---
title: [OR] [EWB] [E3] [CBS] [1] [ST] Perform Scenario Testing
description: [OR] [EWB] [E3] [CBS] [1] [ST] Perform Scenario Testing
image: https://blog.bcm-institute.org/hubfs/PH%20Bank%20Graphic%20Folder/%5BPH%5D%20EastWest%20Bank%20Graphic%20Folder/EWB%20CBS%201%20Morepost/%5BOR%5D%20%5BEWB%5D%20%5BPH%5D%20%5BE3%5D%20%5BCBS%5D%20%5B1%5D%20%5BST%5D%20Deposit%20and%20Account%20Services.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience Implementation Blueprint: EastWest Banking Corporation
# \[OR\] \[EWB\] \[E3\] \[CBS\] \[1\] \[ST\] Perform Scenario Testing
[![x \[OR\] \[EWB\] Title Banner](https://no-cache.hubspot.com/cta/default/3893111/17d1e813-43b5-46af-8fc0-4dafce1e32cc.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/17d1e813-43b5-46af-8fc0-4dafce1e32cc)
Scenario testing is a core component of operational resilience, as articulated in the BSP Circular No. 1203 Series of 2024. It enables financial institutions to validate their ability to remain within defined impact tolerances under severe but plausible disruption scenarios.
For CBS-1 Deposit and Account Services, scenario testing ensures that critical customer-facing services—such as onboarding, transactions, and account access—remain resilient amid operational, cyber, and third-party disruptions.
In alignment with the BCM Institute’s guidance in “\[OR\] \[P2-S4\] What is Scenario Testing in Operational Resilience?”, scenario testing must incorporate end-to-end process validation, interdependency stress, and realistic disruption assumptions.
The scenarios below integrate **Cyber and ICT risks**, reflecting regulatory expectations that banks assess vulnerabilities across digital channels, infrastructure, and third-party ecosystems.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c32e9b3-ea88-44c3-9182-fa3e6a9aadee)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Apr 13, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![x \[OR\] \[EWB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/445a6eaf-f780-48e4-af70-bb0ecc7a1fe0.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/445a6eaf-f780-48e4-af70-bb0ecc7a1fe0)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c32e9b3-ea88-44c3-9182-fa3e6a9aadee)**CBS-1 Deposit & Account Services**
#### Introduction
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/fe85e2f2-f972-49ad-8321-d370fcfd9caf)
[![\[OR\] \[EWB\] \[PH\] \[E3\] \[CBS\] \[1\] \[ST\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/d3b9d48d-4a16-454e-bf5e-a04070a7becd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d3b9d48d-4a16-454e-bf5e-a04070a7becd)
Scenario testing is a core component of operational resilience, as articulated in the BSP Circular No. 1203 Series of 2024.
It enables financial institutions to validate their ability to remain within defined impact tolerances under severe but plausible disruption scenarios.
For CBS-1 Deposit and Account Services, scenario testing ensures that critical customer-facing services—such as onboarding, transactions, and account access—remain resilient amid operational, cyber, and third-party disruptions.
In alignment with the BCM Institute’s guidance in “\[OR\] \[P2-S4\] What is Scenario Testing in Operational Resilience?”, scenario testing must incorporate end-to-end process validation, interdependency stress, and realistic disruption assumptions.
The scenarios below integrate **Cyber and ICT risks**, reflecting regulatory expectations that banks assess vulnerabilities across digital channels, infrastructure, and third-party ecosystems.
