[OR] [EWB] [E1] [C5] Identifying Critical Business Services

 eBook 1: Chapter 5 What Are the Critical Business Services (Critical Operations) of EastWest Banking Corporation for Operational Resilience?

Introduction

In an operational resilience programme, EastWest Banking Corporation should begin by identifying the business services whose disruption would cause intolerable harm to customers, threaten the bank’s safety and soundness, or affect the wider financial system.

BCM Institute’s definition of a Critical Business Service (CBS) aligns closely with this outcome-based view: a CBS is a service provided to customers which, if disrupted, could cause intolerable customer harm or pose a risk to the soundness, stability, or resilience of the financial industry.

For EastWest, this exercise should be anchored like its actual business model. The bank states that it serves consumers, middle-market corporates, and the mass affluent through a wide network of stores and alternative delivery channels, while offering a broad range of banking products and services, as well as allied financial services, including bancassurance and leasing.

EastWest also highlights retail deposits, cards, loans, investments, and its EasyWay app as part of its operating model. These characteristics indicate that its most relevant CBS candidates will likely cluster around deposit-taking, payments, digital access, lending, cards, treasury or cash services, and customer servicing. 

BSP Circular No. 1203, Series of 2024, requires Bangko Sentral-supervised financial institutions to identify critical operations proportionate to their size, nature, and complexity, and then use those identified critical operations to inform subsequent steps, such as setting tolerances for disruption and mapping interconnections and interdependencies.

The Circular also expects the identification process to be dynamic, periodically assessed, and supported by operational risk management, business continuity, change management, and third-party risk considerations.

Purpose of Identifying Critical Business Services

The purpose of identifying CBS for EastWest is not merely to create a list of important activities.

It is to determine which customer-facing services must continue or be restored within an acceptable timeframe during a disruption.

BSP Circular No. 1203 makes this explicit by requiring that identified critical operations serve as the basis for tolerance setting, mapping of interconnections and interdependencies, severe-but-plausible scenario analysis, and resilience testing.

In practice, EastWest should assess its services from the customer journey outward, as BCM Institute recommends, using sources such as risk registers, critical asset and supplier lists, and business continuity and recovery plans.

This approach helps ensure that the selected CBS reflect real customer and market impact rather than internal organisational charts alone.

Proposed Critical Business Services of EastWest Banking Corporation

The following CBS are a practical and defensible starting point for EastWest Banking Corporation’s operational resilience programme.

They are framed as customer-facing services rather than internal functions, consistent with operational resilience principles and BSP expectations.

Commentary on the Proposed CBS

CBS-1 Deposit and Account Services should almost certainly be treated as critical because EastWest is a commercial bank serving retail and affluent customers across branches and alternative channels.

Deposits are foundational to customer confidence and daily financial activity.

A prolonged disruption would quickly cause customer harm and raise prudential concerns.

CBS-2 Payments, Funds Transfer, and Bill Payment Services are typically among the most important CBS in a Philippine bank because interruptions affect customers immediately and may also affect external stakeholders and the broader financial ecosystem.

BSP’s Circular specifically points to disturbances in payment and settlement systems as an example of a severe but plausible scenario that institutions are strongly encouraged to consider.

CBS-3 Digital Banking and Customer Access Channels are particularly relevant for EastWest because the bank expressly refers to traditional and alternative delivery channels, internet banking, and the EasyWay app.

For many customers, the digital channel is no longer secondary; it is the primary means of accessing banking services.

This means digital availability is closely tied to the delivery of several other CBS services, especially deposits, payments, and cards.

CBS-4 Card Issuing and Card Transaction Services is also a strong CBS candidate because EastWest identifies cards as a key product area and previously expanded its retail banking and card portfolio through acquisition.

Card transaction failures cause immediate disruption to point-of-sale and e-commerce operations, affecting both customers and merchants.

CBS-5 Retail and Consumer Lending Services and CBS-6 Corporate and SME Banking Services should be evaluated separately, where their disruption profiles differ.

For retail customers, harm may arise from the inability to access approved loan proceeds, pay instalments correctly, or obtain servicing during hardship.

For business clients, the consequences are often broader, including payroll, supplier, and working capital disruptions. EastWest’s published business model confirms that it serves both consumer and middle-market corporate segments.

CBS-7 Treasury, Liquidity, and Market-Facing Financial Services may not always be customer-visible in the same way as deposits or payments, but they can still be critical if failure would threaten the bank’s safety and soundness or impair settlement and liquidity obligations.

