Mapping Interconnections and Interdependencies is a core implementation activity in MBSB's Operational Resilience programme.
Having identified CBS-1 Customer Deposit and Account Access Services and decomposed it into its supporting Sub-Critical Business Services (Sub-CBS), the next step is to understand how those processes connect to one another and what each process relies upon for successful delivery.
The mapping distinguishes between two related but different concepts.
An interconnection describes how components interact. It identifies the pathways through which transactions, information, decisions, approvals and services move between processes, systems, business units and external parties.
Interdependence describes why one component relies on another.
It identifies the people, technology, data, facilities, third parties and other Critical Business Services whose availability, integrity or performance is necessary for a Sub-CBS to operate effectively.
This distinction is important because identifying a resource alone does not provide an adequate view of resilience.
MBSB also needs to understand where the resource sits in the end-to-end service chain, what it receives and produces, which other processes depend on it, and what happens to CBS-1 if the dependency fails.
BCM Institute's Operational Resilience methodology similarly distinguishes connectivity from dependency.
Mapping interconnections establishes how resources interact and how services, information and operational support flow across the service architecture, while mapping interdependencies identifies the resources upon which service delivery relies.
Together, they provide a basis for identifying concentration risks, single points of failure and cascading disruption pathways.
For MBSB, this is particularly relevant to Customer Deposit and Account Access Services, because delivery may involve multiple customer channels, account-processing capabilities, authentication services, operational teams, data repositories, technology infrastructure, telecommunications services and external service providers.
Failure in a common component can therefore affect several Sub-CBS simultaneously.
BNM's supervisory focus is also increasingly directed toward this type of dependency risk.
BNM reported in its Financial Stability Review that targeted reviews of financial institutions' business continuity arrangements identified the need to accelerate identification of single points of failure, particularly across online banking, ATMs and call centres, and to strengthen joint continuity testing with critical third-party service providers.
BNM also issued its Operational Resilience
Discussion Paper on 19 December 2025, setting out future regulatory considerations for financial institutions' resilience posture and practices.
Accordingly, this mapping is intended to:
The mapping is based on reasonable banking-sector assumptions, in which MBSB-specific system names, provider arrangements, or detailed operating procedures are not publicly available.
These assumptions should therefore be validated by the responsible owners of MBSB business, operations, technology, cybersecurity, and third-party management during implementation.
The analysis uses the previously identified 18 Sub-CBS processes as the primary units of analysis.
The service chain can broadly be represented as:
Throughout this chain, a number of other MBSB Critical Business Services may act as interconnected services or dependencies.
The most material expected relationships include:
These relationships should not be interpreted to mean that every interconnected CBS is always required for CBS-1 to operate.
Rather, the mapping identifies where customer journeys, information flows, transactions or recovery arrangements intersect with another Critical Business Service.
