[OR] [CCB] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Critical Business Services of China Construction Bank's Operational Resilience Program

Introduction

This chapter examines the identification of Critical Business Services (CBS) for China Construction Bank (Malaysia) within the context of implementing an operational resilience programme aligned with   expectations from Bank Negara Malaysia (BNM).  

As financial institutions operate in an increasingly complex environment marked by cyber threats, technology dependencies, third-party concentration risks and geopolitical uncertainties, regulators are shifting focus from merely recovering systems to ensuring that critical services remain within acceptable impact tolerances during severe but plausible disruptions.

Understanding what constitutes a CBS is therefore foundational to building a structured, regulator-ready operational resilience framework.

The objective of this chapter is to enable the reader to (1) understand the rationale for identifying CBS as the anchor of operational resilience, (2) recognise which services at CCB Malaysia would likely qualify as critical based on customer harm, market impact and systemic risk considerations, and (3) appreciate how CBS identification supports regulatory compliance, governance oversight, scenario testing and impact tolerance setting.

By the end of the chapter, the reader should be able to align CBS identification with BNM’s evolving operational resilience expectations and integrate it into enterprise-wide resilience planning.

What is a ‘Critical Business Service’?

A Critical Business Service (CBS) is a service that, if disrupted beyond an acceptable tolerance threshold, could materially harm customers, markets, or the economy.

Operational resilience frameworks position CBS as the core output that must remain available through disruptions, including cyber incidents, technology outages, or physical events.

The key purpose of identifying CBS is to focus resilience efforts on those services whose failure would have the greatest operational, financial, reputational or systemic impact.

In practice, CBS includes services that:

• Support essential customer-facing transactions,
• Enable settlement and clearing mechanisms,
• Perform risk management and liquidity functions,
• Provide access to funds or credit that customers depend upon.

Identification of CBS is foundational to operational resilience because it determines recovery priorities, impact tolerances, and end-to-end operational mapping of people, processes, technology and third parties.

Critical Business Services at China Construction Bank

As a licensed banking institution in Malaysia, CCB Malaysia’s critical services can be grouped by customer segment and risk impact. These CBS examples are drawn from typical financial services offerings evident from CCB Malaysia’s service descriptions and general banking operations:

Core Transaction and Payments Services

These services are primary to daily financial activity and include:

• Account Inquiry and Transaction Processing — access to account balances, statement generation, and posting of debits/credits.
• Payments and Transfers — interbank and intrabank transfer functions, including real-time payments and batch transfers.
• Bill Payment Platforms (e.g., JomPAY) — bill fulfilment channels that customers depend on for utilities and services.

A disruption here directly affects customers’ ability to manage funds and meet financial obligations.

Cash and Liquidity Management Services

• Cash Management, Liquidity and Reporting Services provided to corporate clients — ensure clients’ working capital, funds flow visibility and liquidity optimisation, which are integral to corporate operations.

If impaired, liquidity stress could propagate through client cash flow and systemic liquidity channels.

Lending and Credit Services

• Corporate and Trade Finance — financing for capital projects, trade instruments (letters of credit, documentary collections), and advisory services.
• Loan Origination and Servicing — from processing applications to disbursement and repayment monitoring.

Failure would materially impact credit access, project financing and overall credit risk management.

Foreign Exchange and Cross-Border Financial Services

• Foreign Exchange Transactions — execution and settlement for FX trades, hedging, and global payments.

Disruption could lead to settlement failures, currency risk, and loss of confidence in cross-border operations.

Digital & Internet Banking Platforms

• Internet and Mobile Banking Access — providing customers with always-on access to online services and transaction capabilities.

Given the centrality of digital channels to customer experience, any prolonged outage here would have significant reputational and financial impacts.

Operational Resilience Regulatory Expectations (Malaysia)

Bank Negara Malaysia (BNM) Discussion Paper on Operational Resilience

In late 2025, BNM issued a Discussion Paper titled "Strengthening Operational Resilience for Financial Institutions." The paper emphasises that:

• Institutions must identify their CBS, set acceptable impact tolerances, and map the interconnections of people, processes, technology and third parties that support them.
• Resilience should encompass not only internal capability but also third-party dependencies, reflecting real ecosystem risk.
• The ability to “prevent, respond, recover from and adapt to disruptive events” is essential to maintain trust and financial stability.

Although a full standalone operational resilience framework has not yet been formalised in Malaysia, BNM’s evolving stance reinforces key elements,  including:

• Robust governance and risk management aligned to CBS identification.
• Scenario testing to validate readiness to maintain services through stress events.
• Coverage of technology, cyber, outsourcing and business continuity processes.

Existing Relevant BNM Policies

Operational resilience expectations build on existing frameworks,  including:

• Risk Management in Technology (RMiT): requiring resilient and secure IT systems and recovery planning.
• Business Continuity Management (BCM) Guidelines: focusing on continuity of critical functions and crisis preparedness.
• Outsourcing Policy: ensuring third-party arrangements support resilience and recovery criteria.

These policies, although not exclusively labelled as “operational resilience,” embody many resilience principles that support CBS continuity.

Operational Resilience Implementation Implications

For CCB Malaysia, embedding operational resilience into CBS requires:

• Formal CBS Identification and Documentation — defining CBS, impact tolerances and supporting infrastructure maps.
• Integration with BCM and Technology Risk Management — aligning business continuity, crisis escalation, and technology recovery planning around CBS priorities.
• Scenario-based Stress Testing & Third-Party Oversight — validating that CBS continue within defined thresholds under severe, plausible events.
• Governance and Reporting Mechanisms — Board and senior management oversight of resilience performance and regulatory reporting.

Taken together, these efforts ensure that the bank’s most critical services remain accessible, secure, and recoverable, reinforcing customer confidence and systemic stability in line with both global operational resilience principles and evolving regulatory expectations in Malaysia.

Critical Business Services (CBS) of China Construction Bank (Malaysia)

The following table presents the proposed CBS for CCB Malaysia, aligned to customer impact, financial stability considerations and regulatory expectations.

These CBS should be further validated through customer impact analysis, revenue dependency assessment, substitutability analysis and systemic risk review in accordance with BNM’s operational resilience discussion principles.

Identifying Critical Business Services is not merely a classification exercise—it is a strategic decision that determines where resilience investment, governance oversight and testing efforts must be concentrated.

For China Construction Bank (Malaysia), the services identified in this chapter represent those whose prolonged disruption would result in material customer harm, market instability or regulatory breach.

By clearly defining these CBS, the Bank establishes the foundation for setting impact tolerances, mapping dependencies across people, process, technology, and third parties, and conducting severe but plausible scenario testing in line with BNM’s expectations.

Ultimately, operational resilience is achieved when these critical services can continue within defined thresholds despite disruption.

The discipline of CBS identification ensures that resilience is outcome-focused rather than system-focused, enabling CCB Malaysia to safeguard customer trust, maintain regulatory confidence and contribute to the stability of Malaysia’s financial system.

Blogs marked [x] are under construction.

For organisations looking to   accelerate their journey, BCM Institute’s training and including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.