[OR] [MBSB] [E1] [C5] Identifying Critical Business Services

Chapter 5

Identifying Critical Business Services for MBSB

Introduction

A central step in implementing Operational Resilience at MBSB Bank Berhad (MBSB) is determining which business services are sufficiently important that their prolonged or severe disruption could result in unacceptable consequences for customers, the bank, other financial institutions or the wider Malaysian financial system.

This represents an important shift from traditional Business Continuity Management (BCM).

BCM commonly identifies critical business functions, processes, applications and resources that require recovery. Operational Resilience takes a broader, customer- and outcome-oriented perspective by asking:

Which services must MBSB continue to deliver because their disruption could cause intolerable harm to customers or threaten the soundness, stability or orderly functioning of financial services?

This distinction is increasingly relevant within Malaysia's regulatory environment. Bank Negara Malaysia's (BNM) 2025 Discussion Paper on Operational Resilience, issued on 19 December 2025, identifies the continuity of critical financial services as a central resilience concern and highlights the need for financial institutions to identify the operations and services that are critical to consumers and the market.

For MBSB, identifying Critical Business Services (CBSs) provides the foundation for subsequent Operational Resilience activities.

Once these services have been agreed, the bank can map their interconnections and interdependencies, establish impact tolerances, conduct severe-but-plausible scenario testing, identify vulnerabilities, and prioritise resilience investment.

The Critical Business Services proposed in this chapter are illustrative for this case study. They should not be interpreted as MBSB's formally designated internal CBS inventory.

What Is a Critical Business Service?

The BCM Institute's Operational Resilience Planning Methodology describes a Critical Business Service as a service provided by an organisation, or by another party on its behalf, to one or more clients which, if disrupted, could cause intolerable harm to clients or pose a risk to the soundness, stability or resilience of the financial industry, its systems or the orderly operation of markets.

The methodology also recognises that different regulators use terminology such as Critical Business Services, Important Business Services and Critical Operations.

Although there can be technical differences between these terms, they share a common resilience objective: identifying the services whose continued delivery matters most during disruption.

For MBSB, this means the starting point should not be an organisational department.

For example:

• Information Technology is not, by itself, a CBS.

• Core Banking System is not, by itself, a CBS.

• The Payment Operations Department is not, by itself, a CBS.

These are functions, systems, or resources that support the delivery of services.

A CBS should instead describe an outcome delivered to a customer or another important external stakeholder.

For example:

Providing customers with access to their deposits and enabling them to make payments and transfers.

This service may depend on core banking, digital channels, identity and authentication systems, telecommunications, databases, payment networks, operational personnel and external providers.

The distinction is fundamental because Operational Resilience seeks to protect the end-to-end delivery of the service, rather than merely recovering individual organisational components.

Viewing MBSB Through the Customer-Service Lens

The identification process should begin by examining the services MBSB delivers from the customer's perspective.

The BCM Institute methodology recommends the customer journey as a useful starting point and suggests supplementing it with information from risk registers, critical asset and third-party inventories, business continuity plans and recovery arrangements.

For example, an MBSB retail customer may need to:

Access Account → Authenticate → Check Available Funds → Initiate Payment → Authorise Transaction → Transfer Funds → Receive Confirmation

A corporate customer may need to:

Access Corporate Banking → Review Account → Prepare Payment → Obtain Authorisation → Submit Bulk Payment → Settle Through Payment Infrastructure

MBSB's published digital banking information indicates that its services include account enquiries, DuitNow transfers, financing payments, foreign fund transfers, intrabank transfers, Interbank GIRO, JomPAY and other transactional capabilities. Corporate services also include facilities associated with RENTAS, SWIFT and bulk payments. 

These capabilities do not automatically become CBSs individually. Instead, they help identify the customer outcomes whose interruption could create significant harm.

Key Considerations for Identifying CBS at MBSB

MBSB should apply consistent criteria rather than classify services as critical simply because they are commercially important or technologically complex.

A practical assessment should consider several dimensions.

Customer Harm

The primary consideration should be the consequences to customers.

