---
title: [OR] [GXB] [E1] [C1] Introducing OR Case Study
description: [OR] [GXB] [E1] [C1] Introducing OR Case Study
image: https://blog.bcm-institute.org/hubfs/eBook%20Generic%20Morepost/OR/OR%20E1%20GEN%20Morepost/%5BOR%5D%20%5BGEN%5D%20%5BE1%5D%20%5BC1%5D%20Introducing%20OR%20Case%20Study.jpg
---
.
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Strengthening Banking Resilience: A Practical Guide for GX Bank
# \[OR\] \[GXB\] \[E1\] \[C1\] Introducing OR Case Study
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/7653b707-8a37-4e81-af7a-9982a8d67a64)
Operational resilience has become increasingly important to financial institutions as banking services become more digital, interconnected and dependent on complex technology and third-party ecosystems.
For GX Bank Berhad (GXB), these considerations are particularly relevant because its operating model is fundamentally digital, with customers accessing banking services principally through the GXBank application rather than through a traditional branch network.
GX Bank is a digital bank licensed and regulated by Bank Negara Malaysia (BNM).
Its publicly available services include digital savings accounts, Savings Pockets, DuitNow transfers and QR payments, debit-card services and FlexiCredit, supported by digital onboarding and 24/7 customer support.
This operating model provides the context for the case study developed throughout this eBook series. The purpose is not to assess GXB's actual internal resilience arrangements, which are not publicly available.
Instead, GXB serves as a practical case study to show how to design and implement an Operational Resilience framework for a Malaysian digital bank.
This distinction is important. References to GXB's publicly observable products and operating characteristics are factual; proposed governance arrangements, Critical Business Services (CBS), resilience objectives, dependencies, scenarios and implementation approaches in this guide represent reasonable assumptions for educational and implementation purposes.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/82999100-d8aa-47ed-b3b7-b418c3698d2a)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng) Sep 29, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
##### [![\[BCM\] \[GEN\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/d633fe26-3ef8-41e5-99ae-667e110827df.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d633fe26-3ef8-41e5-99ae-667e110827df)
### eBook 1: Chapter 1
##### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/82999100-d8aa-47ed-b3b7-b418c3698d2a)
### Operational Resilience Case Study for GX Bank
#### Introduction
[![\[OR\] \[GEN\] \[E1\] \[C1\] Introducing OR Case Study](https://no-cache.hubspot.com/cta/default/3893111/509e23af-f220-4126-b68f-30a0d8acbd8a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/509e23af-f220-4126-b68f-30a0d8acbd8a)
For GX Bank Berhad (GXB), these considerations are particularly relevant because its operating model is fundamentally digital, with customers accessing banking services principally through the GXBank application rather than through a traditional branch network.
GXBank is a digital bank licensed and regulated by Bank Negara Malaysia (BNM).
Its publicly available services include digital savings accounts, Savings Pockets, DuitNow transfers and QR payments, debit-card services and FlexiCredit, supported by digital onboarding and 24/7 customer support.
This operating model provides the context for the case study developed throughout this eBook series. The purpose is not to assess GXB's actual internal resilience arrangements, which are not publicly available.
Instead, GXB serves as a practical case study to show how to design and implement an Operational Resilience framework for a Malaysian digital bank.
This distinction is important. References to GXB's publicly observable products and operating characteristics are factual; proposed governance arrangements, Critical Business Services (CBS), resilience objectives, dependencies, scenarios and implementation approaches in this guide represent reasonable assumptions for educational and implementation purposes.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/2726ae74-56b9-4cb7-9255-428edd7e2847)The case study is particularly relevant in light of BNM's **Operational Resilience Discussion Paper**, issued on 19 December 2025.
BNM describes an operating landscape characterised by greater digitalisation, complex interdependencies and increasingly frequent and severe operational disruptions.
