[OR] [MBSB] [E1] [C6] Analysing Key Characteristics for MBSB

Chapter 6

Key Characteristics of MBSB Bank

Introduction

An effective Operational Resilience programme must reflect the characteristics of the organisation to which it is applied.

Financial institutions may be subject to common regulatory expectations, but their resilience requirements will differ depending on their business model, customer profile, technology architecture, service channels, third-party dependencies, governance arrangements, and exposure to disruption.

For MBSB Bank (MBSB), these characteristics are particularly important because the bank operates as a licensed Islamic banking institution in Malaysia and provides financial services to retail, SME and corporate customers.

MBSB's published financial statements confirm that it is licensed under the Islamic Financial Services Act 2013 and is principally engaged in Islamic banking and related financial services. 

From an Operational Resilience perspective, these characteristics determine how MBSB should identify its Critical Business Services, map its interconnections and interdependencies, establish Impact Tolerances, design severe but plausible scenarios and prioritise resilience investment.

BNM's 2025 Discussion Paper on Operational Resilience reinforces this organisation-specific approach.

The paper identifies rapid digitalisation, complex interdependencies, cyber threats, third-party dependencies and increasingly severe operational disruptions as important considerations for Malaysian financial institutions.

It also stresses that maintaining continuity of essential financial services under stress is increasingly important as digital interdependencies deepen.

The purpose of this chapter is to identify the key organisational and operating characteristics of MBSB Bank that should shape the design and implementation of its Operational Resilience programme. The rationale is that Operational Resilience cannot be applied effectively as a generic framework.

MBSB's Islamic banking model, diverse customer groups, digital service channels, dependence on technology and financial infrastructure, third-party relationships, regulatory obligations and interconnected service environment all affect where vulnerabilities may arise and how disruption could translate into customer or financial-system impact.

Understanding these characteristics enables MBSB to focus resilience efforts on the circumstances most relevant to its own business model rather than relying on assumptions developed for another institution.

By the end of this chapter, the reader should be able to recognise the principal characteristics that define MBSB's resilience profile and explain how each characteristic influences the bank's Operational Resilience priorities.

The reader should also understand how these organisational characteristics relate to the emerging direction outlined in BNM's 2025 Discussion Paper and to the broader organisational resilience principles set out in ISO 22316.

ISO 22316:2017 guides the enhancement of organisational resilience while recognising that objectives and initiatives should be tailored to an organisation's individual circumstances rather than imposed uniformly.

Why Organisational Characteristics Matter to Operational Resilience

Operational Resilience is not achieved simply by adopting a standard methodology.

The methodology must be applied to the realities of the organisation.

For MBSB, the relevant question is therefore not:

"What does a resilient bank look like?"

but:

"What characteristics of MBSB determine where disruption could cause unacceptable consequences, and what capabilities are therefore required to remain resilient?"

The answer requires MBSB to consider characteristics such as:

• its role as an Islamic bank;
• the customer groups it serves;
• its dependence on digital banking;
• the importance of customer access to funds;
• the interconnected nature of payments;
• reliance on technology and data;
• dependencies on third parties;
• the availability of alternative service channels;
• concentration and common dependency risks;
• governance and accountability;
• regulatory obligations; and
• the need to adapt as its operating environment changes.

Each characteristic has different Operational Resilience implications.

Characteristic 1 — Islamic Banking Business Model

MBSB is a licensed Islamic bank under Malaysia's Islamic Financial Services Act 2013 and is principally engaged in Islamic banking and related financial services. (MBSB Bank)

This characteristic is important because MBSB's Operational Resilience programme must support the continued delivery of services within its Islamic banking operating model.

Operational disruption should therefore be evaluated not only in terms of whether systems or processes remain available, but also in terms of whether MBSB can continue to deliver the required customer outcome in a manner consistent with applicable regulatory and governance requirements.

For example, disruptions affecting financing-account processing may involve more than temporary application unavailability. They may also affect:

• customer repayment processing;
• transaction records;
• account balances;
• contractual information;
• customer communications;
• reconciliations; and
• the accuracy and integrity of financial information.

This means data integrity and processing accuracy can be as important to resilience as service availability.

A service that remains technically available but produces incorrect or unreliable financial information cannot be considered resilient.