Questions include:

• Would customers lose access to their money?
• Could customers become unable to make essential payments?
• Could businesses fail to pay employees or suppliers?
• Could customers suffer material financial loss?
• Could vulnerable customers be disproportionately affected?
• Would the harm increase significantly as the disruption continues?

BNM specifically notes that consumers increasingly expect uninterrupted access to financial services, particularly services that affect their ability to access funds, including mobile and online banking and real-time payments.

Financial-System Impact

MBSB should consider whether disruption could affect other financial institutions, payment networks or market infrastructure.

Malaysia's financial system is interconnected through payment networks, clearing and settlement infrastructure, telecommunications, technology providers and other shared services.

Consequently, disruption may extend beyond the institution where the original failure occurred.

Volume and Reach

Services supporting large numbers of customers or significant transaction volumes may warrant greater resilience attention.

However, volume alone should not determine criticality. A lower-volume service could still be critical where individual transactions are financially significant or time-sensitive.

Time Criticality

MBSB should determine how quickly customer harm becomes unacceptable.

For example, a disruption lasting ten minutes may cause inconvenience, whereas a disruption lasting several hours during a peak payment period could produce substantially different consequences.

This is why CBS identification must eventually be linked to impact tolerance.

Substitutability

MBSB should determine whether customers have practical alternative ways of obtaining the same outcome.

An alternative channel should not automatically be considered an effective substitute.

A branch, ATM and mobile banking service may appear to provide alternative access channels but could depend on the same core banking platform or authentication infrastructure.

Interdependency

Services heavily dependent upon payment networks, telecommunications providers, data centres, cloud services or specialist third parties require particular attention.

BNM identifies deep visibility over internal and external dependencies as one of the important lessons from recent operational disruptions.

Regulatory and Legal Consequences

MBSB should consider whether disruption prevents it from meeting significant regulatory, contractual or statutory obligations.

Safety and Soundness

Finally, the bank should consider whether disruption could threaten its operational viability, financial position, liquidity, reputation or overall safety and soundness.

Proposed Critical Business Services for MBSB

Applying these considerations produces an initial set of candidate Critical Business Services.

The identification process should remain selective.

If every activity is classified as critical, the CBS framework loses its ability to prioritise resilience resources. Conversely, an excessively narrow list could overlook services whose disruption creates significant customer or market consequences.

The following proposed inventory therefore focuses on externally delivered outcomes rather than individual departments, processes or systems.

Proposed MBSB Critical Business Services

The following table incorporates the revised Critical Business Service (CBS) names as noun phrases, while retaining the service outcome, stakeholders, potential disruption consequences and supporting dependencies.

These services should be subjected to formal validation before being accepted as MBSB's CBS inventory.

The validation should involve business service owners, Operational Risk, BCM, Technology, Cybersecurity, Operations, Compliance, Third-Party Risk and Senior Management.

Distinguishing CBS from Supporting Resources

An important implementation discipline is preventing the CBS inventory from becoming a list of systems and departments.

Consider CBS-2: Enable Domestic Funds Transfers and Payments.

The service may depend on:

People

Payment operations staff, technology teams, cybersecurity personnel and customer support.

Processes

Transaction initiation, authentication, validation, fraud screening, clearing, settlement and reconciliation.

Technology

Digital banking platforms, core banking, databases, payment gateways and monitoring systems.

Information

Customer records, account balances, payment instructions and transaction data.

Facilities

Operations centres, offices and data-centre facilities.

Third Parties and Financial Infrastructure

Telecommunications providers, payment-system operators and specialist technology providers.

These components are important, but they are dependencies of the CBS rather than the CBS itself.

This distinction prepares MBSB for the next Operational Resilience stage: mapping interconnections and interdependencies.

Example Severe but Plausible Scenarios Affecting MBSB CBS

CBS identification should immediately lead management to consider how the services could fail.

BNM notes that operational disruptions can arise from cyber incidents, technology failures, third-party outages, compromised information assets and power outages.

It also highlights Malaysian incidents affecting mobile and online banking, payment systems, switching networks and ATM availability.

