[OR] [MBSB] [E1] [C3] Examining Operating Environment

Chapter 3

Examining the Operating Environment for MBSB Bank

Introduction

Operational Resilience cannot be developed in isolation from the environment in which an organisation operates.

For MBSB Bank (MBSB), its resilience requirements are influenced not only by its internal operations but also by Malaysia's financial system, customer expectations, regulatory requirements, technological developments, cyber threats, third-party dependencies, payment infrastructure and physical and environmental risks.

This operating environment is becoming increasingly complex. Bank Negara Malaysia's (BNM) 2025 Discussion Paper on Operational Resilience, issued on 19 December 2025, identifies rapid digitalisation, rising cyber threats, deeper third-party dependencies and increasing severity and frequency of operational disruptions as important factors driving the need for stronger resilience among Malaysian financial institutions.

BNM notes that sustaining the continuity of essential services under stress has become as important as maintaining adequate financial buffers as digital interdependencies deepen.

For MBSB, examining its operating environment therefore provides an essential bridge between understanding the organisation and determining which business services must be prioritised for Operational Resilience.

By understanding these factors, Metrobank can anticipate risks, respond effectively to disruptions, and integrate resilience into its operations.

The purpose of this chapter is to examine the internal and external operating environment of MBSB Bank and identify the conditions that could influence its ability to continue delivering important financial services during disruption.

The rationale for undertaking this analysis before identifying Critical Business Services (CBSs) is straightforward: MBSB cannot determine what must remain resilient without understanding the environment within which those services are delivered.

Digital banking, interconnected payment infrastructure, telecommunications, cyber threats, external service providers, changing customer expectations and physical disruptions can create dependencies and vulnerabilities extending well beyond the boundaries of individual departments, applications or facilities.

BNM's 2025 Discussion Paper reinforces this perspective by emphasising the need for financial institutions to understand critical services and their internal and external dependencies.

By the end of this chapter, the reader should be able to identify the principal characteristics of MBSB's operating environment, distinguish between internal and external factors affecting resilience, recognise emerging sources of operational vulnerability, and understand how these factors should influence the design of MBSB's Operational Resilience programme.

The reader should also appreciate how the examination of MBSB's environment supports BNM's emerging direction concerning critical services, dependency visibility, impact tolerances, severe but plausible scenario testing, governance and continuous improvement.

The chapter, therefore, provides the contextual analysis needed before MBSB progresses to identifying and prioritising its Critical Business Services.

Why the Operating Environment Matters

Operational Resilience begins with the assumption that disruption will occur.

The objective is therefore not to design an organisation in which every disruption can be prevented. Rather, MBSB should develop sufficient capability to anticipate, withstand, respond to, recover from and learn from disruptions while continuing to deliver its most important services within acceptable limits.

BNM similarly observes that disruptions are becoming increasingly complex and inevitable. Prevention remains important, but it needs to be complemented by preparedness, adaptability and robust recovery capabilities.

The implication for MBSB is significant.

A disruption does not need to originate within MBSB to affect its customers.

For example:

Telecommunications Provider Failure

↓

Loss of Connectivity

↓

Digital Banking / ATM Connectivity Affected

↓

Customers Unable to Access Banking Services

↓

Payment or Cash Access Disrupted

↓

Customer and Business Impact

In this example, MBSB's core banking system could remain operational while the customer-facing service becomes unavailable.

Operational Resilience must therefore consider the entire operating ecosystem rather than only assets directly controlled by MBSB.

Examining MBSB's Operating Environment

A practical assessment of MBSB's operating environment should consider two broad perspectives:

Internal Operating Environment

This consists of factors predominantly within MBSB's organisational boundary, including:

• organisational structure;
• governance;
• business processes;
• people and competencies;
• technology;
• information and data;
• facilities;
• operational procedures;
• risk management;
• BCM;
• cybersecurity;
• crisis management; and
• organisational culture.

External Operating Environment

This consists of factors outside MBSB's immediate organisational control, including:

• regulatory developments;
• customers and customer expectations;
• payment and settlement infrastructure;
• telecommunications;
• technology providers;
• outsourced service providers;
• cloud and data-centre providers;
• cyber threat actors;
• other financial institutions;
• economic and geopolitical developments;
• utilities and infrastructure; and
• environmental and climate-related threats.

The distinction is useful for analysis, but Operational Resilience should not treat the two environments independently.

They are interconnected.

A weakness in an external provider can become an internal operational incident. Likewise, weaknesses in MBSB's internal processes may affect customers, counterparties and other participants in the financial ecosystem.

Malaysia's Financial Services Environment

MBSB operates within a highly interconnected Malaysian financial ecosystem.

