[OR] [CIMB] [E3] [CBS] [2] [ITo] Establish Impact Tolerances

 CBS-2 Payment & Fund Transfer Services

Introduction

In the context of operational resilience, impact tolerance is the maximum level of disruption a business service can withstand without causing intolerable harm to customers, the institution, or the financial system.

This concept goes beyond traditional recovery time objectives (RTO) to encompass broader customer and regulatory impacts, including compliance with AML/CFT, payment system obligations, and systemic stability.

For CIMB Bank, CBS‑2: Payment & Fund Transfer Services is a core service that supports transactions for retail, corporate, and institutional customers.

 In designing impact tolerances for this service and its sub‑components, CIMB must consider both internal priorities and regulatory expectations emerging from frameworks such as the 2025 Bank Negara Malaysia discussion paper on operational resilience, which emphasises embedding operational resilience across people, processes, systems, and third‑party dependencies.

Purpose of the Chapter

 This chapter defines impact tolerance criteria for each Sub‑CBS within CBS‑2, articulating quantitative and qualitative thresholds that reflect both customer and regulatory impact considerations.

This enables a defensible resilience strategy that aligns with international best practices and emerging Malaysian regulatory expectations. 

Establishing measurable thresholds — such as Maximum Tolerable Downtime (MTD) and Maximum Tolerable Data Loss (MTDL) — ensures CIMB can prioritise recovery strategies, technology investments, and scenario testing.

The tolerances below reflect regulatory expectations for availability, integrity, confidentiality, and financial stability while remaining realistic and testable.

Table P4: Establish Impact Tolerance for CBS-2

Key Notes on Impact Tolerance Setting

• Quantitative and Qualitative Measures
  

  
  Impact tolerances are expressed primarily in time (MTD) and data loss (MTDL), but also consider the severity of customer and regulatory harms, reflecting a broader operational resilience lens. (PwC)

• Customer Impact
  

  
  Defines how disruptions directly affect customers (e.g., inability to initiate transfers, notification delays). This informs where strict tolerances are needed to protect customer experience and trust.

• Regulatory Impact
  

  
  Payment services are subject to regulatory expectations (e.g., settlement timing, AML/CFT compliance). Prolonged outages or compliance lapses may trigger reporting requirements or sanctions—making resilience in these areas a priority.

• Impact Types
  

  
  Service availability, processing delays, control failures, and detection latency are distinct impacts that require different mitigation strategies.

• Current Resilience and Actions
  

  
  A self‑assessment of the current resilience posture guides the further actions needed to meet tolerances effectively (e.g., failover architecture, automation, analytics).

Defining and implementing impact tolerances for CIMB Bank’s Payment & Fund Transfer Services enables the bank to clarify thresholds for acceptable disruption, align internal capabilities with regulatory expectations, and maintain stakeholder trust during service interruptions.

The tolerance settings above are intended to balance customer expectations, regulatory requirements, and operational realities, providing structured guidance on where investment and process strengthening are most needed.

Articulating these tolerances also drives scenario testing, governance oversight, and resilience planning, all of which are essential under frameworks emphasised by regulators such as Bank Negara Malaysia, which is increasingly moving towards impact‑based regulatory expectations in operational resilience discussions. 

In practice, these tolerances should be periodically reviewed through stress testing and scenario exercises to ensure they remain aligned with evolving threats, technology changes, and regulatory developments.

Operational Resilience in Practice: The CIMB Bank Approach
eBook 3: Starting Your OR Implementation
CBS-2 Payment & Fund Transfer Services
CBS-2 DP	CBS-2 MD	CBS-2 MPR	CBS-2 ITo	CBS-2 SuPS	CBS-2 ST

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.