---
title: [OR] [CCB] [E3] [CBS] [2] [SuPS] Identify Severe but Plausible Scenarios
description: [OR] [CCB] [E3] [CBS] [2] [SuPS] Identify Severe but Plausible Scenarios
image: https://blog.bcm-institute.org/hubfs/eBook%20Generic%20Morepost/OR/OR%20GEN%20E3%20Morepost/%5BOR%5D%20%5BGEN%5D%20%5BE3%5D%20%5BCBS%5D%20%5BSuPS%5D%20Identify%20Severe%20but%20Plausible%20Scenarios.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Building a Resilient Banking Institution: Operational Resilience Implementation at China Construction Bank (Malaysia)
# \[OR\] \[CCB\] \[E3\] \[CBS\] \[2\] \[SuPS\] Identify Severe but Plausible Scenarios
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/94e06422-4ab9-4bfe-94bd-545de5200261)
Under the principles of operational resilience, identifying Severe but Plausible Scenarios (SBPS) ensures that critical business services remain within defined impact tolerances even under extreme stress conditions.
For CBS-2 Payments & Funds Transfer Services, disruptions may arise from cyber incidents, infrastructure failures, third-party outages, fraud events, or regulatory interventions. Given the systemic importance of payment services to customers, counterparties, and the financial ecosystem, scenario testing must reflect high-impact yet realistic threat conditions.
For China Construction Bank (Malaysia) Berhad, the identification of SBPS for each Sub-CBS (2.1–2.7) supports proactive resilience planning, integration of ICT and cyber risk management, and regulatory compliance.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Mar 12, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![\[OR\] \[CCB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/6b0c36e9-6fb9-4705-a42a-089010976426.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6b0c36e9-6fb9-4705-a42a-089010976426)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
### CBS-2 Payments & Funds Transfer Services
#### Introduction
[![\[OR\] \[CCB\] \[E3\] \[CBS\] \[2\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/c4c51f50-d65e-4de5-ae0f-84eef5617733.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c4c51f50-d65e-4de5-ae0f-84eef5617733)
Under the principles of operational resilience, identifying *Severe but Plausible Scenarios (SBPS)* ensures that critical business services remain within defined impact tolerances even under extreme stress conditions.
For **CBS-2 Payments & Funds Transfer Services**, disruptions may arise from cyber incidents, infrastructure failures, third-party outages, fraud events, or regulatory interventions. Given the systemic importance of payment services to customers, counterparties, and the financial ecosystem, scenario testing must reflect high-impact yet realistic threat conditions.
For China Construction Bank (Malaysia) Berhad, the identification of SBPS for each Sub-CBS (2.1–2.7) supports proactive resilience planning, integration of ICT and cyber risk management, and regulatory compliance.
The table below outlines recommended severe but plausible scenarios, their impact, evidence of proactive risk management, and explicit linkages to cyber and ICT risk integration.
[![Banner \[Table\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86)
###### Table P5: Detailed Processes for CBS-2
| Sub-CBS Code | Sub-CBS | Severe but Plausible Scenario | Impact / Effect | Proactive Risk Management Action | Link to Integration of Cyber and ICT Risks |
| --- | --- | --- | --- | --- | --- |
| 2.1 | Account-to-Account Transfers | Core banking system outage due to data centre power failure | Inability to process internal transfers; customer dissatisfaction; liquidity strain | Active-active data centre setup; periodic failover testing; backup power redundancy | ICT resilience (data centre redundancy), infrastructure monitoring, BCP testing |
| 2.2 | Real-Time & Instructional Payments | Ransomware attack affecting a real-time payment gateway | Immediate disruption of instant payments; reputational damage; regulatory reporting | Network segmentation; EDR deployment; immutable backups; cyber incident response drills | Cyber security integration (SOC monitoring, ransomware playbooks, threat intelligence) |
| 2.3 | Bill Payment & Provider Settlement | Third-party biller platform compromise or API failure | Failed bill settlements; delayed provider remittance; customer complaints | Vendor risk assessment; API monitoring; fallback batch processing | Third-party ICT risk management; secure API gateway; vendor cyber due diligence |
| 2.4 | Cross-Border Remittances | SWIFT connectivity disruption due to a cyber intrusion | Cross-border payments halted; sanctions compliance risk; FX exposure | SWIFT CSP compliance; alternative correspondent routing; sanctions screening redundancy | Integration of SWIFT cyber controls, encryption, and secure network architecture |