Characteristic 2 — Diverse Customer Segments

MBSB provides Shariah-compliant banking facilities to retail, SME and corporate customers. (MBSB Bank)

Different customer groups can experience disruption differently.

For a retail customer, disruption could mean:

• inability to access a deposit account;
• inability to obtain cash;
• inability to transfer funds;
• inability to make an urgent payment; or
• inability to determine an account balance.

For an SME customer, disruption could affect:

• supplier payments;
• payroll;
• working-capital transactions;
• financing repayments; or
• access to business funds.

For a corporate customer, consequences could include:

• bulk-payment delays;
• failed high-value transactions;
• liquidity consequences;
• contractual obligations; or
• delayed settlement.

Operational Resilience should therefore avoid defining service criticality solely on transaction volume.

A lower-volume corporate service may still be critical if transactions are high-value or time-sensitive.

Likewise, widespread disruption to a high-volume retail service may rapidly produce significant customer harm.

BNM notes that digitalisation has increased customer expectations for uninterrupted access to financial services, particularly services that affect access to funds, such as mobile or online banking and real-time payments.

For MBSB, customer segmentation should consequently form part of both CBS identification and Impact Tolerance setting.

Characteristic 3 — Increasing Dependence on Digital Banking

Digitalisation is one of the most significant characteristics influencing MBSB's resilience profile.

The modern banking customer increasingly expects to:

• access accounts remotely;
• view balances;
• transfer funds;
• make payments;
• authenticate transactions;
• obtain financing information; and
• communicate with the bank electronically.

BNM identifies mobile banking, digital onboarding, electronic Know Your Customer, QR payments, cloud-hosted applications, APIs, and open financial architectures as important elements of the increasingly digital financial environment. While these developments improve efficiency and accessibility, they also create more complex dependency chains and greater sensitivity to outages.

For MBSB, this means a digital service may depend upon:

Customer Device

↓

Telecommunications Network

↓

Internet / Mobile Banking Platform

↓

Authentication and Identity Services

↓

Application Infrastructure

↓

Core Banking

↓

Database and Information Services

↓

External Payment Infrastructure

A failure at any level may affect the final customer outcome.

The resilience objective should therefore not simply be:

Keep the digital platform operational.

It should be:

Maintain the delivery of the Critical Business Service to the customer despite disruption affecting one or more digital dependencies.

Characteristic 4 — High Importance of Customer Access to Funds

One of the defining characteristics of banking is that customers depend upon timely access to their money.

BNM highlights this explicitly, noting that digitalisation has created strong expectations of uninterrupted availability for financial services affecting customers' ability to access their funds. Disruption to these services can create immediate dissatisfaction and may undermine trust and confidence.

This characteristic has direct implications for MBSB's proposed Critical Business Services, especially:

• CBS-1 Customer Deposit and Account Access Services;
• CBS-2 Domestic Funds Transfer and Payment Services;
• CBS-3 Digital Banking Services; and
• CBS-4 Cash Access and Cash Transaction Services.

For these services, MBSB should consider not only outage duration but also:

• number of customers affected;
• timing of the disruption;
• value and volume of transactions affected;
• availability of alternative channels;
• vulnerable customer groups;
• ability to make essential payments;
• customer financial loss; and
• potential loss of confidence.

For example, a two-hour interruption during a low-transaction period may have a different impact than the same disruption during a major payroll or festive payment period.

Impact Tolerance should therefore reflect customer consequences, not simply elapsed time.

Characteristic 5 — Interconnected Payment Environment

Banking services do not operate independently.

Many transactions require interaction with external payment networks, clearing arrangements, settlement systems, telecommunications and other financial institutions.

BNM notes that the financial system is tightly interconnected through payment networks, clearing and settlement infrastructures, shared telecommunications services, cloud ecosystems, fintech platforms and API-driven arrangements.

For MBSB, a domestic payment service may therefore involve:

MBSB Customer

↓

MBSB Banking Channel

↓

Authentication

↓

MBSB Core Banking

↓

Payment Processing

↓

External Payment Infrastructure

↓

Receiving Financial Institution

↓

Beneficiary

This creates an important Operational Resilience principle:

MBSB may control the service, but it does not control every dependency required to deliver that service.

A service can therefore fail even though MBSB's own systems remain operational.

This is especially important for:

• domestic funds transfers;
• corporate payments;
• high-value transactions;
• interbank payments; and
• settlement-related activities.