The Discussion Paper focuses on strengthening the continuity of critical financial services rather than relying exclusively on conventional recovery arrangements.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/256138b3-f543-4034-ab3e-54d2b68380ef)
This chapter establishes the foundation for applying Operational Resilience to GXB.
Before detailed resilience activities can begin, the organisation needs to understand:
- the services it provides;
- the customers and stakeholders who depend upon those services;
- its operating and regulatory environment;
- the characteristics of its digital operating model;
- the major threats and vulnerabilities affecting service delivery;
- the internal and external dependencies supporting critical services;
- the governance arrangements required for Operational Resilience;
- the services that may warrant designation as Critical Business Services; and
- the resilience outcomes that the organisation ultimately intends to achieve.
The chapter therefore establishes the organisational context for subsequent Operational Resilience activities.
The underlying principle is straightforward:
Operational Resilience should begin with understanding the organisation and the services that matter, rather than beginning with individual systems, applications or recovery plans.
This is consistent with BNM's emerging direction.
The Discussion Paper states that financial institutions need to identify operations and services critical to consumers and the market, understand internal and external dependencies, establish disruption tolerances, and assess capabilities against severe-but-plausible scenarios.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6d07484c-bfdd-4a00-983b-8d2c54bad8e4)
#### **Understanding Your Organisation: GX Bank**
Understanding the organisation is one of the most important prerequisites for Operational Resilience.
A financial institution cannot determine what must remain resilient without first understanding what it delivers, who depends upon those services and what consequences could arise if those services become unavailable.
##### **Organisational Context**
GXB represents a different operating model from a conventional bank built around physical branches and established legacy infrastructure.
GXBank describes itself as Malaysia's first digital bank to receive approval from BNM and the Ministry of Finance to commence operations. It operates through a technology-centred banking model designed around digital delivery.
The bank's digital delivery model means that technology is not simply a supporting capability.
Technology is an integral component of the banking service itself.
For example, customers depend on digital capabilities to:
Access account → Authenticate → View funds → Initiate transaction → Authorise transaction → Process transaction → Receive confirmation
Disruption at any important point in this chain could affect the customer's ability to complete the intended financial activity.
This creates a strong case for examining resilience from an end-to-end service perspective rather than simply examining the availability of individual applications.
##### Customer Services
Based on publicly available information, GXB's customer service environment includes several significant areas.
Customers can maintain a GX Account and Savings Pockets, earn interest, transfer and receive money, and make DuitNow QR payments.
GXBank also provides debit card services. Its published information indicates that the GX Card can be used for payments and that customers can withdraw cash through ATMs operated by other banks in Malaysia.
FlexiCredit provides eligible customers with a line of credit through the GXBank mobile application. Approved customers can make multiple drawdowns within their available credit limit, with funds disbursed into their GX Account.
These services create several potential customer dependencies.
A customer may depend upon GXB to:
Store money → Access money → Transfer money → Receive money → Make payments → Withdraw cash → Access credit → Protect the account → Obtain assistance
Operational Resilience should consider the continuity of these outcomes, not simply the availability of the technology components supporting them.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c7280eb9-276d-4026-b846-5d0bbf497159)
#### **GXB's Operating Environment in Malaysia**
GXB operates within Malaysia's regulated financial sector under BNM oversight. GXBank states that it holds a digital bank licence from BNM and is also a member of Perbadanan Insurans Deposit Malaysia (PIDM).
##### **Regulatory Environment**
Operational Resilience should therefore not be developed as an isolated management programme.
It should integrate relevant existing disciplines and regulatory requirements relating to:
Operational Risk → BCM → Technology Risk → Cybersecurity → Third-Party Risk → Incident Management → Crisis Management → Operational Resilience
BNM explicitly recognises this relationship.
Its 2025 Discussion Paper notes that Malaysia already has complementary requirements covering Business Continuity Management, Risk Management in Technology (RMiT), Outsourcing, Operational Risk, Responsibility Mapping, Risk Governance and Corporate Governance.