|
Name of Sub-CBS |
Connected Component |
Connection Type |
Interconnection Description |
Upstream Interconnections |
Downstream Interconnections |
|
CBS-1.1 Deposit Account Establishment and Activation |
Customer onboarding, customer due diligence, account-processing functions, account master records and access-enablement processes |
Process, data, internal function and system |
Establishes the customer's deposit account and creates the master records required for subsequent account maintenance, access, and transaction processing activities. The process acts as an originating point for the CBS-1 service chain. |
Customer application and instructions; customer identification and due-diligence information; product eligibility and account-opening requirements; internal approval or exception processes where applicable |
CBS-1.2 Customer and Account Information Maintenance; CBS-1.3 Account Status and Access Administration; CBS-1.5 Account Balance and Transaction Record Processing; CBS-1.6 Customer Account Enquiry and Information Access; CBS-1.9 Account Access Validation and Control |
|
CBS-1.2 Customer and Account Information Maintenance |
Customer records, account master data, contact details, mandates and servicing processes |
Process and information flow |
Maintains information used throughout the account lifecycle. Updates made here are consumed by access validation, customer enquiries, statement generation, restriction management and customer-support processes. |
CBS-1.1 account establishment; authorised customer change requests; customer servicing channels; validated identity and mandate information |
CBS-1.3, CBS-1.6, CBS-1.7, CBS-1.8, CBS-1.9, CBS-1.11 and customer-support processes |
|
CBS-1.3 Account Status and Access Administration |
Account servicing, compliance controls, restriction-management processes and customer access channels |
Process, control and decision flow |
Maintains the operational status of an account and communicates whether normal or restricted access should apply. Status changes directly influence customer access, transaction processing and enquiry responses. |
CBS-1.1 and CBS-1.2; compliance or fraud-related instructions; authorised business decisions; account-status events |
CBS-1.6 Customer Account Enquiry and Information Access; CBS-1.8 Account Access Request and Instruction Processing; CBS-1.9 Account Access Validation and Control; CBS-1.11 Account Restriction and Access Restoration |
|
CBS-1.4 Deposit Receipt and Account Credit Processing |
Deposit channels, incoming payment streams, account-processing functions and reconciliation processes |
Transaction and system interface |
Receives valid deposit or incoming-credit information and passes the resulting postings into account balance and transaction records. It connects CBS-1 with payment, cash and other credit-originating channels. |
Customer deposit instructions; CBS-2 Domestic Funds Transfer and Payment Services where incoming transfers credit deposit accounts; CBS-4 Cash Access and Cash Transaction Services where physical deposits are supported; other authorised incoming-credit sources |
CBS-1.5 Account Balance and Transaction Record Processing; CBS-1.6 Customer Account Enquiry and Information Access; CBS-1.7 Account Statement and Transaction Information Provision; CBS-1.12 Deposit Account Reconciliation and Integrity Management |
|
CBS-1.5 Account Balance and Transaction Record Processing |
Core account-processing capability, transaction feeds, balance records and ledger interfaces |
Data, transaction and processing connection |
Acts as a central processing point for maintaining account balances and transaction histories. Multiple upstream transactional services feed this process, while numerous downstream customer-access and reporting processes rely upon its outputs. |
CBS-1.4; completed debits and credits from CBS-2, CBS-4, CBS-6 Corporate Payment and Bulk Transaction Services and CBS-7 High-Value and Interbank Payment Services, where relevant to customer accounts |
CBS-1.6, CBS-1.7, CBS-1.8, CBS-1.12, CBS-1.13 and downstream reconciliation or financial-record processes |
|
CBS-1.6 Customer Account Enquiry and Information Access |
Branch and assisted-service channels, digital banking, account information services and customer-support channels |
Customer-channel and information interface |
Makes account balances, transaction history, status and related information available to authorised users. It connects central account records with customer-facing channels. |
CBS-1.2, CBS-1.3, CBS-1.5 and CBS-1.9; authentication and access decisions from CBS-8 Customer Transaction Authentication and Authorisation Services |
Customers; CBS-3 Digital Banking Services; branch or assisted servicing; CBS-9 Customer Support and Assistance During Banking Disruptions where customers require assistance |
|
CBS-1.7 Account Statement and Transaction Information Provision |
Account-processing records, statement-generation services, document delivery and customer-access channels |