Consequently, the resilience of these services should be assessed end-to-end.

Characteristic 6 — Dependence on Technology and Shared Infrastructure

MBSB's banking services depend heavily on technology.

A single technology component may support multiple Critical Business Services.

For example:

Core Banking Platform

may support:

• deposit access;
• payments;
• digital banking;
• cash transactions;
• financing servicing; and
• corporate transactions.

This creates concentration risk.

A technology failure may therefore disrupt several CBSs simultaneously.

BNM specifically observes that failures of shared infrastructures can concurrently affect multiple institutions, large customer groups and market functions.

For MBSB, dependency mapping should consequently identify:

• common applications;
• common databases;
• shared networks;
• authentication services;
• data centres;
• common telecommunications;
• shared external providers;
• common personnel; and
• common recovery infrastructure.

This allows the bank to distinguish between apparent redundancy and genuine resilience.

Two customer channels should not be considered independent alternatives if both depend upon the same underlying point of failure.

Characteristic 7 — Reliance on Third Parties

Modern banking institutions rely upon external providers for a variety of capabilities.

Illustrative MBSB dependencies could include:

• telecommunications;
• technology infrastructure;
• software;
• data-centre services;
• cybersecurity;
• payment services;
• outsourced operational services;
• specialist technology support; and
• cash logistics.

BNM identifies third-party dependency and concentration as important Operational Resilience concerns.

It notes that substitution can become difficult when dependency chains are opaque or when financial institutions rely on a concentrated set of specialist providers that cannot be easily replaced.

The resilience question should therefore extend beyond:

Does the provider have a Business Continuity Plan?

MBSB should ask:

• Which CBSs depend upon this provider?
• What service does the provider actually support?
• What is the provider's realistic recovery capability?
• What fourth parties does the provider depend upon?
• Does the provider support multiple MBSB CBSs?
• Could several financial institutions be affected simultaneously?
• Is there a realistic substitute?
• How long would substitution take?
• Has the provider participated in resilience testing?

This moves third-party management from contractual compliance toward service resilience assurance.

Characteristic 8 — Cybersecurity as a Service Resilience Issue

Financial institutions remain highly exposed to cyber threats.

BNM identifies increasingly sophisticated cyber threats including AI-enabled attacks, ransomware, attacks targeting critical infrastructure, destructive malware, third-party attacks and software-supply-chain exploitation.

Cybersecurity is therefore inseparable from MBSB's Operational Resilience.

However, the two disciplines ask different questions.

Cybersecurity

How do we prevent, detect, contain and respond to the cyber incident?

Operational Resilience

If the cyber incident succeeds, can the affected Critical Business Service remain within its Impact Tolerance?

For example, ransomware affecting banking infrastructure may require MBSB to determine:

• whether account information remains trustworthy;
• whether payment services can continue;
• whether alternative arrangements are available;
• whether compromised environments can be isolated;
• whether customer communication channels remain available;
• whether manual procedures are viable;
• whether recovery data is clean; and
• how quickly customer harm becomes unacceptable.

Cyber resilience should therefore be tested as part of CBS scenario testing, rather than exclusively through technology-level exercises.

Characteristic 9 — Data Integrity Is as Important as Availability

Banking services depend upon accurate information.

This includes:

• customer identities;
• account balances;
• transaction history;
• financing information;
• payment instructions;
• authentication records;
• settlement information; and
• reconciliation data.

BNM specifically includes the compromise of data and information assets among the types of disruption that can cause widespread loss of access to essential financial services.

This means MBSB should not define resilience solely as availability.

A banking platform may be running, but if the bank cannot determine whether balances and transaction records are accurate, safe service delivery may not be possible.

The resilience model should therefore consider:

Availability

Can information and services be accessed?

Integrity

Can the information be trusted?

Confidentiality

Is sensitive information appropriately protected?

Recoverability

Can trustworthy information be restored following disruption?

For a financial institution, these dimensions are closely connected.

Characteristic 10 — Multiple Service Delivery Channels

A bank may provide services through different channels such as:

• digital banking;
• physical branches;
• self-service facilities;
• ATMs;
• customer contact centres; and
• alternative service arrangements.

Multiple channels can potentially improve resilience.

However, their value depends upon whether they are genuinely independent.

For example:

Mobile Banking

ATM

Branch Teller

↓

Same Core Banking Platform

If the common core platform fails, all three channels may become unavailable.

