[OR] [GCash] [E1] [C5] Identifying Critical Business Services

Chapter 5

What Are the Critical Operations of GCash When Implementing an Operational Resilience Program?

Introduction

While traditional business continuity management often focuses on recovering business functions or technology, operational resilience concentrates on ensuring that the organisation can continue executing its most critical operational activities that enable the delivery of financial products and services.

For a digital financial services provider such as GCash, the uninterrupted execution of critical operations is essential to maintaining customer trust, protecting financial stability, meeting regulatory obligations, and supporting the Philippine digital economy. 

Identifying these Critical Operations (CO) provides the foundation for establishing impact tolerances, understanding operational dependencies, prioritising resilience investments, and preparing for severe but plausible disruption scenarios.

This chapter introduces the concept of Critical Operations within the context of GCash's Operational Resilience Programme. 

It explains how critical operations are identified, proposes a practical list of operations appropriate for GCash's business model, illustrates severe but plausible scenarios that could disrupt these operations, and demonstrates alignment with the Bangko Sentral ng Pilipinas (BSP) Circular No. 1203 – Guidelines on Operational Resilience.

What is a Critical Operation (CO)?

A Critical Operation (CO) is an operational activity that an organisation must continue to perform, or recover within an acceptable period, because prolonged disruption could result in unacceptable harm to customers, financial markets, the organisation, or the wider economy.

Critical Operations encompass the people, processes, technology, information, facilities, and third-party services that collectively enable an organisation to perform its essential operational responsibilities. They represent the operational capabilities required to deliver products and services reliably under both normal and disrupted conditions.

Unlike traditional business continuity planning, which often identifies critical departments or business functions, Operational Resilience focuses on the operational activities whose interruption would create significant adverse consequences.

Each Critical Operation therefore becomes the primary focus for resilience planning, dependency mapping, impact tolerance setting, scenario testing, governance, and continuous improvement.

For GCash, identifying Critical Operations ensures that resilience efforts are directed towards the operational capabilities that are most essential to maintaining confidence in the organisation and supporting the continuity of the Philippine financial ecosystem.

Key Considerations for Identifying Critical Operations at GCash

The identification of Critical Operations should follow a structured assessment that considers the potential consequences of operational disruption rather than organisational structure.

Key considerations include:

Customer Harm

Would disruption prevent customers from accessing or managing their electronic money, making payments, receiving funds, or completing essential financial transactions?

Financial Stability

Would prolonged disruption significantly affect payment activities, digital financial services, or confidence in the Philippine financial system?

Regulatory Obligations

Would disruption result in non-compliance with BSP regulatory expectations or other applicable legal and supervisory requirements?

Market Confidence

Would extended operational disruption undermine public confidence in digital financial services or electronic payment platforms?

Operational Interdependencies

Does the operation depend upon multiple business units, technology platforms, telecommunications providers, cloud services, banking partners, payment networks, or outsourced service providers?

Recovery Complexity

Would restoration require coordinated recovery across numerous systems, operational teams, external vendors, and infrastructure providers?

Reputational Impact

Would disruption attract widespread public attention, regulatory scrutiny, or significant reputational damage?

Collectively, these considerations enable GCash to identify the operations that require the highest levels of resilience planning, governance, testing, and investment.

Proposed Critical Operations of GCash

The following Critical Operations are fundamental to GCash's ability to deliver digital financial services and maintain operational resilience.

CO-1 Digital Wallet Operations

Operating and maintaining customer electronic money accounts, balance management, account administration, and wallet availability.

CO-2 Digital Payment and Funds Transfer Operations

Processing peer-to-peer transfers, merchant payments, QR payments, bank transfers, and other electronic payment transactions.

CO-3 Cash-In and Cash-Out Operations

Managing the operational processes supporting deposits and withdrawals through banks, agents, ATMs, and retail partners.

CO-4 Merchant Payment Operations

Supporting payment acceptance across retail merchants, online businesses, government agencies, and commercial partners.

CO-5 Bills Payment Operations

Processing payments for utilities, telecommunications providers, educational institutions, government agencies, and recurring customer obligations.

CO-6 Digital Financial Product Operations

Supporting operational delivery of lending, insurance, investment, savings, and other financial products offered through GCash's ecosystem partners.

