eBook OR

[OR] [CCB] [E3] [CBS] [1] [MPR] Map Processes and Resources

Written by Moh Heng Goh | Mar 12, 2026 2:48:09 AM

 CBS-1 Core Deposit & Account Services

Introduction

CBS-1 Core Deposit & Account Services form a foundational critical business service of China Construction Bank (Malaysia) Berhad, enabling customers to open accounts, maintain deposits, execute transactions, and access funds securely.

In accordance with operational resilience principles, mapping processes and resources provides end-to-end visibility of how this service is delivered, including the people, technology, facilities, and third parties required to sustain operations within defined impact tolerances.

This mapping supports:

  • Identification of single points of failure
  • Assessment of concentration risks
  • Scenario testing (e.g., system outage, third-party failure, cyberattack, liquidity stress)
  • Recovery planning and business continuity alignment
  • Regulatory compliance with Bank Negara Malaysia (BNM) expectations

The table below maps each Sub-CBS to its supporting processes and resources.

Table P3: Detailed Processes for CBS-1

Sub-CBF Code

Sub-CBS

Processes

People

Technology (Applications & Infrastructure)

Third-Party Vendors

Upstream / Downstream Dependencies

1.1

Account Opening & Onboarding

Customer identification (KYC/CDD/EDD); Sanctions screening; Risk profiling; Account approval workflow; Data capture & validation

Relationship Managers; Branch Officers; Compliance Officers; AML Analysts; Operations Support

Core Banking System (CBS); eKYC platform; AML/Sanctions Screening System; Document Management System; CRM; Identity & Access Management (IAM); Branch network infrastructure

Credit Bureau (CTOS/CCRIS); Sanctions list providers; National ID verification vendors; IT system vendors

Upstream: Customer application; Regulatory requirements; Identity verification databases. Downstream: Account creation in CBS; Deposit transaction processing (1.3); Payment services (1.6)

1.2

Deposit Maintenance & Account Administration

Customer data updates; Mandate/signatory changes; Limit setting; Account status management; Dual-control authorization

Branch Operations Staff; Customer Service; Back Office Operations; Compliance Review Team

CBS customer master module; CRM; IAM; Data center servers; Backup systems; Network infrastructure

Regulatory reporting service providers; IT infrastructure vendors

Upstream: Account onboarding (1.1). Downstream: Transaction processing (1.3); Statement generation (1.5); Regulatory reporting

1.3

Deposit Transactions Processing

Cash deposit/withdrawal; Internal fund transfers; Clearing & settlement; Reconciliation; Cut-off management

Tellers; Operations Processing Team; Treasury Back Office; Reconciliation Team

Core Banking Transaction Engine; Payment Gateway; ATM/CDM switch; Online & Mobile Banking platforms; Batch processing engine; Data center; DR site

PayNet (DuitNow); RENTAS (BNM); ATM network operators; Card scheme providers

Upstream: Account maintenance (1.2); Liquidity availability (Treasury). Downstream: GL posting (1.4); Statement services (1.5); Payment execution (1.6)

1.4

Interest & Charges Calculation & Posting

Interest rate configuration; Fee assessment; End-of-Day (EOD) batch processing; GL reconciliation; Financial reporting

Finance Department; Product Management; System Support Team; Internal Audit

Interest calculation module in CBS; Batch processing engine; General Ledger system; Financial reporting system; Data storage & backup infrastructure

External auditors; Financial reporting software vendors

Upstream: Deposit balances (1.3); Product configuration. Downstream: Financial reporting; Customer statements (1.5); Regulatory submissions

1.5

Account Inquiry & Statement Services

Balance inquiry; Transaction history retrieval; Statement generation; Secure data distribution; PDPA compliance controls

Contact Centre Officers; Branch CSOs; IT Support; Data Protection Officer

Online Banking; Mobile Banking App; CRM; Statement generation system; Secure email/SMS gateway; Print servers; Cybersecurity tools

SMS/Email gateway providers; Printing & mail vendors; Cloud hosting providers (if applicable)

Upstream: Transaction records (1.3); Interest posting (1.4). Downstream: Customer notification; Complaint handling; Regulatory audit requests

1.6

Transfer & Payment Execution

Payment initiation; Authorization workflow; Fraud monitoring; Transaction screening; SWIFT/RENTAS processing; Settlement reconciliation

Payment Operations Team; Treasury; Fraud Monitoring Team; Compliance; IT Support

Payment Hub; SWIFT interface; RENTAS interface; Fraud Monitoring System; AML screening engine; Network connectivity; Encryption infrastructure

SWIFT Network; PayNet (DuitNow); Correspondent banks; Cybersecurity vendors

Upstream: Account balance validation (1.3); AML screening (1.1). Downstream: External settlement networks; Customer notification; Liquidity management

1.7

Foreign Currency Deposit Services

FX rate setting; Multi-currency account management; Daily revaluation; FX settlement; Regulatory reporting

Treasury Desk; FX Operations Team; Finance; Risk Management

Treasury Management System (TMS); Core Banking FX module; Real-time FX rate feed; SWIFT interface; Data center & DR infrastructure

FX rate providers (Reuters/Bloomberg), Correspondent banks, SWIFT, Custodian banks

Upstream: Global FX market data; Liquidity lines. Downstream: Payment execution (1.6); Financial reporting (1.4); Regulatory compliance

1.8

Account Closure & Dormancy Management

Dormancy monitoring; Customer notification; AML re-screening; Account closure approval; Unclaimed monies transfer; Record retention

Branch Operations; Compliance Team; Legal; Finance; Records Management

CBS dormancy module; Regulatory reporting system; Document archival system; Backup storage; Secure destruction controls

Registrar of Unclaimed Monies (Malaysia); Regulatory portals; Archival storage vendors

Upstream: Account inactivity data (1.3). Downstream: Regulatory reporting; Financial reconciliation; Customer reactivation processes

 

The mapping of processes and resources for CBS-1 Core Deposit & Account Services demonstrates that the service relies on a complex ecosystem of operational processes, skilled personnel, critical banking applications, infrastructure resilience, and interconnected third-party networks. The Core Banking System, payment interfaces (RENTAS, SWIFT, DuitNow), FX data feeds, and regulatory reporting platforms represent high-criticality technology dependencies. Likewise, compliance, treasury, operations, and fraud monitoring teams form essential human control layers supporting service integrity.

By mapping these elements end-to-end, China Construction Bank (Malaysia) Berhad can:

  • Identify potential single points of failure
  • Evaluate concentration risks (e.g., reliance on payment networks or FX data providers)
  • Design scenario testing (cyberattack, system outage, third-party disruption, liquidity shock)
  • Establish realistic impact tolerances
  • Strengthen recovery time objectives (RTO) and service restoration strategies
    • KYC provider failure
    • Fraud system malfunction
    • Data breach incident

Facilitating Impact Tolerance Validation
Assesses:

    • Maximum tolerable downtime for login access
    • Acceptable delay in onboarding
    • Maximum disruption to fraud detection

Enabling Remediation Planning
Supports decisions on:

    • Redundancy improvements
    • Vendor diversification
    • Backup authentication methods
    • Enhanced monitoring controls

 

Building a Resilient Banking Institution: Operational Resilience Implementation at China Construction Bank (Malaysia)

 

 

 

 

eBook 3: Starting Your OR Implementation
       
CBS-1 Core Deposit & Account Services        
CBS-1 DP CBS-1 MD CBS-1 MPR CBS-1 ITo CBS-1 SuPS  CBS-1 ST  eBook 2        
     

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

If you have any questions, click to contact us.