Likewise:

Digital Banking

Call Centre

↓

Same Telecommunications Provider

A telecommunications outage could affect both channels simultaneously.

MBSB should therefore evaluate alternative channels based on dependency independence, not merely channel availability.

This is particularly important when establishing contingency strategies.

Characteristic 11 — Exposure to Physical and Environmental Disruption

MBSB's resilience profile is not exclusively digital.

Branches, offices, data centres, employees, external providers and physical infrastructure may be affected by environmental and infrastructure disruption.

BNM identifies physical climate risks such as floods, heatwaves, wildfires and storms as potential causes of disruption to branches, data-centre operations and logistics networks. It also observes that high-impact events can create multi-layered outages lasting several days.

For MBSB, relevant scenarios could include:

Severe Flood

↓

Facilities Unavailable

Workforce Displacement

Telecommunications Failure

Supplier Disruption

↓

Multiple CBSs Affected

Operational Resilience, therefore, requires MBSB to move beyond traditional single-event exercises and to consider correlated failures.

Characteristic 12 — Importance of People and Specialist Knowledge

Technology is essential, but Operational Resilience remains dependent upon people.

Specialist employees may be required to:

• operate critical processes;
• manage exceptions;
• investigate transactions;
• manage cyber incidents;
• recover systems;
• perform reconciliations;
• communicate with customers;
• coordinate external providers;
• manage crises; and
• authorise critical decisions.

MBSB should therefore identify where critical knowledge is concentrated.

Questions should include:

• Is a critical activity dependent upon one or two specialists?
• Are backup personnel trained?
• Can key activities be performed remotely?
• Are decision-making authorities delegated?
• Are recovery procedures sufficiently documented?
• Are specialist external resources available during industry-wide disruption?

People should therefore be mapped as an explicit CBS dependency.

Characteristic 13 — Strong Regulatory and Governance Environment

As a Malaysian licensed Islamic bank, MBSB operates within a regulated environment in which service continuity, technology resilience, Operational Risk, third-party risk and governance are subject to BNM oversight.

BNM's 2025 Discussion Paper identifies governance and accountability as key elements of Operational Resilience and underscores the need for Board involvement and cross-functional responsibility.

For MBSB, Operational Resilience governance should therefore connect:

Board Oversight

↓

Senior Management Accountability

↓

Operational Resilience Steering Committee

↓

Critical Business Service Owners

↓

Resource and Functional Owners

This structure should provide:

• clear accountability;
• challenge;
• prioritisation;
• escalation;
• resource allocation;
• remediation oversight; and
• evidence of resilience improvement.

Governance should ultimately focus on outcomes rather than compliance documentation alone.

Characteristic 14 — Need to Balance Commercial Efficiency and Resilience

Operational Resilience requires investment.

Examples include:

• architectural improvements;
• additional redundancy;
• alternative providers;
• stronger monitoring;
• increased capacity;
• improved recovery arrangements;
• scenario testing;
• workforce cross-training; and
• remediation of single points of failure.

BNM explicitly recognises that financial institutions face trade-offs between Operational Resilience and cost, innovation, safety, transparency and commercial priorities.

The Discussion Paper notes that investments in redundancy, architecture, monitoring and failover may require significant expenditure without producing immediate financial returns.

This has an important implication for MBSB.

Resilience investment should not be assessed solely by short-term financial returns.

A weakness that does not create immediate losses during normal operation may become highly significant during a severe disruption.

MBSB should therefore prioritise resilience investment according to:

Criticality of Service

Potential Customer Harm

Dependency Concentration

Probability and Severity of Disruption

Existing Resilience Capability

Cost and Practicality of Remediation

This creates a risk-informed basis for investment.

Characteristic 15 — Interdependence with the Wider Financial System

MBSB does not operate independently from Malaysia's financial system.

BNM notes that interconnected payment and market infrastructures mean disruption at one institution can propagate beyond the originating organisation. The benefits of resilience investment can therefore extend to consumers, counterparties and the broader financial system.

This means MBSB's resilience decisions can have consequences beyond its own balance sheet.

For example, failure of a critical payment service could affect:

• customers;
• receiving institutions;
• beneficiaries;
• corporate counterparties;
• payment infrastructure; and
• broader market confidence.