[![Banner \[Table\] \[OR\] \[E3\] Perform Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/a45e9708-7139-4f4e-8e0e-41179f5cacc3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a45e9708-7139-4f4e-8e0e-41179f5cacc3)
###### Table P6: Perform Scenario Testing for CBS-1
| **Sub-CBS Code** | **Sub-CBS** | **Recommended Scenario Test Themes (incl. Cyber & ICT Risk Integration)** | **Impact / Effect** | **Evidence of Proactive Risk Management Action** |
| --- | --- | --- | --- | --- |
| **1.1** | **Customer Onboarding and Account Application** | **Digital onboarding platform outage due to cloud service disruption; surge in applications during outage** | **Delayed onboarding, customer dissatisfaction** | **Redundant onboarding channels (branch/manual), load balancing, and onboarding backlog procedures** |
| **1.2** | **Customer Identification and Verification (KYC/CDD)** | **Failure of e-KYC systems due to API integration breakdown or cyberattack** | **Inability to verify customers, regulatory breach risk** | **Manual KYC fallback, secure API gateways, periodic KYC system penetration testing** |
| **1.3** | **Account Approval and Opening** | **Core banking approval workflow disruption from a system bug or a ransomware attack** | **Delayed account opening, operational backlog** | **Segregated approval workflows, offline approval procedures, and system recovery playbooks** |
| **1.4** | **Initial Funding and Deposit Booking** | **Payment gateway outage or interbank network failure** | **Failed or delayed initial deposits** | **Alternate funding channels, integration with multiple payment networks, and transaction retry mechanisms** |
| **1.5** | **Product Terms Setup and Account Parameter Maintenance** | **Configuration errors or unauthorised parameter changes due to insider threat or cyber breach** | **Incorrect interest/fees applied, financial loss** | **Maker-checker controls, audit trails, privileged access monitoring** |
| **1.6** | **Deposit Transactions Processing** | **Core banking system downtime or database corruption** | **Inability to process deposits, transaction backlog** | **Real-time replication, failover systems, transaction queuing and replay capability** |
| **1.7** | **Withdrawal and Funds Access Processing** | **ATM/POS network outage or cyberattack on card systems** | **Customers are unable to withdraw funds** | **ATM network redundancy, card switch failover, and emergency cash access procedures** |
| **1.8** | **Account Servicing and Customer Maintenance** | **CRM system outage or data breach affecting customer records** | **Inability to update customer data, reputational damage** | **Data backup, role-based access control, and customer service fallback channels** |
| **1.9** | **Interest, Fees, and Charges Processing** | **Batch processing failure or data integrity issue due to system malfunction** | **Incorrect charges, customer disputes** | **Automated reconciliation, batch rerun capability, and exception reporting** |
| **1.10** | **Statement, Passbook, and Balance Reporting** | **Reporting system outage or data extraction failure** | **Customers are unable to access account information** | **Multi-channel reporting (online, branch), cached data access, reporting redundancy** |
| **1.11** | **Digital Account Access and Channel Integration** | **Mobile/internet banking outage due to a DDoS attack or system overload** | **Loss of digital access, customer complaints** | **DDoS protection, auto-scaling infrastructure, and alternate access channels** |
| **1.12** | **ATM and Card-Based Access Management** | **Card management system compromise or ATM malware attack** | **Unauthorised transactions, service disruption** | **EMV security, fraud monitoring systems, ATM hardening and patching** |
| **1.13** | **Account Reconciliation and Exception Handling** | **Reconciliation system failure or delayed batch jobs** | **Unresolved discrepancies, financial reporting issues** | **Automated reconciliation tools, manual reconciliation fallback, and exception dashboards** |
| **1.14** | **Dormancy, Holds, Restrictions, and Account Control Administration** | **Incorrect tagging due to a system error or cyber manipulation** | **Improper account restrictions or access** | **Dual controls, audit logs, periodic review of dormant accounts** |
| **1.15** | **Fraud Monitoring and Transaction Surveillance** | **Failure of fraud detection systems or AI models due to a cyberattack** | **Increased fraud exposure, financial loss** | **Real-time monitoring, rule-based fallback detection, fraud response escalation protocols** |
| **1.16** | **Complaints, Disputes, and Service Recovery** | **Customer complaint system outage or backlog during a crisis event** | **Delayed dispute resolution, reputational damage** | **Case management backup systems, prioritisation protocols, escalation workflows** |
| **1.17** | **Regulatory Reporting and Compliance Monitoring** | **Regulatory reporting system failure or data inconsistency** | **Non-compliance with BSP reporting requirements** | **Regulatory reporting backup processes, validation controls, and compliance monitoring tools** |
| **1.18** | **Incident Response, Business Continuity, and Recovery** | **Major cyberattack (e.g. ransomware) or data centre outage affecting multiple CBS processes** | **Widespread service disruption, breach of impact tolerance** | **Tested BCP/DR plans, crisis management team activation, recovery time validation, and regular scenario testing** |
#### **Regulatory Alignment and Operational Resilience Requirements**
Under BSP Circular No. 1203 Series of 2024, Philippine banks are required to:
- Conduct **scenario testing using severe but plausible events**, including cyber threats and third-party failures
- Validate **impact tolerances** for critical business services
- Ensure **end-to-end mapping of dependencies**, including ICT and third-party providers
- Demonstrate **ability to recover within tolerance thresholds**
- Maintain **evidence of continuous improvement and testing outcomes**
The above scenarios incorporate these requirements by embedding cyber resilience, third-party dependencies, and recovery validation across all Sub-CBS processes.
