[OR] [LBP] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Critical Business Services of Land Bank of the Philippines (LBP) for Operational Resilience

Introduction

  Critical Business Service (CBS) is a service delivered to customers or external stakeholders that, if disrupted, could cause intolerable harm to customers or threaten the soundness, stability, or orderly functioning of the financial system.

The BCM Institute’s guidance also emphasises identifying CBS through an end-to-end service lens, supported by impact analysis, dependency mapping, stakeholder engagement, and documentation of recovery requirements.

For Philippine banks, BSP Circular No. 1203 requires BSFIs to strengthen resilience of their critical operations by identifying them, setting tolerances for disruption, mapping interconnections and interdependencies, addressing third-party risks, and testing delivery under severe but plausible scenarios.

The Board is expected to review and approve the criteria for identifying critical operations and the tolerance for disruption.

For Land Bank of the Philippines (LANDBANK), the most appropriate CBS should reflect its nature as a government bank, its role as the official depository bank of the National Government, its support for rural development and financial inclusion, and its delivery of banking services through physical and digital channels.

LANDBANK publicly highlights its role in serving farmers, fishers, government, communities, remittance users, and digital banking customers, including services through iAccess, the mobile banking app, remittance offerings, cash cards, and government-linked disbursement channels.

What is a ‘Critical Business Service’?

A service should generally be classified as critical when prolonged disruption would likely:

• materially harm retail or corporate customers,
• impair access to money, deposits, payments, or credit,
• disrupt market or liquidity activities,
• create contagion across interconnected institutions or payment systems, or
• threaten regulatory compliance and the bank’s safe and sound operation.

In practice, a bank should distinguish between:

• business services delivered to customers or the market,
• underpinning services such as IT, facilities, and third parties, and
• internal activities that support delivery but are not themselves the CBS presented to the regulator.

Understanding Critical Business Services (CBS)

A Critical Business Service is a service whose disruption would cause material harm to customers, financial stability, or the institution itself. Regulators require institutions to identify these services, define tolerance for disruption, and ensure they can continue during severe but plausible scenarios.

Proposed Critical Business Services for Land Bank of the Philippines (LBP)

The table below presents a practical CBS inventory for LANDBANK's operational resilience.

This is not an official LANDBANK regulatory filing; it is a recommended implementation view derived from LANDBANK’s public mandate, product/service profile, and BSP Circular No. 1203

Recommended Prioritisation for LANDBANK

For implementation purposes, LANDBANK should usually start with the following highest-priority CBS:

• Government Collections and Disbursements
• Payments, Fund Transfers, and Cash Access
• Deposit and Account Services
• Digital Banking and Remote Customer Channel Access
• Remittance and Funds Delivery Services

These should be prioritised first because they combine three characteristics: high customer dependence, high transaction- or time-sensitivity, and significant public-sector or system-wide consequences if disrupted.

That prioritisation is consistent with the BCM Institute’s end-to-end service view and BSP’s emphasis on critical operations, disruption tolerance, mapping, and severe-but-plausible scenario testing.

Regulatory Requirements Under BSP Circular No. 1203 Relevant to CBS Identification

Once LANDBANK identifies its CBS, BSP Circular No. 1203 points to several operational resilience requirements that must be followed.

Identify Critical Operations

The BSP requires BSFIs to identify operations critical to customers, the institution, and the broader financial system. The operational risk management function should help identify vulnerabilities affecting those critical operations.

Example for LANDBANK:

If LANDBANK determines that government disbursement services and retail payments/fund transfers are critical operations, those services must become the primary scope for resilience planning, recovery design, and oversight.

Set Tolerance for Disruption

The BSP requires BSFIs to set clearly defined tolerances for disruption, including at a minimum a time-based metric, and possibly other metrics such as the number of customers affected or transaction values affected.

Example for LANDBANK:

For Payments, Fund Transfers, and Cash Access, LANDBANK may define a tolerance such as:

• maximum service outage duration,
• maximum number of failed beneficiary payments,
• maximum transaction backlog allowed before harm becomes material.

Board Approval and Oversight

The BSP states that the criteria for identifying critical operations and setting tolerance for disruption should be reviewed, challenged, and approved by the Board of Directors.

Example for LANDBANK:

The Board should approve the rationale for classifying Government Collections and Disbursements as a top-tier CBS and confirm the disruption thresholds that management must monitor.

Map Interconnections and Interdependencies

The BSP’s self-assessment appendix asks whether the BSFI has mapped the interconnections and interdependencies among critical operations and identified the resources and roles that support them.

Example for LANDBANK:

For Digital Banking and Remote Customer Channel Access, mapping should include:

• mobile and internet banking platforms,
• core banking systems,
• telecom/network providers,
• cybersecurity controls,
• branch fallback procedures,
• customer support teams,
• third-party technology and payment interfaces.

Manage Third-Party Risks

The BSP states that third-party arrangements affecting critical operations must specify how critical operations will be maintained during disruption, including possible substitutes or bringing the service back in-house where needed.

Example for LANDBANK

If a third party supports card processing, mobile app hosting, or remittance connectivity, LANDBANK should assess substitutes, fallback arrangements, exit options, and contractual resilience obligations.

Determine Severe but Plausible Scenarios

The BSP requires identification of a broad set of severe but plausible scenarios relevant to the institution’s risk profile and operations.

Example for LANDBANK

Relevant scenarios could include:

• nationwide payments outage,
• ransomware affecting digital banking,
• Telecom disruption affecting provincial branches and agents,
• third-party service provider failure,
• surge in government subsidy disbursement volumes during a crisis,
• data centre disruption affecting account access and payment processing.

Integrate BCM and Testing

The BSP states that business continuity management, including the BCP, should be integrated into the operational resilience framework, with BIAs, recovery strategies, incident recovery plans, communication, crisis management, and periodic exercises.

Example for LANDBANK

For Government Collections and Disbursements, LANDBANK should test whether it can continue or restore service within tolerance using alternate channels, manual workarounds, communication plans, and crisis decision-making arrangements.

Practical Example: How LANDBANK Could Frame a CBS

A good CBS statement should describe the service delivered externally, not just the internal function.

Weak statement:

“Core banking system operations”

Better CBS statement:

“Deposit and Account Services for retail, institutional, and government customers”

Weak statement:

“IT payment switch”

Better CBS statement:

“Payments, Fund Transfers, and Cash Access”

This aligns with BCM Institute guidance that regulators want visibility of the business service, while underpinning services and internal services are mapped underneath rather than being presented as the CBS itself.

 For the Land Bank of the Philippines, the most defensible CBS set for operational resilience would centre on deposit/account services, payments and transfers, government collections and disbursements, digital banking access, remittance/funds delivery, card-based disbursement services, priority-sector lending, and treasury/liquidity support.

These are the services most likely to cause intolerable harm to customers, the public sector, or the system if disrupted.

Under BSP Circular No. 1203, identifying CBS is only the starting point.

LANDBANK must then set tolerances, map dependencies, address third-party vulnerabilities, test severe-but-plausible scenarios, and integrate BCM and recovery planning to ensure these critical services can continue or be restored quickly during a disruption.

Blogs marked [x] are under construction.