BNM further observes that isolated failure testing is no longer sufficient and that scenario testing should be severe but reasonably plausible, including concurrent events where appropriate.

For MBSB, illustrative scenarios could include:

The purpose of these scenarios is not simply to prove that recovery plans work.

They should determine whether the CBS remains deliverable within the organisation's defined impact tolerance.

Regulatory Alignment with Bank Negara Malaysia

MBSB's approach to identifying CBSs should be aligned with the emerging direction articulated in BNM's 2025 Discussion Paper.

The Discussion Paper identifies several concepts that are particularly relevant to MBSB's CBS framework.

Identify Services Critical to Consumers and the Market

BNM states that financial institutions need to identify which operations and/or services are critical to consumers and the market and preserve their continuity.

For MBSB, CBS identification should therefore consider external outcomes, rather than relying solely on internal business-function criticality.

Understand Internal and External Dependencies

BNM emphasises the importance of deep visibility over both internal and external dependencies.

Once MBSB identifies its CBSs, it should trace the people, processes, technology, information, facilities, third parties and financial infrastructure necessary to deliver each service.

Move Beyond RTO and MTD Alone

BNM observes that traditional internal recovery metrics, such as Maximum Tolerable Downtime (MTD) and Recovery Time Objective (RTO), remain necessary but may not be sufficient because impact tolerances need to consider customer and stakeholder outcomes.

This represents an important evolution for MBSB.

An application may technically recover within its RTO while the customer-facing service remains unavailable because another dependency has failed.

Operational Resilience, therefore, measures success at the service level.

Consider Digital and Third-Party Concentration

BNM highlights increasingly complex dependency chains created by digital channels, cloud services, APIs, telecommunications and shared infrastructure, as well as concentration risks where specialist providers are difficult to replace.

MBSB's CBS assessment should consequently identify services that depend heavily upon common infrastructure or providers.

Strengthen Governance and Accountability

BNM identifies strong board oversight and timely decision-making through an integrated, cross-functional structure as important characteristics of institutions capable of withstanding disruption.

Accordingly, every MBSB CBS should ultimately have a clearly designated business service owner accountable for its resilience.

From CBS Identification to Operational Resilience

Identifying Critical Business Services is not an end in itself.

The CBS inventory becomes the organising structure for the remainder of MBSB's Operational Resilience programme.

A practical progression is:

This represents an important shift in management perspective.

Instead of asking:

"Is the core banking system resilient?"

MBSB should increasingly ask:

"Can customers continue accessing their funds and completing critical transactions if the core banking system, telecommunications network, authentication platform or another critical dependency fails?"

The second question provides a much stronger basis for Operational Resilience.

Identifying Critical Business Services establishes the service lens through which MBSB can organise its Operational Resilience programme.

For this case study, potential CBSs include access to deposits and account information, domestic payments and funds transfers, digital banking, cash services, financing servicing, corporate payments, high-value and interbank payments, transaction authentication and essential customer assistance during disruption.

These proposed services should not be regarded as MBSB's confirmed internal CBS inventory.

Formal identification requires structured assessment, management challenge and approval using consistent criteria relating to customer harm, financial-system implications, time criticality, substitutability, interdependencies and regulatory consequences.

The direction outlined by BNM reinforces the importance of this approach.

Greater digitalisation, deeper third-party dependencies, interconnected financial infrastructure and increasingly severe operational disruptions mean that resilience can no longer be assessed solely through individual systems, departments or recovery-time objectives.

Financial institutions need to understand which services matter most and preserve their continuity when disruption occurs.

For MBSB, the identification of CBSs therefore answers the first fundamental question:

What must remain resilient?

The next step is to answer an equally important question:

What does each Critical Business Service depend upon to remain operational?

This leads into the mapping of MBSB's interconnections and interdependencies, where each CBS is examined end-to-end across people, processes, technology, information, facilities, third parties and financial infrastructure.

Only after these dependencies are understood can MBSB establish meaningful impact tolerances and determine whether its Critical Business Services can withstand severe but plausible disruption.

eBook 1: Understanding Your Organisation: MBSB Bank
C1	C2	C3	C4
C5	C6	C7	C8

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.