![[OR] [CIMB] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/11714c89-3f47-430e-82af-f61521f1677c.png)
CBS-1 Retail & Digital Banking Access
Introduction
![[OR] [GEN] [E3] [CBS] [ITo] Establish Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/cec876b4-afd8-426f-b4c7-9a1db88709cc.png)
For CIMB Bank, CBS-1: Retail & Digital Banking Access represents a customer-facing critical business service that directly affects financial access, payments, onboarding, and digital engagement.
In line with operational resilience principles and expectations set out in the 2025 Bank Negara Malaysia (BNM) Discussion Paper on Operational Resilience, impact tolerances must define the maximum level of disruption the bank is willing to tolerate before causing intolerable harm to customers, market integrity, or regulatory compliance.
Establishing measurable thresholds — such as Maximum Tolerable Downtime (MTD) and Maximum Tolerable Data Loss (MTDL) — ensures CIMB can prioritise recovery strategies, technology investments, and scenario testing. The tolerances below reflect regulatory expectations for availability, integrity, confidentiality, and financial stability while remaining realistic and testable.
![Banner [Table] [OR] [E3] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/627c33a8-714d-40af-9a2b-0d7957fb8afa.png)
Table P4: Establish Impact Tolerance for CBS-1
|
Sub-CBS Code |
Sub-CBS |
Maximum Tolerable Downtime (MTD) |
Maximum Tolerable Data Loss (MTDL) |
Customer Impact |
Regulatory Impact |
Impact Type |
Current Resilience Status |
Action Required |
|
1.1 |
Online Banking Login & Authentication |
2 hours |
0 minutes |
High – Customers unable to access accounts |
Moderate – Access control & audit trail obligations |
Availability & Security |
Strong but capacity-sensitive |
Enhance MFA redundancy, geo-distributed authentication servers |
|
1.2 |
Account Dashboard & Balance Inquiry |
4 hours |
0 minutes |
High – Inability to view balances affects decision-making |
Moderate – Data accuracy expectations |
Availability & Integrity |
Moderate |
Strengthen database replication & real-time monitoring |
|
1.3 |
Funds Transfer & Payment Services |
1 hour |
0 minutes |
Very High – Financial loss, reputational damage |
High – Payment system compliance & reporting |
Availability & Integrity |
Moderate |
Strengthen payment engine failover, alternate routing & liquidity buffers |
|
1.4 |
Mobile App Transaction Processing |
2 hours |
0 minutes |
High – App users are unable to transact |
Moderate – Consumer protection obligations |
Availability |
Moderate |
Improve auto-scaling infrastructure & DDoS protection |
|
1.5 |
Retail Digital Onboarding |
6 hours |
0 minutes |
Medium – New customers are unable to open accounts |
High – KYC/AML regulatory compliance |
Availability & Compliance |
Moderate |
Maintain backup e-KYC providers, offline fallback workflows |
|
1.6 |
Digital Alerts & Notification Services |
8 hours |
0 minutes |
Medium – Customers are unaware of transactions |
Moderate – Regulatory alert obligations |
Availability |
Moderate |
Implement multi-channel redundancy & telecom failover |
|
1.7 |
Customer Support & Chatbot Interface |
12 hours |
0 minutes |
Medium – Delayed issue resolution |
Low to Moderate – Complaint handling standards |
Availability |
Moderate |
Expand call centre surge capacity & chatbot failover |
|
1.8 |
API Gateway & Third-Party Integrations |
2 hours |
0 minutes |
High – Partner services disrupted |
Moderate – Outsourcing & ICT risk management obligations |
Availability & Operational Dependency |
Moderate |
Implement API clustering, enhanced SLA oversight |
|
1.9 |
Access Monitoring & Security Event Logging |
24 hours (monitoring visibility) |
1 hour |
Low immediate customer impact but high risk exposure |
High – Regulatory breach reporting & cybersecurity obligations |
Integrity & Security |
Moderate |
Deploy redundant SIEM, immutable offsite logging |
|
1.10 |
Back-End Data Synchronisation & Recovery |
4 hours |
15 minutes |
High Risk of data inconsistency or prolonged outage |
High – Regulatory reporting & data retention obligations |
Availability & Integrity |
Moderate |
Increase replication frequency, conduct regular DR simulation tests |
![Banner [Summing] [OR] [E3] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5.png)
By establishing defined impact tolerances for CBS-1: Retail & Digital Banking Access, CIMB Bank demonstrates alignment with regulatory expectations and international best practices in operational resilience. The tolerances differentiate between customer harm thresholds, regulatory exposure, and financial system stability considerations, ensuring proportional recovery priorities.
Regular review, scenario testing, and validation against severe but plausible disruptions are essential to confirm that these tolerances remain appropriate. As digital banking dependency increases, maintaining strong availability, zero data loss for transactional services, and robust cyber monitoring will remain critical. Clearly defined impact tolerances, therefore, serve not only as compliance tools but also as strategic resilience benchmarks that safeguard customer trust and institutional stability.
![[OR] [CIMB] [E3] [CBS] [1] [DP] Detailed Business Processes](https://no-cache.hubspot.com/cta/default/3893111/eb7e4e69-774d-449b-b39c-eec011428302.png)
![[OR] [GEN] [E3] [CBS] [MD] Map Dependency](https://no-cache.hubspot.com/cta/default/3893111/ef1fb41d-072d-440a-9bfc-d5e9dbcaaac3.png)
![[OR] [GEN] [E3] [CBS] [MPR] Map Processes and Resources](https://no-cache.hubspot.com/cta/default/3893111/d4d428de-883c-4ab5-b7e0-951cd44d67fe.png)
![[OR] [GEN] [E3] [CBS] [SuPS] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f9916566-5d6d-4024-b675-61dd130a5e59.png)
![[OR] [GEN] [E3] [CBS] [ST] Perform Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/079d4de8-89ce-4c0b-a192-7a5793aec4f0.png)
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
More Information About OR-5000 [OR-5] or OR-300 [OR-3]
Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.
![[BL-OR] [3-4-5] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)
![[BL-OR] [3] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)
![Email to Sales Team [BCM Institute]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)
