[OR] [GCash] [E1] [C2] Understanding Your Organisation

Chapter 2

Understanding Your Organisation: GCash

Introduction

The purpose of this chapter is to establish a clear understanding of GCash and the operating environment within which its operational resilience programme should be designed and implemented.

For a highly digital financial-services organisation, resilience cannot be developed effectively without first understanding the services delivered to customers, the technologies and processes that enable those services, the regulatory environment, external service providers, financial-sector interconnections, and the potential consequences of disrupting important services.

This organisational understanding supports the principles of ISO 22316 – Security and Resilience: Organisational Resilience, particularly the need for organisations to understand their context, anticipate change, manage vulnerabilities and develop the adaptive capacity required to withstand disruption.

GCash, through G-Xchange, Inc. (GXI), identifies itself as registered, licensed, and regulated by the Bangko Sentral ng Pilipinas (BSP), while its digital wallet operates as a reloadable electronic money instrument.

This chapter also prepares the reader to understand why the organisational context must be directly connected to the BSP Guidelines on Operational Resilience under Circular No. 1203, Series of 2024.

The Circular applies its operational resilience framework to BSP-Supervised Financial Institutions (BSFIs), including non-bank electronic money issuers, and seeks to strengthen their ability to manage and mitigate disruptions to critical operations. 

By the end of the chapter, the reader should be able to recognise GCash's critical operating environment; understand the relationship between its products, customers, technology, people, third parties and financial-sector connections; and appreciate why these elements must be considered when identifying Critical Operations, setting Tolerance for Disruption, mapping interconnections and interdependencies, developing severe-but-plausible scenarios, testing resilience capabilities, and establishing effective response and recovery arrangements.

These elements provide the organisational foundation upon which the subsequent stages of the GCash operational resilience implementation programme can be built. (Bureau of the Treasury)

Understanding GCash in an Operational Resilience Context

GCash operates within a digital financial ecosystem in which customers expect financial services to be available quickly, securely and reliably.

The GCash Wallet enables activities such as transferring money and purchasing goods and services, while the broader GCash environment includes services such as cash-in, cash-out, bills payment, cards, transfers and merchant payments.

Other financial and lifestyle services are delivered through affiliated entities or external partners. (GCash)

This operating model means that operational resilience should not be viewed solely as the availability of the GCash mobile application.

A customer-facing service may depend on multiple underlying resources and organisations, including application platforms, databases, identity-verification mechanisms, payment-processing systems, telecommunications services, cybersecurity controls, cloud or other technology infrastructure, employees, merchants, banks, billers, and other third parties.

GCash's own published information illustrates this interconnected environment. Some services are provided directly by GXI; others involve affiliated entities such as Fuse Financing; and additional services involve third-party partners.

Its privacy information similarly identifies external banks, merchants, insurers, investment providers and other organisations that may support selected services. (GCash)

From an operational resilience perspective, therefore, understanding GCash requires an end-to-end service view rather than an organisational silo or individual system view.

ISO 22316 and Organisational Understanding

ISO 22316 provides principles for enhancing organisational resilience.

Applied to GCash, these principles encourage management to consider the organisation as an interconnected system whose ability to deliver important outcomes depends upon effective leadership, organisational culture, information sharing, resource availability, risk awareness, adaptability and coordinated decision-making.

For GCash, organisational resilience should therefore extend beyond traditional business continuity or disaster recovery. The organisation needs to understand:

• which services and operations are most important to customers and the financial ecosystem;
• how those services are delivered from end to end;
• which people, processes, technology, information, facilities and third parties support them;
• where concentrations, single points of failure and vulnerabilities exist;
• how disruption could affect customers, counterparties and other external stakeholders;
• how rapidly the organisation can respond, adapt and recover; and
• how lessons from incidents, exercises and operational changes are incorporated into continuous improvement.

This broader organisational understanding provides the foundation for translating ISO 22316's organisational resilience principles into practical operational resilience capabilities.

Philippine Operational Resilience Regulatory Context

The regulatory context is particularly important for GCash because BSP Circular No. 1203 introduced specific operational resilience expectations for BSFIs.

BSP explains that the guidelines are intended to enable financial institutions to maintain the delivery of financial services during prolonged disruptions and to require the integration of operational resilience with governance and related risk-management processes. 

The Circular therefore shifts the emphasis from simply preparing recovery plans to demonstrating that an institution understands what must remain resilient, what it depends on, how much disruption it can tolerate, and whether its resilience arrangements actually work under severe conditions.

For GCash, this is especially relevant because BSP Circular No. 1203 expressly encompasses non-bank electronic money issuers, while GCash identifies GXI as a BSP-regulated institution. 

Examples of Operational Resilience Compliance Requirements for GCash

Based on BSP Circular No. 1203, the following requirements should inform GCash's implementation of operational resilience.

These requirements are consistent with BSP's description of Circular No. 1203: BSFIs are expected to identify critical operations, establish tolerance levels for disruption, determine severe but plausible scenarios, map interconnections and interdependencies, manage risks, test their ability to deliver critical operations, and establish response and recovery plans. (Bureau of the Treasury)

Understanding GCash's Critical Operating Environment

For GCash, the identification of Critical Operations should begin with customer outcomes rather than with individual applications or departments. A useful question is:

Which GCash operations, if disrupted for an unacceptable period, could cause material harm to customers, GCash, or other relevant stakeholders?

