A Critical Business Service (CBS) is a service delivered by an organisation, or by another party on its behalf, to clients or the market, where disruption could cause intolerable harm to customers or threaten the stability, soundness, or orderly functioning of the financial system.
In operational resilience, the focus is therefore not simply on internal functions, but on the external services that must continue, or be restored within an acceptable timeframe, during disruption.
For the Development Bank of the Philippines (DBP), the identification of CBS should reflect both its role as a development financial institution and its ability, under its charter, to perform functions of a thrift bank.
DBP publicly presents itself as a development bank serving agricultural and industrial enterprises, while also offering deposit products, ATM and fund transfer services, remittance services, development lending, digital banking, trade, treasury, and trust-related offerings.
Third-party arrangements affecting critical operations must also specify how services will be maintained during disruption or how substitutes/exits will be managed.
The table below sets out a practical set of proposed CBS for DBP.
These are examples of operational resilience planning and should be validated by DBP through formal impact assessment, customer harm analysis, transaction significance analysis, regulatory expectations, and dependency mapping.
|
CBS Code |
Proposed Critical Business Service |
Why It Is Critical |
Likely Customers / Stakeholders Affected |
Relevant BSP OR Requirement |
Examples of Intolerable Harm if Disrupted |
|
1 |
Deposit and Account Services |
DBP offers current, savings, and term deposit products. Customers depend on these accounts to hold funds, access balances, and maintain banking relationships. |
Retail customers, pensioners, payroll account holders, SMEs, institutional depositors |
Identify critical operations; set tolerance for disruption; maintain service continuity through BCM and recovery arrangements. |
Customers cannot access balances, deposits cannot be credited properly, account servicing halts, and confidence in the bank is undermined. |
|
2 |
Payments, Fund Transfers, and Cash Access |
DBP supports ATM withdrawals, fund transfers, bill payments, and PESONet-linked transfer capabilities. Disruption would immediately affect customers’ ability to move or access funds. |
Individuals, corporates, government-related users, beneficiaries, counterpart banks |
Tolerance for disruption must include time-based and other quantitative/qualitative measures, such as the number of customers or transactions affected. |
Customers cannot withdraw cash, transfer funds, pay bills, or settle urgent obligations; transaction backlogs and reputational harm escalate quickly. |
|
3 |
Remittance and Electronic Funds Delivery Services |
DBP provides branch-based and electronic remittance through partners and correspondent bank arrangements, including EC Remit for overseas Filipinos. This is critical where funds support households and time-sensitive obligations. |
OFWs, families/beneficiaries, remittance partners, correspondent banks |
Mapping of interdependencies and third-party resilience is required, especially where external partners support service delivery. |
Delayed family support, failed remittance credits, customer distress, cross-border settlement problems, increased complaints, and loss of trust. |
|
4 |
Digital Banking and Electronic Banking Access |
DBP offers DBP EC Banking, DBP Digital Banking Portal, online banking, e-government payment access, and related digital channels. These channels are essential for continuous service delivery when branches are inaccessible. |
Retail customers, corporates, institutional clients, public-sector users |
Banks should adopt risk-based strategies for their IT environment and test their ability to maintain critical operations under severe but plausible disruption scenarios. |
Customers are locked out of banking channels, payments fail, digital onboarding or servicing stops, and cyber incidents may create wide-scale service unavailability. |
|
5 |
Development Lending and Loan Servicing |
DBP’s primary mandate is development financing, particularly for agriculture, industry, infrastructure, MSMEs, health, utilities, and community development. The lending pipeline and post-disbursement servicing are central to DBP’s public mandate. |
Borrowers, project sponsors, SMEs, public-interest sectors, communities, government stakeholders |
Critical operations should reflect the institution’s business model and the services whose disruption could materially affect customers or the wider economy. |
Delays in financing drawdowns, inability to service loans, disruption to development projects, and broader economic and social impact in funded sectors. |
|
6 |
Corporate, Trade, and Institutional Transaction Banking Services |
DBP offers trade products, corporate/institutional banking, and related electronic channels. These services support working capital, trade flows, and institutional liquidity management. |
Corporate clients, government-linked entities, institutional customers, importers/exporters |
Banks must map interconnections and resources supporting critical operations and identify vulnerabilities in those dependencies. |
Trade transactions stall, corporate payments are delayed, documentary processing fails, and clients may face contractual, liquidity, or supply-chain impact. |
For DBP, the regulator’s expectations mean that identifying CBS is only the first step.
