The Bank of the Philippine Islands (BPI) is a Philippine universal bank headquartered in Makati.
BPI states that it serves both retail and corporate clients and provides consumer banking and lending, asset management, payments, insurance, securities brokerage and distribution, foreign exchange, leasing, and corporate and investment banking.
Because of that breadth, BPI’s operational resilience program should focus on the end-to-end services whose disruption would cause intolerable harm to customers or create wider financial-stability concerns.
That is consistent with the BCM Institute’s explanation that a Critical Business Service (CBS) is a service which, if disrupted, could cause intolerable harm to clients or threaten the soundness and resilience of the financial system.
For Philippine banks, BSP Circular No. 1203 frames this in terms of critical operations. In practice, this chapter uses Critical Business Services (CBS) as the service-oriented equivalent for identifying the business outcomes BPI must continue to deliver through disruption.
The Circular requires BSFIs to identify critical operations, set a tolerance for disruption for each one, map interconnections and interdependencies, and test resilience under severe but plausible scenarios. The board is primarily responsible for oversight and approval of the operational resilience framework.
The purpose of identifying CBS is not to create a long inventory of everything the bank does. Instead, it is to determine which services must remain within acceptable disruption limits because failure to do so would materially harm customers, impair confidence, or affect the banking ecosystem.
BSP Circular No. 1203 requires BSFIs to identify critical operations, set tolerance for disruption, determine severe but plausible scenarios, map interconnections and interdependencies, and integrate business continuity and testing into the operational resilience framework.
|
CBS Code |
Critical Business Service |
Why It Should Be Treated as Critical |
|
CBS-1 |
Deposit and Account Services |
Core retail and corporate banking service covering account opening, deposit-taking, balances, statements, and access to funds. Disruption can immediately affect customers’ ability to hold and use money safely. |
|
CBS-2 |
Payments, Funds Transfer, and Cash Access Services |
Includes intra-bank and interbank transfers, bill payments, card-based payments support, ATM/CAM usage, and other payment execution services. Disruption can affect a large volume of customers and payment-system flows. |
|
CBS-3 |
Digital Banking and Customer Channel Access |
Covers mobile banking, online banking, authentication, alerts, and self-service customer access. For a modern universal bank, prolonged digital-channel failure can materially disrupt service delivery and customer access. |
|
CBS-4 |
Lending and Credit Servicing |
Includes loan origination support, drawdowns, repayments, collections, and loan account servicing for consumer, SME, and corporate customers. Disruption can affect both customers’ financing needs and the bank’s asset quality management. |
|
CBS-5 |
Card and Merchant Services |
Includes debit/credit card authorization support, card servicing, merchant acceptance enablement, dispute handling, and settlement-related customer service. Failure can create immediate customer and merchant harm. |
|
CBS-6 |
Treasury, Foreign Exchange, and Liquidity-Related Client Services |
Includes client FX execution, treasury-related customer transactions, and liquidity-sensitive market services. These services can be critical because disruption may affect market obligations, corporate customers, and confidence in financial intermediation. |
|
CBS-7 |
Corporate Cash Management and Transaction Banking |
Includes cash management, collections, disbursements, payroll-related transaction services, and business payment support for corporate/institutional clients. These are often essential to business continuity for customers and to broader economic activity. |
|
CBS-8 |
Wealth, Investment, and Securities Distribution Services |
BPI publicly lists asset management and securities brokerage/distribution among its services. For relevant customer segments, disruption can affect access to investments, instructions, and portfolio servicing. |
|
CBS-9 |
Remittance and Overseas Filipino Banking Support |
BPI notes international banking subsidiaries and partnerships supporting overseas Filipinos. Remittance-linked and cross-border customer services can become critical where customers depend on timely funds movement and account access. |
|
CBS-10 |
Customer Service, Incident Communication, and Complaint Resolution |
While often seen as an enabling capability, customer support becomes critical during disruption because it supports service continuity, customer instructions, crisis communications, and harm reduction. |
BPI’s own overview supports this CBS structure. It publicly describes itself as a universal bank serving retail and corporate clients, with services spanning consumer banking and lending, asset management, payments, insurance, securities brokerage and distribution, foreign exchange, leasing, and corporate and investment banking. It also highlights a nationwide branch and ATM/CAM footprint and international presence that supports overseas Filipinos. These characteristics justify a CBS inventory that goes beyond traditional deposits and payments to include digital access, lending, cash management, treasury/FX, and investment-related client services. (Bank of the Philippine Islands)
For each proposed CBS above, BPI’s operational resilience program should apply the following BSP requirements:
|
Regulatory Requirement |
What BSP Circular No. 1203 Requires |
Example for BPI |
|
Identify critical operations / services |
