS, it should establish an appropriate Service Recovery Time Objective (SRTO).

The SRTO establishes the target period for restoring a specific business service to a level sufficient to meet business obligations.

This creates an important hierarchy:

The recovery capabilities of underlying dependencies should therefore support, rather than contradict, the service-level recovery objective.

Dependency Mapping

BJB should map the people, processes, technology, information, facilities and external dependencies required for each CBS.

The mapping should extend across organisational and geographical boundaries where necessary.

For example:

The objective is to understand the complete delivery chain and identify vulnerabilities that could prevent recovery of the CBS within its SRTO.

Third-Party Dependencies

MAS recognises that third-party arrangements supporting CBS can increase operational risk. Financial institutions should therefore adopt risk-appropriate measures commensurate with the provider's criticality and its impact on the CBS.

For BJB, this should include consideration of:

• contractual recovery obligations;
• recovery capability;
• alternative providers;
• data portability;
• exit arrangements;
• concentration risks;
• subcontractor dependencies;
• geographic dependencies; and
• participation of critical providers in resilience testing where appropriate.

Testing

Testing should demonstrate more than the existence of recovery documentation.

BJB should obtain evidence that the combined people, processes, systems, facilities and third-party arrangements can recover the CBS within the required service outcome.

The programme should progressively move from component testing toward integrated and end-to-end service testing.

A practical BJB approach could therefore be represented as:

This approach enables BJB to meet its Singapore-focused regulatory expectations while also developing operational resilience capabilities consistent with the broader international direction of travel.

Proposed CBS Governance Structure

Each approved CBS should have a clearly designated owner accountable for its resilience.

An illustrative structure is:

The CBS Owner should maintain an end-to-end perspective rather than assuming that resilience is exclusively the responsibility of Technology, BCM or Operational Risk.

For each CBS, management should be able to answer five fundamental questions:

• What critical outcome are we protecting?
• Who could be harmed if the service fails?
• How quickly must the service be recovered?
• What internal and external dependencies are required to deliver it?
• Have we demonstrated through testing that the service can withstand severe disruption?
  

CBS Register — Recommended Minimum Information

Once BJB has validated its CBS catalogue, record each service in a controlled CBS Register.

The register should contain, at minimum:

Identifying Critical Business Services shifts resilience planning at Bank Julius Baer from recovering individual organisational components to protecting the end-to-end services that matter most to clients, the bank, and the wider financial ecosystem.

For BJB, services such as client account and portfolio access, payments, securities execution, clearing and settlement, custody, investment advisory, discretionary portfolio management, foreign-exchange transactions and critical client communications provide a practical starting point for determining where the most significant disruption impacts could arise.

The final CBS inventory should, however, be based on a structured assessment rather than an assumption.

BJB should validate each candidate service against potential customer harm, safety and soundness, dependencies on and from other financial institutions, time criticality, transaction characteristics, regulatory significance and the complexity of its cross-border delivery model.

Once approved, the CBS catalogue becomes the foundation for the subsequent stages of operational resilience implementation:

In this way, BJB can move beyond asking whether individual systems or departments can recover and instead address the more important operational resilience question:

Can Bank Julius Baer continue delivering its most critical services to its clients when a severe disruption actually occurs?

Blogs marked [x] are under construction

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, offer in-depth insights and practical toolkits to embed this model effectively.