[OR] [GCash] [E1] [C1] Introducing OR Case Study

eBook 1: Chapter 1

Introducing OR Case Study: Metrobank

Operational resilience begins with a thorough understanding of the organisation it is intended to protect.

Before resilience strategies, impact tolerances, dependency mapping, or scenario testing can be developed, it is essential to understand the organisation's purpose, operating model, regulatory obligations, business environment, and critical operations. 

This foundational knowledge enables resilience practitioners to design an Operational Resilience Programme that aligns with the organisation's strategic objectives, operational priorities, and regulatory expectations.

This chapter introduces GCash as the case study organisation for this eBook series.

It examines GCash's operating environment within the Philippines, outlines the composition of a typical Operational Resilience Team, discusses the organisation's Critical Operations, identifies its key organisational characteristics, and establishes the goals that will guide the implementation of its Operational Resilience Programme. 

Together, these elements provide the organisational context required for the subsequent chapters.

 

Purpose of the Chapter

This chapter provides a comprehensive overview of GCash’s operational landscape, enabling readers to appreciate the complexities and challenges GCash faces in maintaining service continuity.

The reader will gain insights into how GCash’s team is structured to manage operational risk, how critical business services are prioritised, and the steps taken to integrate resilience into its corporate culture.

By the end of this chapter, readers will be better prepared to delve into the practical aspects of implementing operational resilience, armed with an understanding of the organisational dynamics and strategic goals that drive GCash's approach.

 

 GCash's Operating Environment in the Philippines Governed by the Bangko Sentral ng Pilipinas

GCash operates within one of Southeast Asia's fastest-growing digital financial services markets, where mobile payments and electronic money have become integral to economic activity. 

Consumers increasingly rely on digital channels for everyday financial transactions, making service availability, security, and operational reliability essential.

The Bangko Sentral ng Pilipinas (BSP) serves as the primary regulator responsible for maintaining the safety, soundness, and stability of the Philippine financial system. 

Through its regulatory framework, the BSP expects financial institutions to maintain effective governance, sound risk management, cybersecurity, business continuity, operational resilience, and consumer protection.

In particular, BSP Circular No. 1203 (Series of 2024) – Guidelines on Operational Resilience requires supervised institutions to strengthen their ability to anticipate, withstand, respond to, recover from, and adapt to operational disruptions. 

This includes identifying critical operations, understanding operational dependencies, establishing impact tolerances, conducting severe-but-plausible scenario testing, and implementing governance arrangements to support resilience objectives.

In addition to regulatory expectations, GCash operates in an environment characterised by rapidly evolving technology, rising cyber threats, complex third-party dependencies, shifting customer expectations, and increasing digital transaction volumes. 

These factors make operational resilience a strategic capability rather than simply a regulatory compliance exercise.

 

Composition of an Operational Resilience Team for GCash

An effective Operational Resilience Programme requires collaboration across the organisation. While governance and oversight typically reside with senior management, resilience activities involve multiple business and support functions.

A typical Operational Resilience Team for GCash may comprise the following roles:

 

Role	Primary Responsibilities
Executive Sponsor	Provides strategic direction, governance, and executive accountability for Operational Resilience.
Operational Resilience Programme Manager	Leads programme implementation, coordination, and reporting.
Operational Risk Management	Integrates operational resilience with enterprise operational risk management practices.
Business Operations Representatives	Identify and maintain Critical Operations, operational processes, and recovery priorities.
Technology and Infrastructure	Maintain resilience of applications, cloud services, infrastructure, and supporting technologies.
Cybersecurity	Protect digital assets, monitor cyber threats, and coordinate cyber incident response.
Business Continuity Management	Develop continuity strategies, recovery plans, and resilience exercises.
Crisis Management	Coordinate organisational response during major operational disruptions.
Information Security	Protect information assets and support secure operational processes.
Third-Party Risk Management	Assess and monitor the resilience of outsourced service providers and strategic vendors.
Compliance and Legal	Ensure regulatory compliance and provide legal guidance.
Customer Operations	Represent customer service, complaints management, and service recovery activities.
Internal Audit	Independently assess the effectiveness of the Operational Resilience Programme.

Cross-functional collaboration ensures that resilience considerations are embedded into business decision-making rather than managed as a standalone initiative.