Potential areas for assessment could include digital wallet availability, wallet funding, payment transaction processing, funds transfer, settlement processing, transaction authorisation, merchant payment enablement, customer account access, and service recovery.

These examples should be treated as candidates for assessment rather than predetermined BSP classifications.

This distinction is important. The organisation should demonstrate a structured process for deciding what constitutes a Critical Operation and periodically reconsider that determination as its products, customer base, technologies, partnerships and threat environment change.

Interconnections and Interdependencies

A digital financial service rarely operates independently. The resilience of GCash therefore depends on understanding how Critical Operations interact with supporting resources and external organisations.

For example, successful delivery of a digital wallet transaction may depend upon customer authentication, mobile connectivity, application services, transaction-processing infrastructure, cybersecurity controls, account and ledger information, partner-bank connectivity, payment infrastructure, merchants, telecommunications providers and operational personnel.

This dependency perspective is particularly important because GCash's service portfolio includes both services delivered by GXI and services involving affiliates or external partners.

An operational resilience framework should consequently identify not merely who the suppliers are, but which Critical Operations depend upon them, what would happen if they failed, how quickly alternative arrangements could be activated, and whether those alternatives have been tested.

Tolerance for Disruption

One of the most important concepts introduced through the BSP operational resilience framework is the Tolerance for Disruption.

BSP's framework requires a tolerance to be established for each identified Critical Operation, representing the maximum level of disruption the institution is prepared to accept.

At a minimum, the framework contemplates a time-based measure, while additional measures may include the number of customers affected and the volume or value of transactions affected.

For GCash, this encourages management to move beyond asking:

"How quickly can the system be recovered?"

toward asking:

"How much disruption to this Critical Operation can be tolerated before the consequences become materially unacceptable?"

This provides a more customer- and outcome-oriented basis for resilience investment, recovery capability and management decision-making.

Severe but Plausible Disruption

Understanding the organisation also means understanding the conditions under which its operating model could fail.

For GCash, severe but plausible scenarios considered during implementation could include a prolonged digital platform outage, a major cyberattack, a compromise of transaction integrity, a telecommunications disruption, a failure of a significant technology or cloud provider, a disruption of payment connectivity, a simultaneous failure of the primary and recovery environments, or a cascading failure involving several interconnected services.

These are implementation examples, not assertions that BSP has prescribed each scenario specifically for GCash.

The scenarios selected should be derived from GCash's own Critical Operations, dependencies, threat environment, and established Tolerance for Disruption.

Testing these scenarios enables management to determine whether documented recovery arrangements translate into genuine operational capability.

Integrating Operational Resilience with Existing Capabilities

Operational resilience should not create another isolated management programme.

BSP has specifically described operational resilience as something that should be integrated with governance structures and existing risk-management processes, including operational risk management, business continuity management, cyber resilience, third-party risk management and recovery arrangements.

For GCash, this means existing capabilities can provide important building blocks. Business continuity can support continuity and recovery strategies; technology resilience can support system availability and restoration; cybersecurity can address cyber disruption; third-party risk management can address external dependencies; crisis management can coordinate strategic decisions; and operational risk management can identify vulnerabilities and controls.

Operational resilience connects these disciplines around a common question:

Can GCash continue to deliver its Critical Operations at acceptable levels of disruption when faced with severe but plausible events?

Understanding GCash is the starting point for developing an effective operational resilience programme.

As a BSP-regulated digital financial services organisation operating through interconnected technologies, financial infrastructure, people, and third-party relationships, GCash must view resilience from the perspective of the end-to-end delivery of its Critical Operations, rather than from individual systems or organisational functions alone.

BSP Circular No. 1203 reinforces this approach by requiring BSFIs to identify Critical Operations, establish Tolerance for Disruption, understand interconnections and interdependencies, consider severe but plausible scenarios, manage risks, test resilience capabilities, and establish appropriate response and recovery arrangements. 

When combined with the principles of ISO 22316, these regulatory expectations provide GCash with a structured basis for developing an organisation that can anticipate, withstand, respond to, recover from, and adapt to disruption.

The key outcome of this chapter is therefore not simply an organisational profile of GCash. It is an understanding of the organisational context needed to determine what must be resilient, why it matters, what it depends upon, how much disruption can be accepted, and how GCash can demonstrate that its resilience capabilities are effective.

This understanding serves as the foundation for the subsequent implementation of Critical Operation identification, dependency mapping, Tolerance for Disruption, scenario testing, resilience improvement, and ongoing management oversight in the Strengthening Operational Resilience at GCash: An Enterprise Implementation Guide.

The regulatory alignment above uses BSP Circular No. 1203 (Series of 2024) – Guidelines on Operational Resilience, which is also identified as the regulatory reference in your existing GCash implementation material.

Understanding Your Organisation
C1	C2	C3	C4	C5
C6	C7	C8	C9	eBook Cover

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.