[OR] [GXB] [E1] [C5] Identifying Critical Business Services

Chapter 5

Identifying Critical Business Services for GX Bank Berhad

Introduction

Operational resilience requires a financial institution to look beyond recovering individual systems, departments, or business processes and focus instead on the services and outcomes that matter most to customers and the wider financial ecosystem.

For GX Bank Berhad (GXB), this service-oriented perspective matters because the bank operates predominantly through digital channels.

Customer access to deposits, payments, transfers, debit-card services, credit facilities, security controls, and support, therefore, depends on a highly interconnected combination of applications, technology infrastructure, payment networks, data, people, processes, and third parties.

Bank Negara Malaysia (BNM) licenses and regulates GXBank as a digital bank. Its publicly available service information shows a digitally centred operating model that includes GX Accounts and Savings Pockets, DuitNow transfers and QR payments, GX debit-card services, ATM cash access, FlexiCredit and 24/7 customer support.

Identifying Critical Business Services (CBS) is therefore a foundational activity in GXB's Operational Resilience programme. It establishes which end-to-end services should receive enhanced resilience attention and subsequently become the subjects of dependency mapping, impact tolerance setting, severe-but-plausible scenario testing, remediation, and ongoing assurance.

This chapter proposes a practical initial catalogue of CBS for GXB. The catalogue is not intended to represent an approved internal GXBank classification.

Rather, it provides an operational resilience implementation baseline derived from the bank's observable customer services, the BCM Institute Operational Resilience Planning Methodology, and the regulatory direction established by BNM's 2025 Discussion Paper on Operational Resilience.

What Is a Critical Business Service?

A Critical Business Service is best understood from the perspective of the outcome delivered to the customer rather than the individual organisational unit, application or process responsible for delivering it.

The BCM Institute definition describes a Critical Business Service as a service provided by an organisation, or by another party on its behalf, where disruption could cause intolerable harm to clients or pose a risk to the soundness, stability, or resilience of the relevant industry or financial system.

This distinction is fundamental.

A CBS should generally describe what the customer needs the bank to deliver, not merely the resources used to deliver it. For example:

Customer outcome:

A customer can access money held with GXB and make an urgent payment.

Critical Business Service:

Digital Funds Transfer and Payment.

Supporting components:

GX App, authentication services, core banking platform, APIs, telecommunications, databases, cybersecurity controls, DuitNow connectivity, PayNet services, cloud infrastructure, operational teams, and third-party providers.

Supporting components may be operationally critical, but they should not automatically be classified as separate CBS.

Instead, they are mapped as interconnections and interdependencies that support the end-to-end service.

This service-based approach prevents GXB from producing a CBS inventory consisting simply of departments, IT applications, or conventional business continuity functions.

CBS versus Critical Business Function

This distinction is also important when integrating Operational Resilience with Business Continuity Management (BCM).

A Critical Business Function (CBF) normally identifies an activity, process or organisational function that needs to be recovered following disruption.

A Critical Business Service, by contrast, represents the end-to-end outcome being delivered to a customer or other external stakeholder.

Operational resilience, therefore, changes the principal question from:

"Which department or system must we recover?"

to:

"Which customer service must continue, and what people, processes, technology, information and third parties are required to keep that service within an acceptable level of disruption?"

This service-centric perspective is central to the BCM Institute Operational Resilience Planning Methodology.

Once CBSs are identified, the subsequent implementation stages map dependencies, establish impact tolerances, test them against severe-but-plausible scenarios, and use lessons learned to improve resilience.

Key Considerations for Identifying CBS at GXB

GXB should not designate every product, process, or digital feature as a Critical Business Service. Doing so would dilute management attention and make meaningful resilience prioritisation difficult.

Instead, GXB should evaluate candidate services using consistent criticality criteria.

Potential for Customer Harm

The first consideration is the consequence to customers if the service becomes unavailable.

GXB should consider whether disruption could prevent customers from:

• accessing money needed for essential expenditure;
• receiving funds;
• transferring money;
• making payments;
• withdrawing cash;
• servicing credit obligations;
• securing an account following suspected fraud; or
• obtaining urgent assistance during a banking disruption.

The assessment should consider not only the number of affected customers but also the nature, severity and duration of harm.

A relatively small number of customers could still experience significant harm if they cannot access funds required for urgent financial needs.

Digital Dependency

As a digital bank, GXB depends heavily on the continuous availability of its digital service environment.

GXBank describes its model as app-based banking without traditional branch dependency, with digital onboarding, banking functionality and customer support delivered through digital channels.

A prolonged mobile application, authentication, core banking, API, network or cloud-related disruption could therefore affect several customer services simultaneously.

This creates an important operational resilience distinction:

The GX App itself is not necessarily the CBS.

Instead, it is a major shared dependency supporting several CBS.

This distinction matters for dependency mapping because a failure in one common technology component could simultaneously affect account access, payments, transfers, debit-card controls, and lending services.

Transaction Volume and Customer Reliance

Services used frequently or relied upon for routine financial activity deserve particular consideration.