BNM's emerging Operational Resilience direction is not intended to replace these requirements but to provide greater coherence around the outcome of maintaining critical financial services through disruption.
##### Digitalisation
Digitalisation creates both resilience advantages and resilience vulnerabilities.
Digital banking can provide:
- continuous service availability;
- rapid transaction processing;
- automation;
- scalability;
- reduced dependence on physical premises; and
- greater customer convenience
At the same time, it creates deeper reliance upon:
- mobile applications;
- digital identity;
- authentication;
- APIs;
- core banking systems;
- cloud and hosting environments;
- databases;
- telecommunications;
- payment infrastructure;
- cybersecurity controls; and
- external technology providers
BNM observes that mobile banking, electronic Know Your Customer, digital onboarding, QR payments, cloud-hosted financial applications, and API-based integration have become integral to financial-service delivery.
It also warns that these developments create complex dependency chains and greater sensitivity to service outages and software supply-chain vulnerabilities.
For a digital bank such as GXB, understanding these dependency chains should therefore be a core Operational Resilience activity.
##### Interconnected Financial Ecosystem
GXB does not deliver its customer services independently.
For example, GXBank participates in DuitNow services. Its published DuitNow terms cover the National Addressing Database, DuitNow Transfer and DuitNow QR services.
DuitNow QR itself is part of Malaysia's national payment ecosystem, enabling activities such as peer-to-peer transfers and merchant payments.
This illustrates an important Operational Resilience principle:
The boundary of a Critical Business Service often extends beyond the bank's organisational boundary.
GXB therefore needs to understand not only its internal systems but also external infrastructures and third parties required to deliver customer outcomes.
#### **Initial Operational Resilience Risk Understanding**
The case study should begin with a broad understanding of the disruption environment before undertaking detailed scenario analysis.
For GXB, relevant disruption categories could reasonably include:
| Disruption Category | Illustrative Event | Potential Consequence |
| --- | --- | --- |
| Cyber | Ransomware or destructive malware | Loss of availability or integrity across critical systems |
| Technology | Core banking failure | Customers unable to access balances or transact |
| Digital Channel | GX App outage | Multiple customer services simultaneously inaccessible |
| Authentication | Identity or transaction authentication failure | Customers unable to log in or authorise transactions |
| Data | Data corruption | Account or transaction information cannot be trusted |
| Payment Infrastructure | DuitNow or payment-network disruption | Transfers or payments delayed or unavailable |
| Card Infrastructure | Card processing/network failure | Debit-card transactions or ATM access disrupted |
| Cloud/Hosting | Major infrastructure outage | Multiple applications unavailable simultaneously |
| Third Party | Critical provider outage | Service interruption outside GXB's direct operational control |
| Telecommunications | Connectivity failure | Customers or systems unable to communicate |
| People | Significant workforce unavailability | Reduced incident-management or operational capability |
| Fraud | Large-scale credential compromise | Financial loss and surge in account-security activity |
| Physical/Environmental | Flood, power disruption or other major event | Staff, facilities, infrastructure or suppliers affected |
BNM's Discussion Paper specifically identifies cyber incidents, technology failures, third-party outages, compromised data and information assets, and power outages as examples that can cause widespread loss of access to essential financial services.
At this stage, the objective is not to quantify every risk. It is to recognise that disruption is inevitable and that GXB must maintain important services even when preventive controls fail.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/cce97ee9-af23-4c1c-a7e7-1270d2d7da56)
#### **Composition of an Operational Resilience Team for GX Bank**
The BCM function or technology function alone cannot implement Operational Resilience effectively.
Delivering a Critical Business Service may cross numerous organisational boundaries. GXB should therefore establish a cross-functional Operational Resilience Team.
A practical case-study structure could be:
BNM emphasises the importance of leadership and culture and expects boards and senior management to take ownership by ensuring critical operations and services are understood, adequately resourced, and supported by appropriate oversight across technology, operations, and risk.