Its services may depend directly or indirectly on:

Customers

↓

MBSB Delivery Channels

↓

MBSB Applications and Infrastructure

↓

Telecommunications and Technology Providers

↓

Payment and Settlement Infrastructure

↓

Other Financial Institutions

↓

Beneficiaries and Counterparties

This interconnectedness creates efficiency and convenience, but it also creates the potential for disruptions to propagate.

BNM specifically notes that the financial system is tightly interconnected through payment networks, clearing and settlement infrastructure, shared telecommunications services, cloud ecosystems, fintech arrangements and API-driven platforms.

Growing dependence on cloud providers, outsourced operational and IT functions, fintech partners, data centres and telecommunications can create both concentration and systemic risks.

For MBSB, resilience, therefore, cannot be assessed solely by asking:

Are MBSB's own systems resilient?

It must also ask:

Can MBSB continue delivering its Critical Business Services when an important part of the financial ecosystem on which it depends becomes unavailable?

Digitalisation and Technology Dependency

One of the most significant characteristics of MBSB's operating environment is the growing dependence of banking services on technology.

Customers increasingly expect banking services to be accessible through digital channels and transactions to be completed quickly.

This creates multiple benefits but also introduces dependency chains.

BNM identifies mobile banking, digital onboarding, electronic Know-Your-Customer, QR payments, cloud-hosted financial applications, APIs and open financial architectures as examples of technologies reshaping financial services.

It also notes that these developments increase sensitivity to outages and create more complex dependencies and potential vulnerabilities across software supply chains and interfaces.

For MBSB, a customer transaction might depend upon:

Customer Device

↓

Internet / Mobile Network

↓

MBSB Digital Channel

↓

Authentication Service

↓

Application Infrastructure

↓

Core Banking

↓

Payment Processing

↓

External Financial Infrastructure

A disruption to any component can prevent completion of the transaction.

Consequently, the Operational Resilience programme should assess technology from an end-to-end service perspective, rather than considering individual applications independently.

Changing Customer Expectations

Digitalisation has also changed customer expectations.

Customers increasingly expect immediate and continuous access to banking services.

BNM specifically highlights financial services affecting customers' ability to access their funds, including mobile and online banking and real-time payments. Interruptions can rapidly create customer dissatisfaction and potentially undermine trust and confidence, particularly where personal information or fraudulent activity is involved.

For MBSB, the impact of disruption should therefore be considered from the customer's perspective.

Questions should include:

• How many customers are affected?
• Which customer groups are affected?
• What are customers unable to do?
• How quickly does inconvenience become harm?
• Are vulnerable customers disproportionately affected?
• Are alternative channels genuinely available?
• Could customers experience financial loss?
• Could businesses fail to make payroll or supplier payments?
• How quickly could customer confidence deteriorate?

These considerations subsequently become important when MBSB establishes Impact Tolerances for its Critical Business Services.

Cyber Threat Environment

Cyber threats represent a major component of the operating environment for financial institutions.

BNM identifies sophisticated cyber threats, including AI-enabled exploits, ransomware, attacks targeting critical infrastructure, destructive malware, third-party attacks and supply-chain exploitation.

These incidents may impair systems for extended periods and require capabilities beyond traditional recovery measures.

For MBSB, cyber resilience and Operational Resilience should therefore be closely integrated.

A traditional cybersecurity perspective asks:

How can the threat be prevented, detected and contained?

Operational Resilience adds:

If preventive controls fail, can the affected Critical Business Service continue within its Impact Tolerance?

For example, a ransomware scenario affecting core banking should not only test whether technology can be recovered.

MBSB should determine whether:

• customer accounts remain accessible;
• account balances remain reliable;
• payments can continue;
• Alternative channels remain operational;
• transaction data can be trusted;
• customer communications can be maintained;
• regulatory escalation can occur; and
• Restoration can be performed without creating further customer harm.

This transforms cyber incident testing from a technology recovery exercise into an end-to-end service resilience test.

Third-Party and Supply-Chain Dependencies

MBSB's operating environment also includes organisations that provide critical technology, telecommunications, infrastructure and operational services.

Potential dependencies may include:

• telecommunications operators;
• cloud service providers;
• data-centre providers;
• technology vendors;
• software suppliers;
• cybersecurity providers;
• payment service providers;
• outsourced operational providers;
• cash logistics providers; and
• specialist professional services.

BNM highlights two particular challenges.

First, external dependency chains may be opaque, meaning that financial institutions have limited visibility into the supply chains supporting their providers.

Second, certain services may be concentrated among a small number of specialist providers, making rapid substitution difficult during disruption.

This creates an important principle for MBSB:

A third-party service can be outsourced, but accountability for the resilience of the resulting MBSB business service cannot be outsourced.

MBSB should therefore identify critical third parties when mapping its Critical Business Services and determine whether realistic alternatives exist.