Operational Resilience should therefore consider both:

Institution-Level Resilience

and

System-Level Consequences

This aligns with the broader objective of maintaining confidence and stability within Malaysia's financial system.

Characteristic 16 — Need for Continuous Adaptation

MBSB's characteristics will not remain static.

Its operating model may evolve through:

• digital transformation;
• new products;
• changes in customer behaviour;
• new technologies;
• new third-party arrangements;
• cloud adoption;
• regulatory developments;
• organisational restructuring; and
• changes to financial infrastructure.

Operational Resilience must therefore be dynamic.

ISO 22316 is particularly relevant in this respect. It provides guidance on improving organisational resilience and emphasises the importance of tailoring it to the organisation rather than applying it uniformly.

ISO also describes organisational resilience as involving awareness of changing contexts, effective risk management, shared values, resilient culture and strong leadership. (ISO)

For MBSB, resilience should therefore be treated as an ongoing organisational capability, not a one-time compliance implementation.

Key Characteristics and Their Operational Resilience Implications

The characteristics discussed in this chapter can be consolidated as follows:

This profile provides a practical basis for tailoring MBSB's Operational Resilience implementation.

Translating Characteristics into Resilience Priorities

The characteristics identified should ultimately influence MBSB's implementation priorities.

A practical sequence is:

This prevents the OR programme from becoming a generic checklist.

Instead, the programme reflects how MBSB actually delivers financial services and where disruption could create unacceptable consequences.

Implications for MBSB's Proposed Critical Business Services

The characteristics identified in this chapter reinforce the relevance of the proposed MBSB CBS catalogue:

The catalogue demonstrates why organisational characteristics must be understood before resilience measures are designed.

Different CBSs are important for different reasons.

Questions MBSB Should Continue to Ask

As its Operational Resilience programme develops, MBSB should periodically reassess questions such as:

• Has MBSB's customer profile changed?
• Are customers becoming more dependent on digital channels?
• Have any CBSs become more time-sensitive?
• Have new common technology dependencies emerged?
• Has reliance on a particular provider increased?
• Are alternatives genuinely independent?
• Has new technology introduced additional concentration risk?
• Have cyber threat scenarios changed?
• Are existing Impact Tolerances still appropriate?
• Have customer expectations changed?
• Are new regulatory requirements emerging?
• Have incidents or near misses revealed previously unknown vulnerabilities?
• Have major transformation programmes changed the end-to-end service model?

Operational Resilience becomes effective when these questions form part of normal management decision-making.

The key characteristics of MBSB Bank provide the context within which its Operational Resilience programme should be designed and implemented.

MBSB is a regulated Islamic bank serving retail, SME and corporate customers, operating in an increasingly digital and interconnected financial environment.

Its services depend on technology, reliable information, telecommunications, payment infrastructure, third parties, specialist personnel, and multiple service channels.

These characteristics create both strengths and vulnerabilities. Digital channels can provide customers with greater accessibility but increase dependency on technology and telecommunications. Multiple service channels can provide alternatives but may share common infrastructure.

Outsourcing can provide specialised capabilities but introduces external dependencies and concentration risk. Interconnected payment infrastructure enables efficient financial services but also creates the possibility that disruption can propagate beyond MBSB.

BNM's 2025 Discussion Paper reinforces the importance of understanding these characteristics.

Rapid digitalisation, complex dependency chains, cyber threats, third-party concentration, changing customer expectations, and interconnected infrastructure mean that financial institutions should develop resilience capabilities to sustain critical services under stress.

ISO 22316 complements this perspective by recognising that organisational resilience must be appropriate to the individual organisation's needs and should be supported by adaptive capacity, leadership, awareness of changing circumstances and an organisational culture that supports resilience. (ISO)

For MBSB, the central lesson is:

Operational Resilience should reflect the characteristics of the organisation, not merely the characteristics of the disruption.

Understanding MBSB's customer profile, service model, technology dependencies, payment connections, third-party relationships and regulatory environment allows the bank to determine where resilience matters most and what capabilities should receive priority.

These characteristics provide the necessary foundation for the final stage of understanding MBSB before detailed implementation begins: establishing organisational goals and objectives for Operational Resilience.

Those goals should translate the organisational context, operating environment, Critical Business Services and resilience characteristics developed throughout this eBook into a clear direction for MBSB's subsequent Operational Resilience programme.