##### **Proposed Operational Resilience Team**
| Role / Function | Principal Operational Resilience Responsibility |
| --- | --- |
| Board / Relevant Board Committee | Provide oversight and challenge; consider resilience within risk appetite and strategic decision-making. |
| Senior Management | Establish direction, priorities, accountability and resources. |
| Operational Resilience Steering Committee | Coordinate the enterprise Operational Resilience programme and resolve cross-functional issues. |
| Operational Resilience Programme Lead | Coordinate methodology, implementation, reporting, testing and continuous improvement. |
| CBS Owners | Remain accountable for the end-to-end resilience of assigned Critical Business Services. |
| Business / Product Owners | Provide service knowledge and identify customer and operational impacts. |
| Technology / Engineering | Identify application, infrastructure, architecture and recovery dependencies. |
| Cybersecurity | Integrate cyber threats, security controls and cyber-recovery considerations. |
| Operational Risk | Integrate risk identification, controls, risk appetite and operational-risk information. |
| Business Continuity Management | Integrate BIA, continuity strategies, recovery arrangements and exercises. |
| IT Disaster Recovery | Establish and validate technology recovery capabilities. |
| Third-Party / Outsourcing Risk | Identify critical external providers, concentration risks and contingency arrangements. |
| Compliance / Legal | Interpret applicable obligations and regulatory implications. |
| Fraud / Financial Crime | Address fraud scenarios and customer-protection considerations. |
| Customer Operations | Assess customer impacts, complaints, escalation and alternative servicing arrangements. |
| Crisis Management / Communications | Coordinate strategic response and internal, customer and stakeholder communications. |
| Internal Audit / Independent Assurance | Provide independent review of framework design and effectiveness. |
The composition should remain proportionate to GXB's actual organisational structure.
The key requirement is not the committee name, but clear accountability and effective cross-functional decision-making.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/166119c4-828b-4bdc-89ed-fb335170f89c)
#### **Critical Business Services of GXB: Key Considerations for Operational Resilience**
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/9f906ebc-f9d2-4053-9e6f-586799079049)
Operational Resilience begins with determining **what must remain resilient**.
Not every important process or system should automatically become a Critical Business Service.
Focus on services where disruption could create unacceptable harm to customers, stakeholders, or the wider financial system.
BNM similarly states that financial institutions should preserve the continuity of operations and services that are critical to customers and stakeholders, recognising that not all activities carry equal significance.
Based on the service analysis developed for this case study, the following preliminary CBS catalogue is proposed.
| Code | Proposed Critical Business Service |
| --- | --- |
| CBS-1 | Customer Deposit and Account Access |
| CBS-2 | Domestic Funds Transfer and Receipt |
| CBS-3 | DuitNow QR and Digital Payment |
| CBS-4 | Debit Card Payment |
| CBS-5 | Cash Access and Withdrawal |
| CBS-6 | Digital Banking Access and Transaction Authentication |
| CBS-7 | FlexiCredit Access, Drawdown and Servicing |
| CBS-8 | Customer Account Security and Fraud Protection |
| CBS-9 | Critical Customer Support During Disruption |
These services are proposed for case-study purposes and should not be interpreted as GXB's actual internally approved CBS catalogue.
Chapter 5 examines the identification and validation of these Critical Business Services in greater detail.
#### **Key Considerations for Operational Resilience**
Identification of the CBS creates a different perspective on resilience.
Consider **CBS-2 Domestic Funds Transfer and Receipt**.
The service could depend upon:
A conventional recovery assessment might evaluate each component separately.