For example, customers can use GXBank services to transfer money, receive funds and make DuitNow QR payments. GX Card provides payment functionality and cash access through ATM networks.

GXB should therefore examine transaction volumes, peak transaction periods, customer usage patterns and the availability of practical alternatives when determining whether disruption could become intolerable.

Financial-System and Payment-System Interconnections

GXB does not operate independently.

Its services connect to external financial infrastructure, payment networks, banks, merchants, technology providers and other counterparties.

DuitNow QR, for example, is part of Malaysia's national payment ecosystem and operates under the interoperable payment framework.

Disruption may therefore extend beyond GXB's own customers.

When identifying CBS, the bank should consider whether failure could:

• interrupt transactions with other financial institutions;
• create payment backlogs;
• cause reconciliation problems;
• disrupt merchant payments;
• affect settlement activities; or
• contribute to wider loss of confidence in digital financial services.

Regulatory and Legal Obligations

A candidate CBS should also be assessed against the obligations associated with operating a regulated financial institution.

The CBS identification process should consider relevant BNM requirements and expectations concerning areas such as:

• operational resilience;
• technology risk;
• cybersecurity;
• payment services;
• customer information;
• outsourcing and third-party arrangements;
• operational risk;
• business continuity;
• incident management; and
• fair treatment of financial consumers.

The objective is not to classify every regulatory activity as a CBS. Compliance, risk management and internal audit, for example, are generally important supporting or governance functions, rather than customer-facing CBS.

Substitutability

Another important question is:

Can customers reasonably obtain the required outcome elsewhere during the disruption?

The existence of an alternative does not automatically mean a service is non-critical.

For example, customers may hold accounts with another bank, but this does not necessarily help customers whose money is held in their GX Account and who cannot access or transfer those funds during a prolonged disruption.

GXB should therefore assess practical substitutability from the customer's perspective rather than assume that alternative financial providers remove the potential for harm.

Concentration and Common Dependencies

Digital operating models can create significant concentration risk because several services may depend upon the same:

• mobile application;
• authentication mechanism;
• core banking platform;
• cloud environment;
• telecommunications connectivity;
• data repository;
• API gateway;
• cybersecurity service;
• payment infrastructure; or
• third-party technology provider.

This means the CBS identification process should eventually be followed by end-to-end mapping to identify common dependencies and potential single points of failure.

Proposed Critical Business Services for GXB

Based on GXB's current publicly observable customer service model, the following CBS catalogue provides a practical starting point for its Operational Resilience programme.

The services have deliberately been expressed as customer outcomes rather than internal systems or organisational functions.

GXB should then validate this proposed catalogue through a formal Business Services Impact Analysis (BSIA) involving business owners, technology, operations, cyber security, risk, compliance, BCM, third-party risk management, and other relevant stakeholders.

The validation exercise may result in some services being consolidated, decomposed into Sub-CBS, or reclassified as supporting services.

Understanding the Relationship Between the Proposed CBS

Do not treat the proposed CBS as nine independent silos.

They form an interconnected service ecosystem.

For example, a customer attempting to make an urgent payment may depend upon:

Customer Deposit and Account Access → Digital Banking Access and Authentication → Domestic Funds Transfer or Digital Payment → External Payment Infrastructure

Similarly:

Customer Deposit and Account Access → Debit Card Payment → Card Network / Merchant Infrastructure

or:

Customer Deposit and Account Access → GX Card → ATM Network → Cash Access

This demonstrates why operational resilience requires more than conventional application recovery.

A disruption affecting a common authentication service, cloud environment, core banking platform or connectivity provider could potentially affect several CBS simultaneously.

From CBS to Sub-CBS

Once GXB has approved its CBS catalogue, each service should be decomposed into manageable Sub-Critical Business Services (Sub-CBS) or service components.

For example, CBS-2 Domestic Funds Transfer and Receipt could potentially include:

Decomposition is not simply to document processes. It establishes sufficient granularity to identify where disruption can occur and which resources are required to deliver the end-to-end customer outcome.

The next stage of the Operational Resilience Planning Methodology can then map the required:

People → Processes → Technology → Information → Facilities → Third Parties

against each CBS and Sub-CBS.

Example Severe-but-Plausible Scenarios Affecting GXB CBS

CBS identification becomes operationally useful when GXB asks a further question:

What could prevent this service from being delivered, and how long could the disruption continue before the resulting impact becomes unacceptable?

A range of severe-but-plausible scenarios should therefore be considered.

These scenarios should eventually be tested against approved impact tolerances rather than simply against conventional system recovery objectives.

A scenario test should therefore determine whether GXB can continue delivering the CBS within the maximum acceptable level of disruption even when several supporting resources fail concurrently.

Particular Considerations for a Digital Bank

GXB's operating model introduces several characteristics that should receive particular attention when identifying CBS.

Digital Channel Concentration

The mobile banking environment is a gateway to numerous customer services. A single channel failure can therefore propagate across multiple CBS.

Shared Technology Dependencies

Common services such as identity management, authentication, APIs, cloud infrastructure, databases and cybersecurity controls can create concentration risk.