[![Banner \[Summing\] \[OR\] \[E3\] Perform Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/11895c06-91e9-4cec-acb6-4356741952e4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/11895c06-91e9-4cec-acb6-4356741952e4)
Scenario testing for CBS-1 Deposit and Account Services provides EastWest Banking Corporation with a structured, evidence-based approach to validate its operational resilience.
By simulating disruptions across onboarding, transaction processing, digital access, and fraud monitoring, the bank can identify vulnerabilities and strengthen its ability to remain within defined impact tolerances.
Ultimately, integrating Cyber and ICT risks into scenario testing ensures that resilience is not limited to physical or process disruptions but also extends to the digital ecosystem underpinning modern banking services.
Continuous testing, learning, and improvement will enable the bank to meet regulatory expectations and sustain customer trust even in periods of severe disruption.
| **eBook 3: Starting Your OR Implementation** | | | | | |
| --- | --- | --- | --- | --- | --- |
| **CBS-1 Deposit & Account Services** | | | | | |
| **CBS-1 DP** | **CBS-1 MD** | **CBS-1 MPR** | **CBS-1 ITo** | **CBS-1 SuPS** | **CBS-1 ST** |
| [![\[OR\] \[EWB\] \[PH\] \[E3\] \[CBS\] \[1\] \[DP\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/eed52bc4-649c-4a2c-be54-7b6f88c9db2d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/eed52bc4-649c-4a2c-be54-7b6f88c9db2d) | [![\[OR\] \[EWB\] \[PH\] \[E3\] \[CBS\] \[1\] \[MD\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/ce0f6cbd-ce77-4244-83ae-66eeddcd0d43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ce0f6cbd-ce77-4244-83ae-66eeddcd0d43) | [![\[OR\] \[EWB\] \[PH\] \[E3\] \[CBS\] \[1\] \[MPR\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/94d31db8-57d8-4c2e-932f-628cd10036f3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/94d31db8-57d8-4c2e-932f-628cd10036f3) | [![\[OR\] \[EWB\] \[PH\] \[E3\] \[CBS\] \[1\] \[ITo\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/a36cec4c-d574-4b3c-954c-57beb01679c6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a36cec4c-d574-4b3c-954c-57beb01679c6) | [![\[OR\] \[EWB\] \[PH\] \[E3\] \[CBS\] \[1\] \[SuPS\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/7ed33e3b-ff0c-470b-a21a-9005393c16c3.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7ed33e3b-ff0c-470b-a21a-9005393c16c3) | [![\[OR\] \[EWB\] \[PH\] \[E3\] \[CBS\] \[1\] \[ST\] Deposit and Account Services](https://no-cache.hubspot.com/cta/default/3893111/d3b9d48d-4a16-454e-bf5e-a04070a7becd.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d3b9d48d-4a16-454e-bf5e-a04070a7becd) |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)
**Gain Competency:** For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-04-13T11:52:53.322Z",
"datePublished" : "2026-04-13T07:31:40.000Z",
"headline" : "[OR] [EWB] [E3] [CBS] [1] [ST] Perform Scenario Testing",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-ewb-e3-cbs-1-st-perform-scenario-testing",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```