Information and document flow |
Converts account and transaction records into customer-readable statements or formal account information and distributes them through authorised delivery mechanisms. |
CBS-1.2 Customer and Account Information Maintenance; CBS-1.5 Account Balance and Transaction Record Processing; statement request or scheduled production process |
Customer delivery channels; CBS-3 Digital Banking Services where electronic statements are provided; customer servicing and dispute-resolution processes |
|
CBS-1.8 Account Access Request and Instruction Processing |
Customer channels, account servicing, authentication and transaction-routing processes |
Customer instruction and transaction-flow connection |
Receives customer account-access requests or account-related instructions and routes validated requests to the appropriate processing path. It is a key hand-off between customer channels and account-processing functions. |
Customers; branch and contact-centre channels; CBS-3 Digital Banking Services; account details from CBS-1.2 and account status from CBS-1.3 |
CBS-1.9 Account Access Validation and Control; appropriate account-processing activity; CBS-1.10 Account Access Exception and Rejection Management where the instruction cannot proceed |
|
CBS-1.9 Account Access Validation and Control |
Identity, authentication, authorisation, account status, fraud and security controls |
Control, decision and system interface |
Determines whether an account-access request or instruction may proceed. It receives customer, account, security and authorisation information and passes an approval or rejection outcome downstream. |
CBS-1.2, CBS-1.3, CBS-1.8 and CBS-8 Customer Transaction Authentication and Authorisation Services; applicable security or fraud controls |
Approved requests proceed to the relevant account or transaction process; rejected or uncertain requests flow to CBS-1.10 or CBS-1.11 |
|
CBS-1.10 Account Access Exception and Rejection Management |
Failed requests, operational support, customer servicing and technology-support processes |
Exception and escalation connection |
Receives unsuccessful or rejected access attempts and coordinates resolution, correction or escalation. It prevents failed requests from remaining unresolved and enables valid requests to return to the normal service path. |
Rejections or failures from CBS-1.8 and CBS-1.9; channel or application errors; account-processing exceptions; customer reports |
Resolved requests return to CBS-1.8 or normal access; restrictions may proceed to CBS-1.11; systemic problems escalate to CBS-1.13 and CBS-1.14 |
|
CBS-1.11 Account Restriction and Access Restoration |
Account control functions, security and fraud management, servicing teams and authentication capabilities |
Control and restoration connection |
Applies or removes authorised account-access restrictions and reconnects the customer to normal account access after conditions for reinstatement have been satisfied. |
CBS-1.3, CBS-1.9, CBS-1.10; compliance, fraud or security decisions; authorised customer remediation information |
Restored access flows back to CBS-1.6 and CBS-1.8; unresolved or widespread access problems may escalate through CBS-1.13, CBS-1.14 and CBS-9 |
|
CBS-1.12 Deposit Account Reconciliation and Integrity Management |
Account transaction records, ledger records, reconciliation outputs and exception-management functions |
Data reconciliation and assurance connection |
Compares information from relevant processing sources to detect incomplete, duplicate, mismatched or inaccurate account postings. It is a key integrity hand-off between transaction processing and validated customer account information. |
CBS-1.4, CBS-1.5; transaction feeds from interconnected payment and cash services; recovery outputs from CBS-1.17 |
Corrected or validated information returns to CBS-1.5, CBS-1.6 and CBS-1.7; significant integrity issues escalate to CBS-1.13 and CBS-1.14 |
|
CBS-1.13 Account Access Service Monitoring and Exception Escalation |
Operational monitoring, technology monitoring, service management, customer-complaint indicators and incident-management processes |
Monitoring, event and escalation flow |
Consolidates operational indicators and exceptions to determine whether CBS-1 is degrading or disrupted. Provides the escalation bridge from normal operations to incident response. |
Service indicators from CBS-1.4–CBS-1.12; technology availability data; transaction backlogs; access-error trends; customer complaints and channel alerts |
CBS-1.14 Customer Account Access Incident Management; technology and cyber response; operational management; CBS-9 Customer Support and Assistance During Banking Disruptions where customer communication is required |
|
CBS-1.14 Customer Account Access Incident Management |
Enterprise incident management, technology recovery, cybersecurity response, business continuity, operations and customer communication |
