[OR] [BPI] [E3] [CBS] [1] [MPR] Map Processes and Resources

Written by Moh Heng Goh | Apr 16, 2026 11:39:28 AM

CBS-1 Deposit & Account Services

Introduction

Mapping processes and resources is a foundational requirement in operational resilience, as emphasised in the BSP Circular No. 1203. Financial institutions are required to identify and document the end-to-end processes, along with supporting resources and dependencies, that enable the delivery of critical business services (CBS).

For BPI, CBS-1 Deposit and Account Services represents a core service that supports financial inclusion, liquidity management, and daily banking operations. Disruptions to this CBS can have immediate and widespread impacts on customers, market confidence, and regulatory compliance.

This chapter maps each Sub-CBS to its supporting processes, people, technology, third parties, and dependencies, ensuring a comprehensive understanding of operational resilience vulnerabilities and interconnections.

Purpose of the Chapter

The purpose of this chapter is to provide a structured, regulatory-aligned mapping of the processes and resources that support CBS-1.

It enables the reader to:

Identify critical operational components required to deliver deposit services
Understand interdependencies across business units, systems, and external parties
Support impact tolerance setting, scenario testing, and recovery planning
Align with regulatory expectations under BSP Circular No. 1203 for end-to-end service mapping and dependency visibility

Table P3: Map Processes and Resources for CBS-1

Sub-CBS Code	Sub-CBS	Processes	People	Technology (Applications & Infrastructure)	Third-Party Vendors	Upstream / Downstream Dependencies
1.1	Customer Onboarding and Account Application	Customer data capture, application submission, document collection	Branch staff, Relationship Managers, Customer Service Officers	CRM systems, onboarding platforms, and document management systems	eKYC vendors, ID verification providers	Upstream: Customer acquisition channels; Downstream: KYC/CDD
1.2	Customer Identification and Verification (KYC/CDD)	Identity verification, sanctions screening, risk profiling	Compliance officers, KYC analysts	AML systems, sanctions screening tools, and biometric verification systems	Credit bureaus, government ID databases	Upstream: Onboarding; Downstream: Account approval
1.3	Account Approval and Opening	Approval workflows, account creation, and account number generation	Operations team, Compliance approvers	Core banking system (CBS), workflow engines	None / minimal	Upstream: KYC; Downstream: Funding
1.4	Initial Funding and Deposit Booking	Cash/transfer deposit processing, ledger posting	Tellers, Operations staff	Core banking system, payment gateways	Payment networks (e.g., interbank systems)	Upstream: Account opening; Downstream: Transactions processing
1.5	Product Terms Setup and Account Parameter Maintenance	Interest setup, account configuration, limits setting	Product managers, Operations	Product configuration systems, CBS	None	Upstream: Account opening; Downstream: Interest processing
1.6	Deposit Transactions Processing	Credit transactions, transfers, batch processing	Operations team, IT support	Core banking system, payment engines, middleware	Clearing houses, payment networks	Upstream: Funding; Downstream: Reconciliation
1.7	Withdrawal and Funds Access Processing	ATM withdrawals, branch withdrawals, fund transfers	Tellers, ATM support teams	ATM systems, card management systems, CBS	ATM networks, card schemes (Visa/Mastercard)	Upstream: Account balance; Downstream: Fraud monitoring
1.8	Account Servicing and Customer Maintenance	Customer updates, account modifications, inquiries	Customer service, Call centre staff	CRM systems, customer portals	Call centre outsourcing vendors	Upstream: Customer records; Downstream: Reporting
1.9	Interest, Fees, and Charges Processing	Interest calculation, fee deduction, periodic postings	Finance team, Operations	Interest calculation engines, CBS	None	Upstream: Product setup; Downstream: Reporting
1.10	Statement, Passbook, and Balance Reporting	Statement generation, balance inquiry, passbook updates	Operations, Customer service	Reporting systems, digital banking platforms	Print vendors, email/SMS providers	Upstream: Transactions; Downstream: Customer communication
1.11	Digital Account Access and Channel Integration	Online/mobile banking access, authentication	IT teams, Digital banking teams	Mobile apps, internet banking platforms, IAM systems	Cloud providers, fintech partners	Upstream: Core banking; Downstream: Fraud monitoring
1.12	Reconciliation and Exception Management	Transaction matching, discrepancy resolution	Finance, Operations	Reconciliation tools, data warehouses	None	Upstream: Transactions; Downstream: Regulatory reporting
1.13	Fraud Detection and Transaction Monitoring	Fraud monitoring, alerts, and case management	Fraud analysts, Risk teams	Fraud management systems, AI/analytics tools	Fraud detection service providers	Upstream: Transactions; Downstream: Compliance reporting
1.14	Regulatory Reporting and Compliance Monitoring	Regulatory submissions, audit reporting	Compliance officers, Risk management	Regulatory reporting systems, data aggregation tools	Regulators’ reporting platforms	Upstream: Reconciliation; Downstream: Supervisory review
1.15	Incident Response, Business Continuity, and Recovery	DR activation, crisis management, service restoration	BCM team, IT DR teams, Crisis management team	DR sites, backup systems, and incident management tools	DR site providers, telecom providers	Upstream: All CBS components; Downstream: Service restoration

Regulatory Alignment and Operational Resilience Considerations

Under BSP Circular No. 1203, BPI is expected to:

1. End-to-End Mapping of Resources

Banks must identify people, processes, technology, facilities, and third parties supporting each CBS
Example: Mapping ATM withdrawal services includes ATM infrastructure, telecom providers, and card networks

2. Identification of Critical Dependencies

Highlight single points of failure and concentration risks
Example: Reliance on a single cloud provider or payment switch for digital banking services

3. Third-Party Risk Management

Ensure critical vendors are subject to due diligence, monitoring, and contingency planning
Example: Outsourced KYC verification providers must meet resilience and data protection standards

4. Support for Impact Tolerance and Scenario Testing

Mapping outputs must feed into:

Impact tolerance setting (e.g., maximum downtime for deposit services)
Severe but plausible scenarios (e.g., cyberattack on core banking system)

5. Business Continuity Integration

Banks must demonstrate recovery capabilities across mapped dependencies
Example: Failover to DR site for core banking within defined recovery time objectives (RTO)

The mapping of processes and resources for CBS-1 Deposit and Account Services provides BPI with a comprehensive, end-to-end view of how critical services are delivered and sustained.

By identifying the intricate relationships between people, processes, technology, and third parties, the bank can better anticipate vulnerabilities and manage disruptions effectively.

Aligned with BSP Circular No. 1203, this structured mapping forms the backbone of operational resilience by enabling:

Clear visibility of dependencies and interconnections
Informed impact tolerance setting and scenario testing
Robust business continuity and recovery planning

Ultimately, this chapter equips BPI with the necessary foundation to ensure that deposit and account services remain resilient, reliable, and continuously available, even under severe but plausible disruption scenarios.


eBook 3: Starting Your OR Implementation
CBS-1 Deposit & Account Services
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.



	If you have any questions, click to contact us.

View full post