Concentration and Common Dependency Risk

A particularly important resilience concern is the existence of common dependencies.

Different MBSB services may appear independent while relying on the same underlying resource.

For example:

Digital Banking

ATM Services

Branch Transactions

Corporate Payments

↓

Common Core Banking Platform

A failure of that platform could simultaneously affect multiple customer channels.

Similarly:

Digital Banking

Customer Contact Centre

Branch Connectivity

↓

Common Telecommunications Provider

The existence of alternative channels therefore, does not necessarily provide resilience if those channels depend on the same underlying infrastructure.

BNM's discussion of shared infrastructure and concentration risk reinforces the importance of identifying these common points of dependency.

For MBSB, mapping should therefore identify not only dependencies, but also concentrations and single points of failure.

Payment and Financial Infrastructure Dependencies

As a bank, MBSB participates in an ecosystem in which payments may involve multiple institutions and infrastructure providers.

A simplified transaction could involve:

MBSB Customer

↓

MBSB Channel

↓

MBSB Core Banking / Payment Processing

↓

External Payment Infrastructure

↓

Receiving Financial Institution

↓

Beneficiary

The successful completion of the customer's transaction therefore, depends on more than MBSB.

A disruption affecting payment networks, switching infrastructure, clearing or settlement could affect the service even where MBSB's internal systems remain operational.

BNM notes that Malaysia has experienced operational disruptions affecting mobile and online banking channels, payment systems, switching networks and ATMs.

These incidents demonstrate dependencies across internal systems, common industry infrastructure and third-party providers, as well as the importance of end-to-end operational visibility.

Such dependencies should consequently form part of MBSB's Critical Business Service mapping and scenario testing.

Physical and Environmental Risks

Operational Resilience should not become exclusively focused on technology and cyber risks.

Physical disruptions remain relevant.

BNM identifies climate-related physical risks such as:

• floods;
• heatwaves;
• wildfires; and
• storms.

Such events can affect physical infrastructure, data-centre operations, branch accessibility and logistics networks. BNM also notes that increasingly severe climate events and other high-impact, multi-layered outages can prolong disruptions across regions.

For MBSB, relevant scenarios could include:

Major Flood

↓

Branch / Office Inaccessibility

↓

Workforce Displacement

↓

Telecommunications and Utility Disruption

↓

Third-Party Logistics Disruption

↓

Multiple Customer Services Affected

The resilience assessment should therefore consider combinations of failures rather than assuming each disruption will occur independently.

People and Workforce Dependencies

People remain a critical component of MBSB's operating environment.

Even highly automated banking services require personnel to:

• monitor systems;
• investigate exceptions;
• manage incidents;
• authorise decisions;
• perform reconciliations;
• communicate with customers;
• coordinate recovery;
• interact with service providers; and
• escalate significant incidents.

Operational Resilience should therefore identify:

• specialist knowledge concentrated in individual employees;
• minimum staffing requirements;
• succession arrangements;
• cross-training requirements;
• remote-working capability;
• decision-making authority during disruption; and
• dependency on key third-party specialists.

A technology platform may be available but still fail to deliver the required service if essential personnel cannot operate, monitor or recover it.

Regulatory Environment and BNM's Emerging Direction

BNM's 2025 Discussion Paper is particularly relevant to the examination of MBSB's operating environment because it establishes the emerging regulatory direction for strengthening Operational Resilience among Malaysian financial institutions.

The paper applies its discussion to financial institutions, including banking and Islamic banking institutions.

It is important to recognise that the publication is a Discussion Paper, rather than to present every concept within it as an already-finalised regulatory requirement.

BNM describes the document as setting out its emerging direction and key considerations and explicitly connects Operational Resilience with existing requirements issued by the Bank.

For MBSB, the practical direction emerging from the paper can be summarised as follows:

BNM's lessons from operational disruptions are particularly clear: financial institutions need to identify critical operations or services, understand dependencies, establish impact tolerances focused on internal and external outcomes, test severe but plausible scenarios, maintain strong Board oversight and systematically learn from disruption.

Existing Regulatory Requirements as the Foundation

Operational Resilience should not be treated as an entirely separate regulatory programme.

For MBSB, existing BNM requirements and established risk disciplines provide much of the underlying capability needed to strengthen resilience.

These may include:

Business Continuity Management

Provides Business Impact Analysis, continuity strategies, recovery arrangements, exercises and crisis preparedness.

Risk Management in Technology

Provides governance and controls supporting technology availability, cybersecurity and technology recovery. BNM issued its revised Risk Management in Technology policy document on 28 November 2025.

Operational Risk Management

Provides the broader framework for identifying, assessing, monitoring and managing operational risks.

Third-Party Risk Management

Supports assessment and oversight of dependencies arising from outsourcing and external service providers.