Incident coordination and decision connection |
Coordinates cross-functional response when disruption becomes material to CBS-1. It receives impact information and directs containment, workaround, recovery and restoration activities. |
CBS-1.13 escalation; technology or cyber incidents; reports from business operations; third-party incident notification; customer-impact information |
CBS-1.15, CBS-1.16, CBS-1.17, CBS-1.18; enterprise crisis management where required; CBS-9 for disrupted-customer support |
|
CBS-1.15 Disrupted Account Access Customer Assistance |
Contact centre, branches, digital communication channels, incident management and customer-support functions |
Customer communication and support connection |
Converts incident and service-status information into practical customer assistance during disruption and routes individual cases requiring intervention to the appropriate operational process. |
CBS-1.14 incident status and approved messages; CBS-1.13 service information; account status and customer data where available |
Customers; CBS-9 Customer Support and Assistance During Banking Disruptions; CBS-1.11 where account-specific restoration is needed; CBS-1.16 where alternative access arrangements are offered |
|
CBS-1.16 Alternative Account Access and Continuity Processing |
Business continuity arrangements, alternative channels, authorised workarounds, operational teams and alternative technology capability |
Continuity and alternate-route connection |
Establishes alternate means of maintaining essential CBS-1 outcomes when the normal operating path is unavailable. It may reroute activities through available channels or approved manual/alternative procedures. |
Activation decision from CBS-1.14; information from CBS-1.13; continuity procedures; available customer channels; account and customer data |
Essential customer access; CBS-1.15 for customer guidance; CBS-1.17 for return to recovered processing; CBS-1.18 for transition back to normal service |
|
CBS-1.17 Deposit Account Processing Recovery and Reconciliation |
Technology recovery, backup or replicated data, account processing, queued transactions and reconciliation functions |
Recovery, data and transaction reconnection |
Restores processing capability and reconnects interrupted transactions to the account service. Ensures that transactions occurring before, during and after disruption are correctly accounted for before full restoration. |
Recovery activation from CBS-1.14; technology-recovery capability; backup/replicated data; queued transaction records; alternate-processing outputs from CBS-1.16 |
CBS-1.12 Deposit Account Reconciliation and Integrity Management; CBS-1.5 Account Balance and Transaction Record Processing; CBS-1.18 Account Access Service Restoration and Validation |
|
CBS-1.18 Account Access Service Restoration and Validation |
Recovered account processing, customer-access channels, monitoring, reconciliation, incident-management and service-acceptance processes |
Restoration and validation connection |
Provides the final end-to-end hand-off from disruption and recovery into stable normal service. It confirms that processing, access, data integrity and customer channels have been restored and remain stable. |
CBS-1.12, CBS-1.14, CBS-1.16 and CBS-1.17; restored technology services; validated transaction and account data |
Normal operations across CBS-1.4–CBS-1.13; customers; CBS-3, CBS-4, CBS-8 and CBS-9 where those interconnected services were affected; post-incident review and resilience improvement |
Several important service-level relationships emerge from the interconnection analysis.
CBS-1.5 Account Balance and Transaction Record Processing sits near the centre of the CBS-1 service architecture. Deposit credits, payments, cash transactions and other account movements ultimately rely on accurate maintenance of account balances and transaction records.
A severe failure at this point could therefore have a cascading effect on:
It should consequently be treated as a potential concentration point for further resilience analysis.
CBS-8 Customer Transaction Authentication and Authorisation Services is expected to be a significant interconnected CBS, particularly for:
A disruption to a common authentication capability could therefore leave the underlying deposit account operational while preventing customers from accessing it.
This distinction is important for impact tolerance analysis: availability of the account-processing system does not necessarily mean that the customer-facing CBS remains available.
CBS-3 Digital Banking Services, branch operations, assisted-service capabilities, and potentially CBS-4 Cash Access and Cash Transaction Services represent different pathways through which customers may access their funds or account information.
The resilience analysis should determine whether these channels are genuine substitutes during disruption or share common dependencies that could cause simultaneous failure.