External Ecosystem Dependencies

Payment networks, card networks, telecommunications providers, cloud and technology service providers may form part of the end-to-end delivery chain.

Cyber Resilience

Cyber incidents may affect confidentiality, integrity and availability simultaneously. Scenario design should therefore go beyond conventional infrastructure outages.

Data Integrity

Restoring an application does not necessarily restore the CBS if transaction records, balances or customer data cannot be trusted.

Limited Physical Substitution

A digital bank may have fewer physical alternatives for customers when primary digital channels become unavailable. Alternative service arrangements should therefore form an important part of resilience planning.

These characteristics reinforce why GXB should map CBS end-to-end, rather than relying solely on individual system availability or IT Disaster Recovery metrics.

Regulatory Alignment with Bank Negara Malaysia

BNM issued its Discussion Paper on Operational Resilience in December 2025 as part of its developing regulatory approach to strengthening Malaysian financial institutions' ability to withstand operational disruption.

BNM subsequently noted that the Discussion Paper was intended to surface regulatory considerations concerning financial institutions' operational resilience posture and practices.

For GXB, the practical implication is that operational resilience should be approached as an enterprise capability rather than simply as an extension of Business Continuity Management or IT Disaster Recovery.

The direction of the BNM framework places importance on maintaining critical financial services through disruption, supported by governance, understanding of dependencies, and the ability to respond, recover and adapt under severe conditions.

The proposed CBS identification process supports this regulatory direction in several ways.

The BNM Discussion Paper should therefore be viewed together with other applicable regulatory requirements rather than as a standalone resilience initiative.

In particular, GXB should ensure its Operational Resilience framework integrates applicable technology-risk, cybersecurity, operational-risk, business-continuity, outsourcing, payment and customer-protection requirements.

Governance of the CBS Catalogue

CBS identification should not be treated as a one-time workshop.

GXB should establish a controlled CBS Register containing, at a minimum:

• CBS code and name;
• CBS description;
• customer or stakeholder served;
• defined service outcome;
• CBS owner;
• rationale for criticality;
• potential customer harm;
• financial and regulatory impact;
• key Sub-CBS;
• principal dependencies;
• third-party dependencies;
• impact tolerance;
• relevant recovery objectives;
• severe-but-plausible scenarios;
• testing status;
• identified vulnerabilities;
• remediation actions; and
• date of last management review.

Each CBS should have an accountable Business Service Owner with sufficient authority to coordinate across the organisational boundaries involved in delivering the service.

This is particularly important because end-to-end service ownership may span technology, operations, product, cyber security, risk management, and external providers.

The catalogue should also be reviewed whenever there is a material change to GXB's products, technology architecture, outsourcing arrangements, payment connectivity, customer base or operating model.

Practical CBS Identification Test for GXB

Before approving a candidate, CBS management can apply a simple service test.

For each proposed service, ask:

Who receives the service?

What outcome does the customer depend upon?

What happens to the customer if the service stops?

How does the impact increase as the disruption continues?

Could the disruption affect other financial institutions, payment infrastructure or market confidence?

Are reasonable substitutes available to the customer?

Which other GXB services depend upon the same resources?

Would Senior Management consider prolonged loss of this service unacceptable?

If the answers demonstrate potentially intolerable customer, regulatory, financial or systemic consequences, the service is a strong candidate for designation as a CBS.

Identifying Critical Business Services establishes the operational foundation for GXB's Operational Resilience programme.

The objective is not to classify every important application, department or process as critical. It is to identify the customer and financial-service outcomes whose disruption could produce unacceptable consequences and then manage resilience around those outcomes.

For GXB, a practical initial catalogue comprises Customer Deposit and Account Access; Domestic Funds Transfer and Receipt; DuitNow QR and Digital Payment; Debit Card Payment; Cash Access and Withdrawal; Digital Banking Access and Transaction Authentication; FlexiCredit Access, Drawdown and Servicing; Customer Account Security and Fraud Protection; and Critical Customer Support During Disruption.

This catalogue should now undergo internal validation and formal governance.

Once approved, each CBS can be decomposed into Sub-CBS and mapped across its people, processes, technology, information, facilities and third-party dependencies.

This step matters beyond documentation. It changes the resilience question from "Can GXB recover its systems?" to "Can GXB continue delivering the financial services that its customers depend upon when a severe disruption occurs?"

That service-centric perspective bridges to the next stages of operational resilience implementation: mapping interconnections and interdependencies, setting impact tolerances, conducting severe-but-plausible scenario testing, and implementing improvements based on the weaknesses identified.

Through this progression, GXB can develop an Operational Resilience programme that is practical for a digital banking environment and aligned with Bank Negara Malaysia's evolving supervisory direction.

The proposed nine-CBS catalogue is intentionally at the enterprise-service level; the next logical step is to develop the Sub-CBS catalogue for CBS-1 Customer Deposit and Account Access, which can then become the basis for mapping, impact tolerance, and scenario-testing chapters.

Blogs marked [x] are under construction

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.