| 2.5 | Batch & Bulk Payments | File upload corruption from malware in a corporate client environment | Large-scale payroll/payment rejection; operational backlog | File integrity validation; malware scanning; maker-checker controls; customer awareness programme | Secure file transfer protocols (SFTP), endpoint security integration, and cyber hygiene |
| 2.6 | Corporate e-Banking Payments Interface | Distributed Denial-of-Service (DDoS) attack on the corporate banking portal | Corporate clients unable to initiate payments; liquidity and market impact | DDoS mitigation service; traffic filtering; capacity scaling; penetration testing | Cyber resilience (DDoS protection, web application firewall, real-time monitoring) |
| 2.7 | QR Payment & Digital Channels | Mobile banking app compromise due to a zero-day vulnerability | Fraudulent transactions; mass service suspension; reputational loss | Secure SDLC; vulnerability scanning; multi-factor authentication; fraud analytics | Integration of application security, mobile security controls, threat detection & response |
[![Banner \[Summing\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/446ccb83-e056-40d0-aae5-834d73c13f43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/446ccb83-e056-40d0-aae5-834d73c13f43)
Identifying severe but plausible scenarios for CBS-2 Payments & Funds Transfer Services enables China Construction Bank (Malaysia) Berhad to rigorously test whether its payment operations can remain within defined impact tolerances during extreme disruptions.
By embedding cyber and ICT risk integration into each scenario, the Bank ensures that operational resilience is not limited to traditional business continuity planning but extends to digital, third-party, and systemic risk exposures.
Through proactive risk management actions such as redundancy, cyber defence enhancement, vendor oversight, and continuous scenario testing, the Bank strengthens its ability to prevent, adapt, respond, and recover from major disruptions. This structured scenario identification framework enhances regulatory compliance, protects customers, and sustains trust in critical payment infrastructure.
| Building a Resilient Banking Institution: Operational Resilience Implementation at China Construction Bank (Malaysia) | | | | | | | | | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| **eBook 3: Starting Your OR Implementation** | | | | | | | | | | |
| **CBS-2 Payments & Funds Transfer Services** | | | | | | | | | | |
| **CBS-2 DP** | **CBS-2 MD** | **CBS-2 MPR** | **CBS-2 ITo** | **CBS-2 SuPS** | ** CBS-2 ST ** | **eBook 2** | | | | |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/21e83d5a-5a06-41a6-b8af-a2401034af49) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[2\] \[MD\] Map Dependency](https://no-cache.hubspot.com/cta/default/3893111/da942e74-1023-4795-be5b-7fdd6a6f7cc9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/da942e74-1023-4795-be5b-7fdd6a6f7cc9) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[2\] \[MPR\] Map Processes and Resources](https://no-cache.hubspot.com/cta/default/3893111/a106c656-951f-4914-a7d4-112942258094.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a106c656-951f-4914-a7d4-112942258094) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[2\] \[ITo\] Establish Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/4185dac6-4c22-44da-befc-5de4fddc02b4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/4185dac6-4c22-44da-befc-5de4fddc02b4) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[2\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/c4c51f50-d65e-4de5-ae0f-84eef5617733.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c4c51f50-d65e-4de5-ae0f-84eef5617733) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[2\] \[ST\] Perform Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/a77d4c6b-6562-4930-a6d7-0540c23377ec.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a77d4c6b-6562-4930-a6d7-0540c23377ec) | [![eBook Cover \[OR\] \[CCB\] \[E2\] \[2D\]](https://no-cache.hubspot.com/cta/default/3893111/9b21eac0-621d-41c1-a95b-81665c719a89.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9b21eac0-621d-41c1-a95b-81665c719a89) | | | | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0fd66f64-f7a8-4c65-a54b-9c56982c138c) |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-03-12T04:26:50.592Z",
"datePublished" : "2026-03-12T04:26:46.000Z",
"headline" : "[OR] [CCB] [E3] [CBS] [2] [SuPS] Identify Severe but Plausible Scenarios",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-ccb-e3-cbs-2-sups-identify-severe-but-plausible-scenarios",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```