Operational Resilience asks a broader question:
**Can the customer continue to achieve the required financial outcome within an acceptable level of disruption?**
This leads to five key implementation activities consistent with BNM's emerging direction:
**Identify Critical Services**
↓
**Map Internal and External Interdependencies**
↓
**Manage Critical Third-Party Dependencies**
↓
**Set Tolerances for Disruption**
↓
**Test Against Severe-but-Plausible Scenarios**
BNM specifically identifies these themes and notes that dependency mapping should encompass people, processes, data, technology, facilities, business units and external providers.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/e12b7140-d40d-4b7f-a231-17b3e65f28ef)Key Characteristics of GX Bank
Several characteristics of GXB's operating model should shape its Operational Resilience approach.
##### **Digital-First Delivery**
GXB delivers most banking services through digital channels. GXBank describes its model as app-based banking without the traditional requirement for branches or queues.
This means digital availability directly affects service availability.
##### **High Technology Dependency**
Technology forms part of the service delivery chain rather than merely supporting it.
Operational Resilience should therefore closely integrate business resilience with technology and cyber resilience.
##### **Real-Time Customer Expectations**
Digital customers expect access to funds and financial services when required.
BNM notes that consumer expectations for uninterrupted financial-service access have increased significantly, particularly where disruptions prevent consumers from accessing their funds or using real-time payments.
##### **Interconnected Service Delivery**
Payment infrastructure, telecommunications, card networks, external technology services and other providers may support end-to-end service delivery.
A failure outside GXB could therefore disrupt a GXB customer outcome.
##### **Common Dependency Risk**
Multiple CBS may rely on common components.
For example, an authentication failure could simultaneously affect account access, payments, transfers, credit access and account-security functions.
##### **Cyber Exposure**
The digital operating model increases the importance of cyber resilience, particularly against ransomware, destructive malware, credential compromise, supply-chain attacks and data-integrity incidents.
##### **Limited Physical Substitution**
Customers of a predominantly digital bank may have fewer physical service alternatives if primary digital channels become unavailable.
Alternative arrangements therefore need to be considered from the customer's perspective.
#### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/02078ee0-af93-4873-9644-67d0094f384f)Establishing Organisational Goals for GXB's Operational Resilience
The Operational Resilience programme should translate these characteristics into explicit organisational goals.
A proposed overarching goal for the case study is:
**GXB should be able to continue delivering its Critical Business Services within defined and approved impact tolerances during severe-but-plausible disruptions while protecting customers, maintaining confidence and meeting applicable regulatory obligations.**
This overarching goal translates into eight supporting objectives.
##### **Goal 1 — Protect Critical Customer Outcomes**
Maintain priority financial services customers need to access money, transfer funds, make payments, obtain cash, manage credit, and protect their accounts.
##### **Goal 2 — Understand End-to-End Dependencies**
Establish sufficient visibility of the people, processes, technology, information, facilities and third parties required to deliver each CBS.
##### **Goal 3 — Establish Impact Tolerances**
Define the maximum level of disruption that can be tolerated before unacceptable harm occurs.
These tolerances should complement rather than simply replicate existing RTOs and Maximum Tolerable Downtime measures.
BNM explicitly notes that traditional internal recovery metrics such as MTD and RTO remain necessary but may not be adequate because resilience also requires consideration of customer and stakeholder outcomes.
##### **Goal 4 — Test Severe-but-Plausible Disruptions**
Develop scenarios sufficiently severe to expose vulnerabilities while remaining credible.
Testing should consider concurrent and cascading failures, not only isolated technology outages.
BNM specifically states that isolated-failure testing is no longer sufficient and that scenario testing should incorporate severe-but-reasonably-plausible and concurrent events.
##### **Goal 5 — Strengthen Third-Party Resilience**
Identify critical external dependencies and understand:
- concentration risk;
- contractual arrangements;
- service-level expectations;
- provider recovery capability;
- alternative arrangements;
- substitutability; and
- exit strategies.
##### **Goal 6 — Integrate Existing Resilience Disciplines**
Operational Resilience should connect:
**Operational Risk + BCM + ITDR + Cybersecurity + Third-Party Risk + Incident Management + Crisis Management**
rather than creating another independent management silo.
