---
title: [OR] [CIMB] [E3] [CBS] [2] [ITo] Establish Impact Tolerances
description: [OR] [CIMB] [E3] [CBS] [2] [ITo] Establish Impact Tolerances
image: https://blog.bcm-institute.org/hubfs/CIMB%20Graphic%20Folder/CIMB%20CBS%202%20Morepost/%5BOR%5D%20%5BCIMB%5D%20%5BE3%5D%20%5BCBS%5D%20%5B2%5D%20%5BITo%5D%20Payment%20%26%20Fund%20Transfer%20Services.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience in Practice: The CIMB Bank Approach
# \[OR\] \[CIMB\] \[E3\] \[CBS\] \[2\] \[ITo\] Establish Impact Tolerances
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/e6bf3389-adf3-47b2-b35a-90bf5de0996b)
In the context of operational resilience, **impact tolerance** is the maximum level of disruption a business service can withstand without causing intolerable harm to customers, the institution, or the financial system.
This concept goes beyond traditional recovery time objectives (RTO) to encompass broader customer and regulatory impacts, including compliance with AML/CFT, payment system obligations, and systemic stability.
For **CIMB Bank**, *CBS‑2: Payment & Fund Transfer Services* is a core service that supports transactions for retail, corporate, and institutional customers.
In designing impact tolerances for this service and its sub‑components, CIMB must consider both internal priorities and regulatory expectations emerging from frameworks such as the **2025 Bank Negara Malaysia discussion paper on operational resilience**, which emphasises embedding operational resilience across people, processes, systems, and third‑party dependencies.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0430108a-ef49-43aa-ac7d-ee6bb474eba8)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng) Mar 13, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
###### [![\[OR\] \[CIMB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/11714c89-3f47-430e-82af-f61521f1677c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/11714c89-3f47-430e-82af-f61521f1677c)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0430108a-ef49-43aa-ac7d-ee6bb474eba8)
### CBS-2 Payment & Fund Transfer Services
#### Introduction
[![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[2\] \[ITo\] Establish Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/fc279add-ed55-46f4-8b83-676b1a9699fe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fc279add-ed55-46f4-8b83-676b1a9699fe)
In the context of operational resilience, **impact tolerance** is the maximum level of disruption a business service can withstand without causing intolerable harm to customers, the institution, or the financial system.
This concept goes beyond traditional recovery time objectives (RTO) to encompass broader customer and regulatory impacts, including compliance with AML/CFT, payment system obligations, and systemic stability.
For **CIMB Bank**, *CBS‑2: Payment & Fund Transfer Services* is a core service that supports transactions for retail, corporate, and institutional customers.
In designing impact tolerances for this service and its sub‑components, CIMB must consider both internal priorities and regulatory expectations emerging from frameworks such as the **2025 Bank Negara Malaysia discussion paper on operational resilience**, which emphasises embedding operational resilience across people, processes, systems, and third‑party dependencies.
#### **Purpose of the Chapter**
This chapter defines impact tolerance criteria for each Sub‑CBS within CBS‑2, articulating quantitative and qualitative thresholds that reflect both customer and regulatory impact considerations.
This enables a defensible resilience strategy that aligns with international best practices and emerging Malaysian regulatory expectations.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/bbca4643-69de-4387-b2fe-f7e363f08101)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/9598c70d-42e4-4fa5-8837-526f2c5dc74b)Establishing measurable thresholds — such as Maximum Tolerable Downtime (MTD) and Maximum Tolerable Data Loss (MTDL) — ensures CIMB can prioritise recovery strategies, technology investments, and scenario testing.
The tolerances below reflect regulatory expectations for availability, integrity, confidentiality, and financial stability while remaining realistic and testable.
#### **[![Banner \[Table\] \[OR\] \[E3\] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/627c33a8-714d-40af-9a2b-0d7957fb8afa.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/627c33a8-714d-40af-9a2b-0d7957fb8afa)**
###### Table P4: Establish Impact Tolerance for CBS-2
| Sub‑CBS Code | Sub‑CBS | MTD (hrs) | MTDL | Customer Impact | Regulatory Impact | Impact Type | Current Resilience Status | Action Required |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 2.1 | Customer-Initiated Transfers | 2 | ≤ 1 hr data loss | High — inability to initiate payments causes immediate customer harm (funds movement delayed) | Medium — service interruption reporting, payment obligations | Service Availability | Redundant systems in place; some batch dependencies | Strengthen parallel processing & active standby |
| 2.2 | Internal Processing & Routing | 4 | ≤ 1 hr data loss | Medium — internal delays affect downstream settlement timing | High — requires timely routing to clearing/settlement interfaces | Processing Delay | Resilience testing is conducted quarterly | Increase real‑time monitoring & fallback logic |
| 2.3 | Clearing & Settlement Interface | 2 | ≤ 30 min | High — failed clearing delays settlement, affecting liquidity | High regulatory settlement timing requirements | System Outage | Tested with key counterparties | Implement additional settlement windows & contingency queues |
| 2.4 | Foreign & Cross‑Border Payments | 6 | ≤ 1 hr | High — cross‑border latency impacts corporates & forex | Medium — compliance with TFS/AML | External Dependency | Multiple FX corridors available | Strengthen third‑party SLAs, increase real‑time reconciliation |
