[OR] [DBP] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios

Sub-CBS Code

Sub-CBS

Severe but Plausible Scenario

Impact / Effect

Proactive Risk Management Action

Link to Integration of Cyber and ICT Risks

1.1

Customer Onboarding and Account Application

Prolonged outage of the digital onboarding platform due to a cyberattack (e.g., DDoS)

Inability to onboard new customers; reputational damage

Deploy DDoS protection, and alternate manual onboarding procedures

Cyber resilience (DDoS mitigation, secure digital channels)

1.2

Customer Identification and Verification (KYC/CDD)

National ID verification service outage or data breach

Delays in KYC processing; regulatory non-compliance

Maintain offline verification procedures; diversify KYC data sources

ICT dependency risk; third-party cyber risk

1.3

Account Approval and Opening

Core banking system failure during account approval

Incomplete or erroneous account creation

Implement system redundancy; maker-checker controls

Core system resilience; system failover

1.4

Initial Funding and Deposit Booking

The payment gateway outage is preventing the initial deposit posting

Customer dissatisfaction; failed account activation

Establish alternate funding channels; transaction queuing

Payment system integration risk

1.5

Product Terms Setup and Account Parameter Maintenance

Unauthorized system changes due to an insider threat

Incorrect interest rates/fees applied

Enforce role-based access control (RBAC); audit trails

Identity and access management (IAM) risk

1.6

Deposit Transactions Processing

Core banking system latency or crash during peak hours

Transaction delays; financial inaccuracies

Implement load balancing; real-time monitoring

System performance and capacity risk

1.7

Withdrawal and Funds Access Processing

ATM network outage or card switch failure

Customers are unable to withdraw funds

Multi-network ATM routing; cash contingency planning

Network resilience; third-party switch risk

1.8

Account Servicing and Customer Maintenance

CRM system unavailability due to a ransomware attack

Inability to update customer records; service delays

Regular backups, endpoint protection; incident response plan

Cyber resilience (ransomware defense)

1.9

Interest, Fees, and Charges Processing

Batch processing failure due to corrupted data

Incorrect customer balances; financial loss

Data validation controls; reconciliation checks

Data integrity and processing risk

1.10

Statement, Passbook, and Balance Reporting

Data warehouse failure impacting reporting systems

Customers are unable to access statements

Implement backup reporting systems; cloud replication

Data availability and storage resilience

1.11

Digital Account Access and Channel Integration

Mobile banking application outage due to cloud service failure

Customers are unable to access accounts digitally

Multi-cloud strategy; failover mechanisms

Cloud and API resilience risk

1.12

ATM and Card-Based Access Management

Card management system breach exposing card data

Fraud risk; customer trust erosion

Tokenisation, encryption, and fraud monitoring systems

Payment card security (PCI DSS) risk

1.13

Account Reconciliation and Exception Handling

Reconciliation system failure leading to unmatched transactions

Financial discrepancies; audit issues

Automated reconciliation tools; exception workflows

Data reconciliation system risk

1.14

Dormancy, Holds, Restrictions, and Account Control Administration

Erroneous bulk account freezing due to a system error

Customer complaints; legal exposure

Implement approval controls; rollback procedures

System control and governance risk

1.15

Fraud Monitoring and Transaction Surveillance

Fraud detection system outage during an active fraud attack

Undetected fraudulent transactions

Deploy AI-based fraud detection redundancy; real-time alerts

Cyber fraud and monitoring risk

1.16

Complaints, Disputes, and Service Recovery

Contact center system outage during a crisis event

Inability to handle customer complaints

Activate alternate communication channels; crisis scripts

Communication system resilience

1.17

Regulatory Reporting and Compliance Monitoring

Failure to submit regulatory reports due to system/data issues

Regulatory penalties; compliance breach

Maintain manual reporting fallback; data governance controls

Regulatory technology (RegTech) risk

1.18

Incident Response, Business Continuity, and Recovery

Failure of the disaster recovery (DR) site during a major outage

Prolonged service disruption; breach of impact tolerance

Conduct regular DR testing; geo-redundant sites

ICT resilience, DR, and backup infrastructure