CO-7 Customer Identity and Authentication Operations

Managing customer registration, identity verification, login authentication, multi-factor authentication, access control, and digital identity services.

CO-8 Fraud Detection and Financial Crime Operations

Monitoring transactions, identifying fraudulent activities, supporting anti-money laundering controls, and protecting customers against financial crime.

CO-9 Customer Support and Dispute Management Operations

Managing customer enquiries, complaints, dispute investigations, transaction reversals, and service recovery activities.

CO-10 Digital Platform and Technology Operations

Operating and maintaining the technology infrastructure, cloud services, APIs, networks, applications, databases, and supporting platforms that enable all GCash operational activities.

Example: Severe but Plausible Scenarios Affecting GCash Critical Operations

Operational resilience requires organisations to prepare for realistic disruption scenarios that could significantly affect their ability to perform Critical Operations.

Examples include:

Large-scale Cyberattack

A ransomware attack compromises multiple production environments, preventing execution of payment processing, customer authentication, and wallet operations.

Cloud Infrastructure Failure

A cloud infrastructure failure disrupts transaction processing, customer access, and supporting operational platforms.

Nationwide Telecommunications Outage

Major telecommunications failures prevent customers from accessing mobile applications, completing authentication, or receiving transaction notifications.

Payment Infrastructure Failure

Disruption affecting payment gateways or interbank payment infrastructure delays or prevents payment processing.

Third-Party Service Provider Failure

Critical vendors supporting cloud hosting, digital identity verification, fraud monitoring, payment processing, or API services become unavailable.

Distributed Denial-of-Service (DDoS) Attack

Sustained attacks overwhelm network infrastructure, degrading platform performance and preventing customer access.

Insider Threat

Malicious or negligent actions by privileged personnel compromise critical operational systems or financial data.

Technology Change Failure

A defective software release or configuration error causes widespread application instability and transaction failures.

Pandemic or Workforce Disruption

Significant workforce shortages affect fraud monitoring, operational support, customer service, and technology operations.

Natural Disaster

Typhoons, earthquakes, flooding, or regional infrastructure failures disrupt facilities, telecommunications, technology infrastructure, and operational teams.

Regulatory Alignment for GCash with Bangko Sentral ng Pilipinas

Identifying Critical Operations is a fundamental component of the Operational Resilience framework expected under Bangko Sentral ng Pilipinas (BSP) Circular No. 1203 (Series of 2024) – Guidelines on Operational Resilience.

The BSP expects supervised financial institutions to identify the operations that are essential to maintaining financial stability, protecting customers, and supporting the continued delivery of important financial activities.

Institutions should understand the people, processes, technology, information, facilities, and third-party relationships supporting these operations, establish impact tolerances for operational disruption, and conduct mapping and scenario testing to validate resilience capabilities.

For GCash, identifying Critical Operations enables management to prioritise resilience investments, understand operational dependencies, evaluate vulnerabilities, establish recovery priorities, and strengthen governance over operational risk.

It also supports integration across Operational Risk Management, Business Continuity Management, Cyber Resilience, Third-Party Risk Management, Crisis Management, and Technology Risk Management, creating a coordinated enterprise-wide Operational Resilience capability that aligns with BSP regulatory expectations and international good practice.

Proposed Critical Operations (CO) of GCash

Identifying Critical Operations is a foundational activity in implementing an Operational Resilience Programme at GCash.

Rather than concentrating solely on organisational units or technology systems, the organisation should focus on the operational capabilities that are essential to maintaining customer confidence, meeting regulatory obligations, and supporting the stability of the Philippine financial ecosystem.

These Critical Operations provide the basis for determining impact tolerances, understanding operational dependencies, prioritising resilience investments, and validating preparedness through scenario testing.

The proposed Critical Operations presented in this chapter establish a practical framework for strengthening operational resilience at GCash. In the following chapters, each Critical Operation will be analysed in greater detail by identifying its supporting people, processes, technology, facilities, information, and third-party dependencies.

This service-oriented operational view enables GCash to better anticipate, withstand, respond to, recover from, and adapt to severe but plausible disruptions while continuing to perform the operations that matter most to its customers and stakeholders.

The menu and blogs highlighted in the table below are under construction

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.