| 2.5 | Payment & Transfer Compliance Controls | 8 | ≤ 30 min | High — compliance break can lead to regulatory sanctions | Very High — AML/CFT, sanctions screening, regulatory reporting | Control Failure | Automated control systems; periodic model updates | Enhance machine‑learning detection, tighter change governance |
| 2.6 | Notification & Status Reporting | 3 | ≤ 2 hrs | Medium — customers lack transaction status feedback | Low | Availability & Accuracy | Real‑time push notifications | Align to guaranteed queue persistence & resend logic |
| 2.7 | Exception Handling & Remediation | 12 | ≤ 4 hrs | Medium — slower handling may erode trust | Medium — delayed exception reporting | Operational Backlog | Exceptions routed to central case management | Increase automated remediation & SLA policing |
| 2.8 | Settlement & Reconciliation Accounting | 4 | ≤ 1 hr | Medium — accounting discrepancies affect financial accuracy | High — accounting/reporting obligations | Financial Accuracy | Daily reconciliation; some real‑time checking | Expand real‑time reconciliation coverage |
| 2.9 | Service & Channel Monitoring | 1 | N/A | High — early detection prevents escalations | High — regulator expects proactive monitoring | Detection Latency | Central monitoring platform | Extend predictive analytics & cross‑channel correlation |
| 2.10 | Customer Support & Dispute Resolution | 24 | N/A | High customer trust and dispute turnaround | Medium — required responsiveness | Service Responsiveness | 24×7 support available | Implement omni‑channel escalation pathways |
#### **Key Notes on Impact Tolerance Setting**
- ##### **Quantitative and Qualitative Measures**
Impact tolerances are expressed primarily in time (MTD) and data loss (MTDL), but also consider the severity of customer and regulatory harms, reflecting a broader operational resilience lens. ([PwC](https://www.pwc.com/my/en/publications/2026/operational-resilience-for-financial-institutions.html?utm_source=chatgpt.com))
- ##### **Customer Impact**
Defines how disruptions directly affect customers (e.g., inability to initiate transfers, notification delays). This informs where strict tolerances are needed to protect customer experience and trust.
- ##### **Regulatory Impact**
Payment services are subject to regulatory expectations (e.g., settlement timing, AML/CFT compliance). Prolonged outages or compliance lapses may trigger reporting requirements or sanctions—making resilience in these areas a priority.
- ##### **Impact Types**
Service availability, processing delays, control failures, and detection latency are distinct impacts that require different mitigation strategies.
- ##### **Current Resilience and Actions**
A self‑assessment of the current resilience posture guides the further actions needed to meet tolerances effectively (e.g., failover architecture, automation, analytics).
#### [![Banner \[Summing\] \[OR\] \[E3\] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5)
Defining and implementing impact tolerances for CIMB Bank’s *Payment & Fund Transfer Services* enables the bank to **clarify thresholds for acceptable disruption**, align internal capabilities with regulatory expectations, and maintain stakeholder trust during service interruptions.
The tolerance settings above are intended to balance **customer expectations, regulatory requirements, and operational realities**, providing structured guidance on where investment and process strengthening are most needed.
Articulating these tolerances also drives **scenario testing, governance oversight, and resilience planning**, all of which are essential under frameworks emphasised by regulators such as Bank Negara Malaysia, which is increasingly moving towards impact‑based regulatory expectations in operational resilience discussions.
In practice, these tolerances should be periodically reviewed through stress testing and scenario exercises to ensure they remain aligned with evolving threats, technology changes, and regulatory developments.
| Operational Resilience in Practice: The CIMB Bank Approach | | | | | |
| --- | --- | --- | --- | --- | --- |
| **eBook 3: Starting Your OR Implementation** | | | | | |
| **CBS-2 Payment & Fund Transfer Services** | | | | | |
| **CBS-2 DP** | **CBS-2 MD** | **CBS-2 MPR** | **CBS-2 ITo** | **CBS-2 SuPS** | **CBS-2 ST** |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c1183ef6-0c74-415a-9c50-ee038421db83) | [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[2\] \[MD\] Map Dependency](https://no-cache.hubspot.com/cta/default/3893111/a3bfca68-b9a5-4e5d-867a-5c6195959943.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a3bfca68-b9a5-4e5d-867a-5c6195959943) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/b5f5f1a8-74a6-41a3-88c6-d38f18c6c1ed) | [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[2\] \[ITo\] Establish Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/fc279add-ed55-46f4-8b83-676b1a9699fe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/fc279add-ed55-46f4-8b83-676b1a9699fe) | [![\[OR\] \[CIMB\] \[E3\] \[CBS\] \[2\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/adaf7a37-0038-4d26-879d-a6b9c47c79d5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/adaf7a37-0038-4d26-879d-a6b9c47c79d5) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/5d2f4433-8420-4537-8156-cf016981e0b1) |
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)**
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the \[OR-3\] OR-300 Operational Resilience Implementer course and the \[OR-5\] OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Your Comments Here:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng"
},
"dateModified" : "2026-04-07T11:04:41.314Z",
"datePublished" : "2026-03-13T08:14:06.000Z",
"headline" : "[OR] [CIMB] [E3] [CBS] [2] [ITo] Establish Impact Tolerances",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-cimb-e3-cbs-2-ito-establish-impact-tolerances",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```