Each selected CBS should then be translated into a resilience work program that answers at least these questions:
|
Regulatory expectation |
What DBP should do for each CBS |
Example for DBP |
|
Identify critical operations |
Confirm which services would cause customer harm or systemic impact if disrupted |
Payments, remittance, digital banking, deposits, and development lending are likely candidates |
|
Set tolerance for disruption |
Define maximum acceptable outage, transaction backlog, customer impact, and data-loss thresholds |
Example: PESONet/fund transfer service may require much shorter tolerance than a non-urgent back-office reporting process |
|
Map interconnections and interdependencies |
Identify people, processes, technology, data, facilities, and third parties that support each CBS |
ATM switch, core banking, digital channels, telecoms, branch operations, SWIFT/correspondent banks, remittance partners |
|
Assess third-party resilience |
Ensure contracts and contingency plans address disruption, substitution, or exit |
Remittance partners, telecom providers, cloud/hosting vendors, payment processors |
|
Determine severe but plausible scenarios |
Use realistic scenarios relevant to DBP’s risk profile |
Cyberattack on digital banking, prolonged telecom outage, data centre failure, branch/facility denial, remittance partner outage |
|
Integrate BCM and testing |
Align BIA, recovery strategies, incident response, crisis communication, and periodic exercises with each CBS |
Test whether deposit access, payments, and digital banking can stay within tolerance during a ransomware or network outage |
|
Board and management oversight |
Have the Board approve criteria, and senior management drive remediation and investment priorities |
Board-approved CBS list, tolerance levels, and remediation roadmap |
The following examples show how CBS selection should connect to resilience testing under BSP expectations:
|
CBS |
Severe but plausible scenario |
Expected resilience question |
|
Deposit and Account Services |
Core banking outage during payroll crediting |
Can DBP restore balance inquiry, posting, and branch servicing within tolerance? |
|
Payments, Fund Transfers, and Cash Access |
ATM switch or network failure on a peak business day |
Can customers still withdraw cash or reroute essential payments? |
|
Remittance Services |
Failure of the remittance partner or the correspondent bank channel |
Can DBP switch to alternate channels without intolerable delay to beneficiaries? |
|
Digital Banking and Electronic Banking |
Ransomware or authentication platform disruption |
Can customers still access critical transactions safely while cyber containment is underway? |
|
Development Lending and Loan Servicing |
System outage affecting loan drawdown and repayment processing |
Can DBP continue high-priority disbursements and customer servicing for critical development projects? |
|
Trade and Institutional Banking |
Disruption of trade processing or corporate portal |
Can DBP maintain priority institutional transactions and documentary processing within the agreed tolerance? |
For DBP, the most credible Critical Business Services are those that combine its public development mandate with its banking obligations to depositors, borrowers, and transaction customers.
A practical CBS set would therefore include deposit/account services, payments and cash access, remittance services, digital banking access, development lending and servicing, and selected corporate/institutional transaction services.
These service lines align with DBP’s publicly stated offerings and with BSP’s requirement that banks identify critical operations whose disruption could create material harm.
In implementation, DBP should treat this chapter as a proposed CBS baseline.
The next steps are to validate each CBS through stakeholder workshops, define service owners, map dependencies, set impact tolerances, identify severe but plausible scenarios, and conduct scenario testing in line with BSP Circular No. 1203.
Blogs marked [x] are under construction.
| eBook 1: Understanding Your Organisation: Development Bank | |||
| C1 | C2 [x] | C3 [x] | C4 [x] |
| C5 | C6 [x] | C7 [x] | C8 [x] |
| |
|
|
|
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|