[OR] [CBC] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Critical Business Services of Chinabank for Operational Resilience

Introduction

 Operational resilience begins with identifying the services that must continue, or be restored within an acceptable period, because disruption would cause unacceptable harm to customers, threaten the bank’s safety and soundness, or affect the wider financial system.

BCM Institute defines a Critical Business Service (CBS) as a service provided to clients which, if disrupted, could cause intolerable harm to clients or pose a risk to the stability or orderly operation of the financial system.

 Note that for global delivery of BCM Institute's OR training, CBS is used synonymously with Critical Operations and Important Business Services. 

China Banking Corporation (Chinabank) is a long-established Philippine universal bank that provides a broad range of banking and financial services through its branch network, ATMs, digital channels, and subsidiaries. Its public materials describe services spanning deposit products, loans and trade finance, domestic and foreign fund transfers, treasury products, trust products, foreign exchange, corporate finance, and other investment banking services. Chinabank also highlights its nationwide branch footprint, ATMs, My CBC App, and Chinabank Online, all of which indicate that service continuity must be managed across physical, digital, operational, and third-party dependencies.

In operational resilience, a Critical Business Service (CBS) is a service provided to clients which, if disrupted, could either cause intolerable harm to customers or pose a risk to the soundness, stability, or resilience of the financial system. BCM Institute further notes that identification should be done through an end-to-end service lens, supported by stakeholder input, dependency analysis, and documentation of service descriptions, inputs, outputs, risks, recovery requirements, and regulatory requirements.

For Philippine banks, BSP Circular No. 1203 requires BSP-supervised financial institutions to identify critical operations, set tolerance for disruption, map interconnections and interdependencies, manage risks to delivery, and test the ability to deliver critical operations under severe but plausible scenarios. The Circular also states that identified critical operations should drive later steps such as tolerance-setting and dependency mapping, and that the Board should approve the identified critical operations.

Against that backdrop, the most appropriate CBS candidates for Chinabank are the services that are customer-facing, transaction-heavy, systemically relevant, and most likely to cause significant customer harm or regulatory concern if disrupted.

What is a ‘Critical Business Service’?

A service should generally be classified as critical when prolonged disruption would likely:

• materially harm retail or corporate customers,
• impair access to money, deposits, payments, or credit,
• disrupt market or liquidity activities,
• create contagion across interconnected institutions or payment systems, or
• threaten regulatory compliance and the bank’s safe and sound operation.

In practice, a bank should distinguish between:

• business services delivered to customers or the market,
• underpinning services such as IT, facilities, and third parties, and
• internal activities that support delivery but are not themselves the CBS presented to the regulator.

Understanding Critical Business Services (CBS)

Critical Business Service is a service whose disruption would cause material harm to customers, financial stability, or the institution itself.

Regulators require institutions to identify these services, define tolerance for disruption, and ensure they can continue during severe but plausible scenarios.

Critical Business Services (Critical Operations) for BDO Unibank

The following CBS are a reasoned chapter-level proposal based on BDO’s published products, channels, and business model.

They are not an official BDO-issued CBS inventory, but they are suitable starting points for an operational resilience program.

The above CBS set is grounded in Chinabank’s disclosed business model and product set, including deposits, loans, trade finance, fund transfers, treasury, trust, FX, cash management, remittance, digital banking, and online corporate services.

How Chinabank Should Determine Which Services Are Truly “Critical”

Not every banking product should automatically be classified as a CBS. Under the operational resilience approach, Chinabank should prioritise services whose disruption would create one or more of the following outcomes: immediate customer harm, inability to access money, failure of high-volume or high-value transactions, breach of regulatory obligations, disruption to market or interbank activity, or material impact on the bank’s safety and soundness. This approach is consistent with BCM Institute’s definition of CBS and BSP’s focus on critical operations.

For Chinabank, the first wave of CBS identification would likely begin with deposit-taking, payments/fund transfers, digital banking access, and cash management/corporate transaction services, because these are highly visible to customers, transaction-intensive, and closely tied to financial access and economic activity. BCM Institute’s banking examples expressly include cash transactions, lending, deposit-taking, treasury, private banking and wealth management, investment banking, corporate finance, and trade services.

