[OR] [MAS] [E2] [C2] Identifying Critical Business Services (CBS)

eBook 2: Chapter 2

 Identifying Critical Business Services (CBS)

What is a Critical Business Service (CBS)?

A Critical Business Service is defined as:

An end-to-end service provided to external customers or stakeholders, where disruption would result in intolerable harm to customers, financial markets, or the institution itself.

This definition reinforces three important principles:

• Service-Oriented: Focuses on outcomes delivered, not internal processes
• End-to-End: Covers the entire delivery chain, including dependencies
• Impact-Driven: Determined by the severity of disruption consequences

Examples of services (not processes) include:

• Processing customer payments
• Providing access to digital banking platforms
• Executing securities transactions

👉 A CBS is not:

• A department (e.g., IT, Operations)
• A system (e.g., core banking system)
• A process (e.g., account reconciliation)

Instead, it represents the complete service the customer experiences.

Criteria for Identifying CBS

The identification of CBS must be grounded in clear, measurable criteria. The BCM Institute and MAS guidance highlight two primary dimensions:

Customer Impact

This criterion evaluates whether, in the event of a service disruption, a service is disrupted.

Key considerations include:

• Number of customers affected
• Vulnerability of customers (e.g., retail vs institutional)
• Criticality of service usage (daily banking vs occasional use)
• Ability of customers to access alternatives

Examples:

• A disruption to digital banking access affects a large number of customers immediately
• A failure in payment processing may prevent customers from meeting financial obligations

👉 High customer impact = Strong candidate for CBS

Financial and Systemic Impact

This criterion evaluates the broader consequences on the institution and financial system.

Key considerations include:

• Financial losses (direct and indirect)
• Liquidity and funding implications
• Impact on financial market stability
• Interconnectedness with other institutions

Examples:

• Failure in interbank payment systems may trigger systemic risks
• Disruption in trade settlement services can affect market confidence

👉 High systemic impact = Strong candidate for CBS

Additional Supporting Criteria

While customer and systemic impact are primary, organisations should also consider:

• Regulatory obligations
• Legal and compliance implications
• Reputational damage
• Time sensitivity of the service

These factors help refine and validate CBS selection.

MAS Expectations on Service Continuity

The Monetary Authority of Singapore requires financial institutions to adopt a service-centric resilience approach, with CBS identification forming the foundation.

Key Regulatory Expectations

MAS expects institutions to:

• Identify Critical Business Services
• Based on customer and systemic impact

• Define Impact Tolerances
• Maximum tolerable disruption (time, data loss, service degradation)

• Ensure Continuous Delivery
• Even during severe but plausible disruptions

• Perform End-to-End Mapping
• Including dependencies on technology and third parties
  

• Conduct Scenario Testing
• To validate CBS resilience

From BCM to Operational Resilience

Traditional BCM focuses on:

• Recovery of systems and processes

Operational resilience expands this to:

• Sustaining service delivery within acceptable thresholds

This shift means:

• Success is not just recovery
• Success is maintaining continuous service availability within impact tolerance

Service Continuity as a Regulatory Outcome

MAS emphasises that institutions must demonstrate:

• Ability to continue delivering CBS during disruptions
• Capability to prioritise resources toward critical services
• Evidence that customer outcomes are protected

👉 CBS identification is therefore not optional—it is the foundation of regulatory compliance.

Principles for Identifying CBS

Based on BCM Institute’s methodology, organisations should apply the following principles:

Service-Centric Perspective

Focus on external outcomes, not internal activities.

End-to-End Coverage

Consider the entire delivery chain, including:

• Front-end channels
• Back-end processing
• Third-party providers

Impact-Based Prioritisation

Use objective criteria to assess impact rather than subjective judgment.

Cross-Functional Collaboration

Engage:

• Business units
• IT
• Risk and compliance
• Operations

Dynamic Review

CBS identification must be:

• Reviewed regularly
• Updated based on changes in business, technology, or risk landscape

Methodology for Identifying CBS

The BCM Institute outlines a structured methodology aligned to [OR-P2-S1]:

Step 1: Define Business Services

• List all services delivered to customers
• Group them into logical service categories

Step 2: Assess Impact

• Evaluate each service against:
• Customer impact
• Financial/systemic impact

Step 3: Apply Thresholds

• Determine which services exceed defined impact thresholds

Step 4: Validate with Stakeholders

• Conduct workshops with:
• Business owners
• Risk and compliance teams
• Senior management

Step 5: Finalise CBS List

• Obtain formal approval
• Document CBS definitions clearly

👉 Output: A prioritised list of Critical Business Services.

Examples of Critical Business Services

In the context of Singapore’s financial institutions, common CBS include:

Payments and Funds Transfer Services

• Domestic and cross-border payments
• Real-time payment systems
• Corporate payment processing

Impact:

• Immediate customer disruption
• Potential systemic financial instability

Digital Banking Services

• Mobile and online banking platforms
• Customer account access and transactions

Impact:

• High customer dependency
• Reputational and regulatory consequences

Deposit and Account Services

• Account opening and maintenance
• Deposits and withdrawals
• Balance and statement services

Impact:

• Core banking functionality
• Essential for financial inclusion

Lending and Credit Services

• Loan disbursement
• Credit line management

Impact:

• Economic and customer financial impact

Trading and Investment Services

• Securities trading
• Wealth management platforms

Impact:

• Market integrity and investor confidence

Key Challenges in Identifying CBS

Organisations often face the following challenges:

• Confusing processes with services
• Over-identification (everything becomes “critical”)
• Lack of clear impact metrics
• Organisational silos limiting visibility
• Insufficient senior management engagement

Addressing these challenges requires:

• Strong governance
• Clear methodology
• Cross-functional collaboration

Identifying Critical Business Services (CBS) is the cornerstone of operational resilience.

It shifts the organisation’s focus from internal recovery processes to protecting what truly matters—customer outcomes and financial stability.

Aligned with the expectations of the Monetary Authority of Singapore and grounded in the BCM Institute’s structured methodology, CBS identification enables organisations to:

• Prioritise resilience investments effectively
• Understand and manage critical dependencies
• Define meaningful impact tolerances
• Demonstrate regulatory compliance

Ultimately, a well-defined set of CBS ensures that organisations are not just prepared to recover from disruptions but also capable of sustaining essential services under extreme conditions, which is the true objective of operational resilience.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.