 

Critical Operations of GCash: Key Considerations for Operational Resilience

A core activity in implementing Operational Resilience is identifying the organisation's Critical Operations (CO). These are the operational activities whose disruption could result in unacceptable harm to customers, financial stability, regulatory compliance, or organisational objectives.

When determining Critical Operations, GCash should evaluate:

• Customer impact resulting from operational disruption.
• Financial and systemic consequences for the Philippine payment ecosystem.
• Regulatory obligations established by the BSP.
• Interdependencies across business processes, technology, information, facilities, personnel, and third-party providers.
• Recovery complexity and required coordination.
• Reputational consequences arising from prolonged operational disruption.
• The organisation's ability to operate within defined impact tolerances during severe but plausible scenarios.

Examples of Critical Operations include:

• Digital Wallet Operations
• Digital Payment and Funds Transfer Operations
• Cash-In and Cash-Out Operations
• Merchant Payment Operations
• Bills Payment Operations
• Digital Financial Product Operations
• Customer Identity and Authentication Operations
• Fraud Detection and Financial Crime Operations
• Customer Support and Dispute Management Operations
• Digital Platform and Technology Operations

These critical operations form the foundation for subsequent resilience activities, including dependency mapping, impact tolerance development, scenario testing, and resilience improvement planning.

 

Key Characteristics of GCash

Several characteristics influence the design and implementation of Operational Resilience at GCash.

Digital-First Operating Model

Business operations depend heavily on digital platforms, cloud computing, mobile technologies, and online customer interactions.

High Transaction Volumes

Large volumes of financial transactions require continuous operational availability and highly resilient transaction processing capabilities.

Customer-Centric Service Delivery

Customers expect secure, convenient, and uninterrupted access to financial services at any time.

Extensive Third-Party Dependencies

Operational capabilities rely upon telecommunications providers, cloud service providers, banking partners, payment networks, technology vendors, and outsourced service providers.

Cybersecurity Exposure

The organisation operates in an increasingly sophisticated cyber threat environment that requires integrated cyber resilience capabilities.

Highly Regulated Environment

GCash operates under comprehensive regulatory oversight requiring strong governance, operational controls, consumer protection, and resilience management.

Rapid Innovation

Continuous product development and technological change require resilience to be integrated throughout the system development and change management lifecycle.

 

Establishing Organisational Goals for Operational Resilience

The Operational Resilience Programme should support GCash's broader organisational strategy while satisfying regulatory expectations and protecting customers.

Typical organisational goals include:

• Ensure the continuity of Critical Operations during severe but plausible disruptions.
• Protect customers from unacceptable operational harm.
• Strengthen confidence in GCash's digital financial services.
• Meet BSP Operational Resilience regulatory requirements.
• Improve organisational preparedness for operational disruption.
• Enhance cyber resilience and technology resilience capabilities.
• Strengthen third-party resilience across critical suppliers and service providers.
• Establish measurable impact tolerances for Critical Operations.
• Improve cross-functional coordination during disruption response.
• Foster a culture of resilience and continuous improvement throughout the organisation.

These goals provide strategic direction for the Operational Resilience Programme and establish measurable outcomes for programme implementation.

 

Understanding the organisation is the essential first step in building an effective Operational Resilience Programme. 

For GCash, this involves more than understanding its products or organisational structure; it requires appreciating its role within the Philippine financial ecosystem, the regulatory expectations set by the Bangko Sentral ng Pilipinas, the complexity of its technology-enabled operating model, and the operational activities critical to customers and the wider economy. 

This organisational context provides the foundation upon which resilience capabilities can be designed, implemented, and continuously improved.

This chapter has introduced GCash's operating environment, organisational characteristics, governance structure for Operational Resilience, Critical Operations, and strategic resilience goals. 

Together, these elements establish the context necessary for developing a comprehensive Operational Resilience framework. 

In the next chapter, the focus shifts from understanding the organisation to understanding the principles and framework of Operational Resilience, providing the methodology that will guide the identification, protection, testing, and continuous improvement of GCash's Critical Operations.

The menu and blogs highlighted in the table below are under construction

Understanding Your Organisation
C1	C2	C3	C4	C5
C6	C7	C8	C9	eBook Cover

 

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.