Regulatory Requirements from BSP Circular No. 1203 Relevant to Chinabank’s CBS Identification

1. Board-approved identification of critical operations

The Circular states that the Board should approve the identified critical operations and that the identification should be proportionate to the nature, scale, and complexity of the bank’s business. For Chinabank, this means CBS identification cannot be a purely operational exercise; it must be formally governed and reviewed at the Board level.

Example for Chinabank:

The Board may approve Deposit and Account Services, Payments and Funds Transfer, and Digital Banking as the first three enterprise-level CBS because they affect the largest population of customers and could create immediate harm if disrupted.

2. Set tolerance for disruption

BSP requires banks to set a tolerance for disruption for each identified critical operation. The Circular says this should include, at minimum, a time-based metric and may also include other metrics such as the maximum number of customers affected or the volume and value of affected transactions.

Example for Chinabank:

For CBS-2 Payments, Funds Transfer, and Cash Access Services, Chinabank may define a maximum tolerable outage period for retail transfers, a threshold for failed ATM withdrawals, and a ceiling for the number or value of unsettled customer transactions before escalation and recovery measures are triggered.

3. Map interconnections and interdependencies

The Circular makes clear that identified critical operations should drive mapping of interconnections and interdependencies. The self-assessment annex also asks whether the BSFI has identified the personnel responsible for mapping, whether interconnections and interdependencies have been mapped, and what resources support the mapping.

Example for Chinabank:

For CBS-3 Digital Banking and Online Channel Services, Chinabank would map dependencies across core banking systems, identity and authentication controls, telecom networks, cloud or hosting infrastructure, mobile app support, cybersecurity monitoring, customer contact channels, and third-party payment rails.

4. Assess public infrastructure and third-party dependencies

BSP specifically requires assessment of dependencies on public infrastructure such as telecommunications, transportation, and energy, and also requires third-party arrangements supporting critical operations to include continuity or exit provisions. It further expects banks to identify substitute arrangements or bring services back in-house where feasible.

Example for Chinabank:

For CBS-4 Corporate Cash Management and Collections/Disbursements, Chinabank should assess dependencies on telecom links, data centres, power supply, payment gateways, government collection interfaces, and outsourced service providers supporting receivables, payables, payroll, or settlement workflows.

5. Integrate BCM and test severe but plausible scenarios

The Circular requires BCM to be integrated into the operational resilience framework and requires periodic business continuity exercises covering identified critical operations, their interconnections, and key dependencies using a range of severe but plausible scenarios. The examples in the Circular include pandemics, natural calamities, failure of key service providers, and major cyber incidents.

Example for Chinabank:

Chinabank should test whether CBS-1 Deposit and Account Services and CBS-3 Digital Banking can continue within tolerance during a ransomware event, prolonged telecom outage, branch/facility denial, core banking degradation, or a failure of a critical external payment or connectivity provider.

Recommended Chinabank CBS Prioritisation Approach

A practical sequencing for Chinabank would be:

• Tier 1 CBS: Deposit and Account Services; Payments, Funds Transfer, and Cash Access; Digital Banking and Online Channel Services.

• Tier 2 CBS: Corporate Cash Management; Trade Finance and Settlement; Remittance and Branch-Based Transaction Services.

• Tier 3 CBS: Lending and Credit Servicing; Treasury/FX/Financial Markets; Trust/Wealth/Investment Management.

This prioritisation is an inference based on the likely scale of customer harm, transaction dependency, and systemic relevance of Chinabank’s publicly disclosed services, rather than a statement from Chinabank itself. It follows BSP’s and BCM Institute’s logic of focusing first on services whose disruption would create the most serious customer and market consequences.

For Chinabank, Critical Business Services should be defined not by internal department boundaries, but by the services delivered to customers and the wider market that must continue, or be restored quickly, during disruption.

Based on Chinabank’s public service portfolio and the BSP operational resilience framework, the strongest CBS candidates are deposit and account services, payments and fund transfers, digital banking, corporate cash management, trade services, lending and credit servicing, treasury and FX, remittance, and selected trust and investment services.

BSP Circular No. 1203 gives Chinabank a clear regulatory path: identify and Board-approve critical operations, set disruption tolerances, map dependencies, assess vulnerabilities, including third-party and public infrastructure exposure, and test resilience through severe but plausible scenarios.

A Chinabank CBS inventory built on these principles would provide the foundation for the next stages of operational resilience implementation.

Blogs marked [x] are under construction. 

eBook 1: Understanding Your Organisation: BDO Unibank
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

 

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.