##### **Goal 7 — Strengthen Governance and Decision-Making**
Ensure the Board, Senior Management and CBS owners receive meaningful information about vulnerabilities, impact tolerances, scenario-testing results and remediation priorities.
##### **Goal 8 — Establish Continuous Improvement**
Lessons from:
**Incidents → Near Misses → Exercises → Scenario Tests → Audit → Regulatory Review**
should feed into:
**Lessons Identified → Remediation → Validation → Improved Resilience**
BNM describes Operational Resilience as a continuous journey that requires institutions to learn from disruptions and near misses and periodically update testing, processes, architecture, and governance
#### **Initial Assumptions for the GXB Case Study**
Because this guide does not have access to GXB's confidential operating arrangements, several assumptions are necessary.
For purposes of subsequent chapters, the case study assumes that:
1. GXB operates a technology-intensive digital banking environment.
2. Multiple Critical Business Services share common technology dependencies.
3. External payment and financial infrastructure forms part of the end-to-end delivery chain.
4. Third-party technology and telecommunications providers may support critical service delivery.
5. Customer access to banking services is primarily digital.
6. Cybersecurity and data integrity are fundamental to service continuity.
7. Existing BCM, ITDR, operational-risk, cybersecurity, and incident-management capabilities can be integrated into Operational Resilience.
8. GXB establishes accountable owners for each approved CBS.
9. An appropriate governance process approves impact tolerances.
10. Scenario testing includes severe-but-plausible combinations of business, technology, cyber and third-party failures.
These assumptions provide a consistent foundation for the implementation examples used throughout the eBook.
#### **The Operational Resilience Implementation Journey**
The case study should ultimately move GXB through three broad phases:
 This approach recognises that Operational Resilience is not a project that concludes after producing a framework or completing a scenario exercise.
The intended outcome is a sustainable organisational capability.
**[![Banner \[Summing\] \[OR\] \[E1\] \[C1\] Introducing OR Case Study](https://no-cache.hubspot.com/cta/default/3893111/d2e2c339-9a7d-496d-924a-d75107cf7afe.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d2e2c339-9a7d-496d-924a-d75107cf7afe)**
GXB provides a useful case study for understanding Operational Resilience in a highly digital financial institution.
Its customer-facing model depends upon continuous interaction among banking processes, digital applications, authentication mechanisms, payment infrastructure, data, telecommunications, cybersecurity capabilities and external providers.
The central lesson from this chapter is therefore that Operational Resilience should not begin with individual systems or recovery plans.
It begins by understanding **the organisation, its operating environment, its customers, the services customers depend upon and the ecosystem required to deliver those services**.
BNM's December 2025 Discussion Paper reinforces this direction.
It describes Operational Resilience as the ability of critical operations and services to withstand disruption within acceptable and tolerable levels under severe-but-plausible scenarios.
It emphasises preserving critical services, mapping dependencies, managing third-party dependencies, setting disruption tolerances, scenario testing, strong governance, and continuous improvement.
For the GXB case study, nine preliminary Critical Business Services have been identified, ranging from customer deposits and account access to payments, transfers, card and cash services, credit, account security, and critical customer support.
These services provide the anchor around which the remainder of the Operational Resilience programme can be constructed.
With this organisational foundation established, the next chapter can examine **GXB's operating environment in greater depth**, identifying the internal and external conditions, stakeholders, technology dependencies, regulatory expectations and emerging threats that influence how resilience should be designed.