CBS-1.13 through CBS-1.18 form a distinct resilience pathway:
A failure in this pathway may not cause the initial incident but can substantially increase its duration or customer impact.
|
Name of Sub-CBS |
People |
Systems and Technology |
Data and Information Flows |
Facilities |
Third Parties / External Entities |
Interconnected CBS |
Nature of Dependency |
Disruption Impact |
|
CBS-1.1 Deposit Account Establishment and Activation |
Customer onboarding personnel; branch or servicing officers; operations personnel; compliance/financial crime specialists where required |
Customer onboarding platform; core deposit/account platform; Customer Relationship Management Platform; document-management capability; identity-verification capability |
Customer identification; customer profile; account application; product selection; due-diligence information; account master data; operating instructions |
Branches and operational servicing locations where physical onboarding is supported; primary/recovery processing locations |
Identity-verification or supporting service providers where applicable; government or authorised data sources where legitimately used |
CBS-8 Customer Transaction Authentication and Authorisation Services where credentials or authentication relationships are established |
Relies on accurate creation of customer and account master records and successful hand-off to core account-processing and access-control capabilities. Customer identity and account information must remain complete, accurate and available. |
Failure may prevent new accounts from becoming operational, create incomplete account records or result in accounts that cannot subsequently be accessed or transacted upon. Prolonged failure creates onboarding backlog and customer-service impact. |
|
CBS-1.2 Customer and Account Information Maintenance |
Customer-servicing staff; operations personnel; authorised approvers; compliance specialists where relevant |
Core account platform; Customer Relationship Management Platform; document-management system; workflow capability |
Customer particulars; addresses and contact details; mandates; account instructions; servicing history; status amendments |
Branch and customer-servicing locations; operational processing locations |
Relevant verification or document-processing service providers where used |
CBS-3 Digital Banking Services; CBS-8 Customer Transaction Authentication and Authorisation Services |
Downstream services depend on current and accurate customer and account information. Incorrect amendments can propagate across channels and security controls. |
Unavailable or inaccurate data may prevent legitimate servicing, cause authentication failures, misdirect communications or result in inappropriate access restrictions. |
|
CBS-1.3 Account Status and Access Administration |
Account-servicing personnel; operational-control teams; compliance, fraud or security specialists; authorised decision-makers |
Core account platform; account-control workflow; case-management capability; access-control interfaces |
Account status; restriction codes; dormancy indicators; holds; freeze instructions; release approvals; reason codes |
Operational processing and customer-service locations |
Government, legal or regulatory authorities where lawful restrictions or instructions apply |
CBS-8 Customer Transaction Authentication and Authorisation Services |
Account access is dependent on correct status information and timely implementation or removal of restrictions. Status data may act as a gating control across multiple channels. |
Incorrect or unavailable status controls could deny legitimate customer access, permit inappropriate activity or create inconsistent access across channels. |
|
CBS-1.4 Deposit Receipt and Account Credit Processing |
Deposit-processing staff; operations personnel; exception-management and reconciliation teams |
Core banking/account platform; transaction processing interfaces; payment-processing capability; cash/deposit channel systems where applicable |
Account number; payer/depositor information; transaction amount; timestamps; value date; transaction reference; posting status |
Branch or cash-processing locations where applicable; central operational processing and technology facilities |
Payment network/service providers; banking counterparties; cash-processing providers where applicable |
CBS-2 Domestic Funds Transfer and Payment Services; CBS-4 Cash Access and Cash Transaction Services; potentially CBS-7 High-Value and Interbank Payment Services |
Depends on receipt of valid transaction instructions and connectivity between originating channels and the customer account ledger. |
Failure may delay or prevent expected deposits from appearing in customer accounts, create balance inaccuracies and cause customers to lose access to expected funds. |
|
CBS-1.5 Account Balance and Transaction Record Processing |
Core banking operations personnel; application-support specialists; database specialists; reconciliation teams |
Core banking/account-processing platform; transaction database; ledger interfaces; middleware/integration services; resilient hosting and storage |
Account balances; debits and credits; transaction histories; value dates; available balances; processing status |
Primary and recovery technology facilities; secure operational locations |