The bank should identify the critical operations that are proportionate to its size, nature, and complexity. These drive the later steps of tolerance-setting and dependency mapping. |
BPI identifies “Payments, Funds Transfer, and Cash Access” and “Deposit and Account Services” as top-tier CBS because disruption would affect large customer volumes immediately. |
|
Board oversight and framework approval |
The board is primarily responsible for oversight and approval of the operational resilience framework, while senior management implements it and reports on resilience capability. |
BPI’s board approves the CBS inventory, tolerance-setting methodology, and prioritised investment for resilience uplift. |
|
Set tolerance for disruption |
Each critical operation should have a clearly defined tolerance for disruption, including at minimum a time-based metric; other metrics may include number of customers or transaction value/volume affected. |
For digital banking, BPI may set maximum outage duration, maximum affected user threshold, and maximum transaction backlog before customer harm becomes intolerable. |
|
Map interconnections and interdependencies |
The Circular expects mapping of activities, interconnections, interdependencies, key roles, and resources supporting critical operations. |
For payments, BPI maps branches, mobile app, core banking, switch/network connectivity, settlement arrangements, telecoms, power, fraud controls, and third parties. |
|
Manage third-party dependencies |
Due diligence is required for service providers supporting critical operations; arrangements must support the bank’s tolerance for disruption and include continuity or exit provisions. |
BPI assesses whether key vendors for payments, digital channels, cloud/hosting, or telecom support can meet service continuity expectations and substitution plans. |
|
Assess public infrastructure and cyber/ICT resilience |
Dependencies on telecoms, transport, and energy should be assessed; technology and security controls must support confidentiality, integrity, and availability through disruption. |
BPI evaluates the resilience impact of telco outages, data-center issues, cyberattacks, and authentication failures on mobile and online banking CBS. |
|
Integrate BCM into operational resilience |
BCM and the BCP should be integrated into the resilience framework, including business impact analysis, recovery strategies, incident response, communications, and crisis management. |
BPI aligns each CBS with BIA outputs, recovery playbooks, invocation triggers, succession of authority, and customer communications protocols. |
|
Test under severe but plausible scenarios |
The bank should periodically test critical operations using severe but plausible scenarios tailored to its operating environment. |
BPI tests scenarios such as ransomware, major telco outage, critical vendor failure, severe typhoon, payment-system disruption, or simultaneous multi-channel outage. |
The Circular’s self-assessment guide points to scenarios such as the “Big One,” severe typhoon, critical third-party failure, payment and settlement disturbances, and widespread cyberattack/ransomware. For BPI, these can be translated into service-based resilience tests such as: a nationwide mobile and internet banking outage during payday; prolonged failure of a payments gateway affecting fund transfers; branch and ATM disruption following a typhoon in a key metro area; or ransomware affecting customer servicing and transaction processing. These are exactly the kinds of tests needed to validate whether a CBS can stay within its disruption tolerance.
In a practical implementation sequence, BPI should first prioritize the CBS that combine the highest customer harm, systemic sensitivity, and transaction dependency.
On that basis, the likely first-wave CBS are: Deposit and Account Services, Payments, Funds Transfer, and Cash Access, Digital Banking and Customer Channel Access, and Corporate Cash Management and Transaction Banking.
These are the services most directly tied to continuous customer access to funds, day-to-day commerce, and confidence in the banking system. The second wave would usually include Lending and Credit Servicing, Card and Merchant Services, Treasury/FX client services, and selected wealth/investment services, depending on BPI’s internal materiality assessment.
For BPI, identifying Critical Business Services should not begin with departments or systems alone; it should begin with the services that customers and the financial system most rely on.
Based on BPI’s published business profile and BSP Circular No. 1203, the most relevant CBS categories are deposits and accounts, payments and transfers, digital banking access, lending and credit servicing, card and merchant services, treasury/FX-related services, corporate cash management, wealth and securities servicing, remittance-related support, and customer service during disruption.
These CBS then become the foundation for the rest of the operational resilience program: setting disruption tolerance, mapping dependencies, identifying vulnerabilities, testing severe but plausible scenarios, and strengthening recovery capability.
In other words, the quality of BPI’s CBS identification will determine how effectively its operational resilience program protects customers, supports regulatory compliance, and sustains confidence in the Philippine financial system.
Blogs marked [x] are under construction.
|
Operational Resilience in Action: The BPI Transformation Blueprint |
|||
| eBook 1: Understanding Your Organisation: Bank of the Philippine Islands (BPI) | |||
| C1 | C2 [x] | C3 [x] | C4 [x] |
| |
|||
| C5 | C6 [x] | C7 [x] | C8 [x] |
| |
|
|
|
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|