This moves the case study from understanding **who GXB is and what must remain resilient** toward understanding **the environment in which those critical services must continue to operate**.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/3aefb2d2-3110-47c1-ad4f-d3e6e5381066)
Blogs marked \[x\] are under construction
[![x \[OR\] \[GEN 1\] \[3/4 Banner\] Implementing Operational Resilience](https://no-cache.hubspot.com/cta/default/3893111/79404147-12eb-4e20-a39e-50e36094b57a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/79404147-12eb-4e20-a39e-50e36094b57a)
| ##### Understanding Your Organisation | | | | | | |
| --- | --- | --- | --- | --- | --- | --- |
| **C1** | **C2 \[x\]** | **C3 \[x\]** | **C4 \[x\]** | **C5** | | |
| [![\[OR\] \[GEN\] \[E1\] \[C1\] Introducing OR Case Study](https://no-cache.hubspot.com/cta/default/3893111/509e23af-f220-4126-b68f-30a0d8acbd8a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/509e23af-f220-4126-b68f-30a0d8acbd8a) | [![\[OR\] \[GEN\] \[E1\] \[C2\] Understanding Your Organisation](https://no-cache.hubspot.com/cta/default/3893111/ced1bdb4-c85e-4ebe-8878-082aea79ef6a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/ced1bdb4-c85e-4ebe-8878-082aea79ef6a) | [![\[OR\] \[GEN\] \[E1\] \[C3\] Examining Operating Environment](https://no-cache.hubspot.com/cta/default/3893111/cc870a30-329c-416c-bda9-ffd799be3d62.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/cc870a30-329c-416c-bda9-ffd799be3d62) | [![\[OR\] \[GEN\] \[E1\] \[C4\] Composing the OR Team](https://no-cache.hubspot.com/cta/default/3893111/695d257f-c746-48a6-a463-26b3b6a8a7d1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/695d257f-c746-48a6-a463-26b3b6a8a7d1) | [![\[OR\] \[GEN\] \[E1\] \[C5\] Identifying Critical Business Services](https://no-cache.hubspot.com/cta/default/3893111/d7ffb74d-3b48-4a81-b2f1-5e4d6724c804.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d7ffb74d-3b48-4a81-b2f1-5e4d6724c804) | | |
| **C6 \[x\]** | **C7 \[x\]** | **C8 \[x\]** | **C9 \[x\]** | **eBook Cover** | | |
| [![\[OR\] \[GEN\] \[E1\] \[C6\] Analysing Key Characteristics](https://no-cache.hubspot.com/cta/default/3893111/312be1e5-fa5e-40cd-ae3b-55f729092d4a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/312be1e5-fa5e-40cd-ae3b-55f729092d4a) | [![\[OR\] \[GEN\] \[E1\] \[C7\] Establishing Organisational Goals for Operational Resilience](https://no-cache.hubspot.com/cta/default/3893111/36ee9cb1-b726-4615-ad89-cfdebc4ecbf4.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/36ee9cb1-b726-4615-ad89-cfdebc4ecbf4) | [![\[OR\] \[GEN\] \[E1\] \[C8\] Summary](https://no-cache.hubspot.com/cta/default/3893111/24dde137-e587-4125-ac61-a0b0577d1f61.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/24dde137-e587-4125-ac61-a0b0577d1f61) | [![\[OR\] \[GEN\] \[E1\] \[C9\] \[Back Cover\] OR](https://no-cache.hubspot.com/cta/default/3893111/e234eb57-ece8-484b-8ab0-96f336d8396d.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/e234eb57-ece8-484b-8ab0-96f336d8396d) | [![eBook Cover \[OR\] \[GEN\] \[E1\] \[2D\] ](https://no-cache.hubspot.com/cta/default/3893111/2f556b8b-e5f1-4aea-b053-95b4a7a17aec.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2f556b8b-e5f1-4aea-b053-95b4a7a17aec) | | |
| | | | | | | |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/309c3a80-4c3c-4eb9-811d-bd401ccb1610)Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng"
},
"dateModified" : "2026-09-29T06:37:17.009Z",
"datePublished" : "2026-09-29T03:36:40.000Z",
"headline" : "[OR] [GXB] [E1] [C1] Introducing OR Case Study",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-gxb-e1-c1-introducing-or-case-study",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```