[OR] [DBP] [E1] [C5] Identifying Critical Business Services

CBS Code

Proposed Critical Business Service

Why It Is Critical

Likely Customers / Stakeholders Affected

Relevant BSP OR Requirement

Examples of Intolerable Harm if Disrupted

1

Deposit and Account Services

DBP offers current, savings, and term deposit products. Customers depend on these accounts to hold funds, access balances, and maintain banking relationships.

Retail customers, pensioners, payroll account holders, SMEs, institutional depositors

Identify critical operations; set tolerance for disruption; maintain service continuity through BCM and recovery arrangements.

Customers cannot access balances, deposits cannot be credited properly, account servicing halts, and confidence in the bank is undermined.

2

Payments, Fund Transfers, and Cash Access

DBP supports ATM withdrawals, fund transfers, bill payments, and PESONet-linked transfer capabilities. Disruption would immediately affect customers’ ability to move or access funds.

Individuals, corporates, government-related users, beneficiaries, counterpart banks

Tolerance for disruption must include time-based and other quantitative/qualitative measures, such as the number of customers or transactions affected.

Customers cannot withdraw cash, transfer funds, pay bills, or settle urgent obligations; transaction backlogs and reputational harm escalate quickly.

3

Remittance and Electronic Funds Delivery Services

DBP provides branch-based and electronic remittance through partners and correspondent bank arrangements, including EC Remit for overseas Filipinos. This is critical where funds support households and time-sensitive obligations.

OFWs, families/beneficiaries, remittance partners, correspondent banks

Mapping of interdependencies and third-party resilience is required, especially where external partners support service delivery.

Delayed family support, failed remittance credits, customer distress, cross-border settlement problems, increased complaints, and loss of trust.

4

Digital Banking and Electronic Banking Access

DBP offers DBP EC Banking, DBP Digital Banking Portal, online banking, e-government payment access, and related digital channels. These channels are essential for continuous service delivery when branches are inaccessible.

Retail customers, corporates, institutional clients, public-sector users

Banks should adopt risk-based strategies for their IT environment and test their ability to maintain critical operations under severe but plausible disruption scenarios.

Customers are locked out of banking channels, payments fail, digital onboarding or servicing stops, and cyber incidents may create wide-scale service unavailability.

5

Development Lending and Loan Servicing

DBP’s primary mandate is development financing, particularly for agriculture, industry, infrastructure, MSMEs, health, utilities, and community development. The lending pipeline and post-disbursement servicing are central to DBP’s public mandate.

Borrowers, project sponsors, SMEs, public-interest sectors, communities, government stakeholders

Critical operations should reflect the institution’s business model and the services whose disruption could materially affect customers or the wider economy.

Delays in financing drawdowns, inability to service loans, disruption to development projects, and broader economic and social impact in funded sectors.

6

Corporate, Trade, and Institutional Transaction Banking Services

DBP offers trade products, corporate/institutional banking, and related electronic channels. These services support working capital, trade flows, and institutional liquidity management.

Corporate clients, government-linked entities, institutional customers, importers/exporters

Banks must map interconnections and resources supporting critical operations and identify vulnerabilities in those dependencies.

Trade transactions stall, corporate payments are delayed, documentary processing fails, and clients may face contractual, liquidity, or supply-chain impact.

Regulatory expectation

What DBP should do for each CBS

Example for DBP

Identify critical operations

Confirm which services would cause customer harm or systemic impact if disrupted

Payments, remittance, digital banking, deposits, and development lending are likely candidates

Set tolerance for disruption

Define maximum acceptable outage, transaction backlog, customer impact, and data-loss thresholds

Example: PESONet/fund transfer service may require much shorter tolerance than a non-urgent back-office reporting process

Map interconnections and interdependencies

Identify people, processes, technology, data, facilities, and third parties that support each CBS

ATM switch, core banking, digital channels, telecoms, branch operations, SWIFT/correspondent banks, remittance partners

Assess third-party resilience

Ensure contracts and contingency plans address disruption, substitution, or exit

Remittance partners, telecom providers, cloud/hosting vendors, payment processors

Determine severe but plausible scenarios

Use realistic scenarios relevant to DBP’s risk profile

Cyberattack on digital banking, prolonged telecom outage, data centre failure, branch/facility denial, remittance partner outage

Integrate BCM and testing

Align BIA, recovery strategies, incident response, crisis communication, and periodic exercises with each CBS

Test whether deposit access, payments, and digital banking can stay within tolerance during a ransomware or network outage

Board and management oversight

Have the Board approve criteria, and senior management drive remediation and investment priorities

Board-approved CBS list, tolerance levels, and remediation roadmap

CBS

Severe but plausible scenario

Expected resilience question

Deposit and Account Services

Core banking outage during payroll crediting

Can DBP restore balance inquiry, posting, and branch servicing within tolerance?

Payments, Fund Transfers, and Cash Access

ATM switch or network failure on a peak business day

Can customers still withdraw cash or reroute essential payments?

Remittance Services

Failure of the remittance partner or the correspondent bank channel

Can DBP switch to alternate channels without intolerable delay to beneficiaries?

Digital Banking and Electronic Banking

Ransomware or authentication platform disruption

Can customers still access critical transactions safely while cyber containment is underway?

Development Lending and Loan Servicing

System outage affecting loan drawdown and repayment processing

Can DBP continue high-priority disbursements and customer servicing for critical development projects?

Trade and Institutional Banking

Disruption of trade processing or corporate portal

Can DBP maintain priority institutional transactions and documentary processing within the agreed tolerance?