Incident and Crisis Management

Provides escalation, command, coordination and decision-making mechanisms during significant disruption.

Operational Resilience should integrate these capabilities around the continued delivery of the Critical Business Service.

The objective is therefore not to create parallel arrangements for every resilience discipline, but to ensure existing capabilities collectively support service continuity.

Alignment with ISO 22316

The examination of MBSB's operating environment is also consistent with the principles of ISO 22316:2017 — Security and resilience — Organisational resilience — Principles and attributes.

ISO 22316 takes a broad organisational perspective on resilience. Applied to MBSB, this means resilience should not be viewed solely as an emergency response or technology recovery capability.

Instead, MBSB should develop the organisational capacity to understand and respond to change.

From an Operational Resilience perspective, this requires:

• understanding the organisational context;
• monitoring changes in the operating environment;
• maintaining effective leadership;
• developing an organisational culture supportive of resilience;
• coordinating management disciplines;
• understanding relationships and dependencies;
• developing adaptive capacity; and
• continuously improving from experience.

The alignment between these principles and BNM's emerging Operational Resilience direction is particularly useful for MBSB.

ISO 22316 provides the broader organisational resilience perspective, while BNM provides the financial-services context within which resilience should be operationalised.

MBSB Operating Environment Assessment

Based on the considerations discussed above, an initial operating-environment assessment can be developed.

This assessment should be reviewed periodically because the operating environment will continue to change.

Translating Environmental Analysis into Operational Resilience

Examining the operating environment should ultimately influence how MBSB implements Operational Resilience.

The analysis can be translated through the following pathway:

Examine Operating Environment

↓

Identify Sources of Disruption

↓

Understand Customers and Stakeholders

↓

Identify Critical Business Services

↓

Map Interconnections and Interdependencies

↓

Identify Concentrations and Vulnerabilities

↓

Establish Impact Tolerances

↓

Develop Severe but Plausible Scenarios

↓

Test Resilience

↓

Remediate and Improve

This ensures that Operational Resilience is not implemented as a theoretical compliance framework.

It becomes a structured response to the actual conditions under which MBSB delivers financial services.

Key Questions for MBSB

At the conclusion of the operating-environment assessment, MBSB should be able to answer several fundamental questions:

• What developments are changing how MBSB delivers its services?
• Which customer expectations make service interruption increasingly unacceptable?
• Which technologies are becoming critical to multiple services?
• Where does MBSB rely on common infrastructure?
• Which external providers could cause significant service disruption?
• Are alternative channels genuinely independent?
• Which cyber scenarios could simultaneously affect several services?
• Which payment and settlement infrastructures are essential?
• What physical or environmental events could affect multiple resources simultaneously?
• Where are specialist skills concentrated?
• How could disruption propagate between MBSB, customers, providers and the wider financial ecosystem?
• Which existing BCM, technology, cyber and risk controls already contribute to resilience?
• Where might existing arrangements be insufficient when assessed from the perspective of end-to-end service continuity?

These questions provide the bridge from environmental understanding to Critical Business Service identification.

Examining MBSB Bank's operating environment demonstrates why Operational Resilience must extend beyond conventional organisational boundaries.

MBSB operates within an ecosystem of customers, employees, digital channels, technology platforms, telecommunications networks, payment infrastructure, third-party providers and other financial institutions. Disruption affecting any important element of this ecosystem can ultimately affect the financial service experienced by the customer.

BNM's 2025 Discussion Paper reinforces this perspective. Malaysia's experience with disruptions affecting mobile and online banking, payment systems, switching networks and ATMs illustrates the importance of understanding dependencies across internal systems, common infrastructure and third-party providers.

BNM consequently identifies critical-service continuity, deep dependency visibility, customer-oriented impact tolerances, severe but plausible scenario testing, strong Board oversight and continuous learning as important components of stronger Operational Resilience.

For MBSB, the principal lesson is:

Operational Resilience begins by understanding not only the organisation, but the environment and ecosystem upon which the organisation depends to deliver its services.

The operating-environment assessment, therefore, provides the foundation for determining where MBSB should focus its resilience efforts.

Rather than attempting to make every activity equally resilient, MBSB should use this understanding to identify the services whose disruption could create the greatest consequences for customers, the bank and the wider financial ecosystem.

The next stage is therefore to move from the question:

"What could affect MBSB?"

to the more focused question:

"Which MBSB business services must remain resilient when these disruptions occur?"

Answering that question establishes the basis for identifying MBSB's Critical Business Services, which can then be mapped end-to-end, assigned Impact Tolerances and subjected to severe but plausible scenario testing as the Operational Resilience pro

 

 

eBook 1: Understanding Your Organisation: MBSB Bank
C1	C2	C3	C4
C5	C6	C7	C8

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.