This is consistent with the BSP and BCM Institute's focus on services whose disruption may affect the institution, customers, and the wider financial system.

CBS-8 Customer Service, Complaints Handling, and Incident Communications become especially important during disruption.

BSP Circular No. 1203 requires business continuity arrangements, incident recovery planning, and communication and crisis management programmes to support the delivery of critical operations.

While customer service may support multiple CBS rather than stand alone in every bank, at EastWest, it should, at a minimum, be recognised as a critical cross-cutting service layer in the resilience design.

Operational Resilience Requirements from BSP Circular No. 1203 Relevant to CBS Identification

The BSP guidelines do not stop at identifying critical operations. They require the bank to build an operational resilience framework around them.

The key requirements relevant to EastWest’s CBS identification are summarised below.

These requirements are directly supported by BSP Circular No. 1203, particularly the sections on identified critical operations, tolerance for disruption, mapping interconnections and interdependencies, severe-but-plausible scenarios, third-party arrangements, BCM integration, and board reporting of test results.

Examples of How BSP Requirements Apply to EastWest’s CBS

For Deposit and Account Services, EastWest should determine how long customers can be without access to their balances, cash withdrawals, fund transfers, account opening, or account servicing before the harm becomes intolerable.

It should then map the applications, branch processes, call centre support, customer authentication controls, telecoms, data centres, and third-party utilities supporting that CBS.

BSP explicitly expects the mapping of interconnections and interdependencies, and the assessment of dependencies on public infrastructure, such as telecommunications and energy.

For Payments and Funds Transfer Services, EastWest should set disruption tolerances not only by time but also by the number of customers affected and the volume or value of affected transactions, since these are expressly mentioned in the Circular.

This is especially important where payment failures may ripple beyond EastWest to merchants, counterparties, and other financial institutions.

For Digital Banking and Customer Access Channels, EastWest should assess cyberattacks, ransomware, telecom outage, cloud or hosting failure, and authentication service disruptions as severe but plausible scenarios.

BSP’s Circular specifically cites simultaneous or coordinated cyberattacks/ransomware, failures of critical third-party providers, and disturbances in payment and settlement systems as scenarios that institutions are strongly encouraged to consider.

For all CBS, EastWest should ensure that test results are properly documented and escalated. BSP requires that testing outcomes include observed gaps or weaknesses and adjustments made or needed, and that the results be reported to the board.

This turns CBS identification from a static classification exercise into a continuing improvement cycle.

Key Considerations When Finalising EastWest’s CBS

EastWest should avoid classifying every important activity as a CBS. BSP states that the number of identified critical operations should be commensurate with the bank’s size, nature, and complexity.

A focused list is more useful because it drives realistic tolerance-setting, dependency mapping, scenario testing, and resource allocation.

The bank should also distinguish between a critical business service and the many internal functions that support it.

For example, “Payments, Funds Transfer, and Bills Payment Services” is the CBS; fraud monitoring, infrastructure support, settlement processing, vendor connectivity, and incident escalation are supporting processes or dependencies.

This distinction keeps the resilience framework customer-centred and aligned with the service-based approach described by BCM Institute and reflected in BSP’s focus on continuous delivery of critical operations.

Finally, EastWest should use existing operational risk management, business continuity, change management, and supplier management structures rather than build a disconnected parallel programme.

EastWest’s own governance materials indicate that risk management is already embedded across many business processes and operations, and BSP explicitly expects operational resilience to align with the BSFI’s governance and risk management system.

For EastWest Banking Corporation, the identification of Critical Business Services should begin with services essential to customer access, transaction execution, financial confidence, and the bank’s safety and soundness.

Based on EastWest’s published business model and BSP Circular No. 1203, the most defensible initial CBS set includes Deposit and Account Services; Payments, Funds Transfer, and Bills Payment Services; Digital Banking and Customer Access Channels; Card Services; Retail and Consumer Lending Services; Corporate and SME Banking Services; Treasury and Liquidity-related Services; and the customer support and communications capabilities needed to sustain them during disruption.

These CBS should then drive the next stages of EastWest’s operational resilience implementation: mapping dependencies and connectivity, establishing tolerance for disruption, identifying severe but plausible scenarios, and testing the bank’s ability to continue or restore service within acceptable limits.

That is the essence of operational resilience under BSP Circular No. 1203: not merely recovering systems, but protecting the continuous delivery of the services that matter most.

Blogs marked [x] are under construction.

eBook 1: Understanding Your Organisation
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.