Technology infrastructure, telecommunications, hosting or support providers where outsourced |
CBS-2, CBS-3, CBS-4, CBS-6 Corporate Payment and Bulk Transaction Services, CBS-7 High-Value and Interbank Payment Services |
This is a high-concentration dependency. Numerous customer-facing and transactional processes require authoritative balance and transaction information from a common account-processing capability. |
Severe failure may affect account information and transaction processing across multiple channels and CBS simultaneously. Data corruption could require prolonged reconciliation even after technology restoration. |
|
CBS-1.6 Customer Account Enquiry and Information Access |
Branch personnel; contact-centre personnel; digital service support; operations personnel |
Core account platform; digital/mobile/web banking interfaces; API or middleware services; Customer Relationship Management Platform; authentication services |
Account balance; account status; recent transactions; customer profile; access credentials and authorisation results |
Branches; contact centres; technology processing locations |
Telecommunications, internet, mobile or hosting providers where applicable |
CBS-3 Digital Banking Services; CBS-8 Customer Transaction Authentication and Authorisation Services; CBS-9 Customer Support and Assistance During Banking Disruptions |
Depends simultaneously on authoritative account data, functioning customer channels, connectivity and successful authentication. Failure of any common component may make otherwise available account information inaccessible. |
Customers may be unable to determine account balances or transaction status, potentially generating high enquiry volumes and undermining confidence in account availability. |
|
CBS-1.7 Account Statement and Transaction Information Provision |
Statement-processing staff; customer-servicing personnel; operational support |
Core account platform; statement-generation engine; document-management/archive capability; digital delivery platform |
Account transaction history; customer identification and delivery information; statement period; balance information |
Processing facilities; branch locations for physical servicing where relevant |
Electronic delivery, printing or mailing service providers where outsourced |
CBS-3 Digital Banking Services where statements are delivered digitally |
Depends on complete transaction history and accurate customer information. Digital or physical delivery mechanisms constitute additional downstream dependencies. |
Customers may lose access to formal account records, affecting reconciliation, financial administration, disputes and evidentiary requirements. |
|
CBS-1.8 Account Access Request and Instruction Processing |
Branch staff; contact-centre personnel; operations personnel; digital operations support |
Digital banking platform; branch servicing platform; core account system; workflow and middleware capability |
Customer instruction; account number; transaction/request type; account status; channel information; timestamps |
Branches; contact centres; operational and technology locations |
Telecommunications or digital-channel providers where relevant |
CBS-3 Digital Banking Services; CBS-8 Customer Transaction Authentication and Authorisation Services |
Relies on continuous transfer of customer instructions from the access channel through validation into the relevant account-processing function. |
Requests may not reach the underlying account process, causing loss of effective account access even where core account infrastructure remains available. |
|
CBS-1.9 Account Access Validation and Control |
Fraud-management specialists; security personnel; customer-servicing staff; operations-control teams |
Identity and Access Management System; authentication platform; fraud/risk controls; core account status interface; security-monitoring capability |
Customer identity; credentials; device/session information; mandate information; account restrictions; authentication result; fraud indicators |
Technology and security operations locations |
Authentication, telecommunications or security-service providers where applicable |
CBS-8 Customer Transaction Authentication and Authorisation Services |
Strong dependency on CBS-8 and common identity/security capabilities. Correct validation must occur before account access can safely proceed. |
Failure may create either widespread denial of legitimate access or unacceptable security exposure. A common authentication outage could affect multiple customer-facing CBS concurrently. |
|
CBS-1.10 Account Access Exception and Rejection Management |
Customer-support personnel; operations teams; technical support; fraud/security specialists |
Case-management platform; service-management system; core account system; monitoring and diagnostic capability |
Rejection codes; error messages; account status; customer case history; technical incident information |
Customer-service and operational locations |
Relevant technology or communications providers during external faults |
CBS-3, CBS-8, CBS-9 where exceptions originate in or require assistance from those services |
Depends upon the ability to identify the failure source and transfer cases to the responsible team. Effective resolution relies on accurate diagnostic and account information. |
Unresolved exceptions accumulate, increasing customer access failures, complaint volumes and processing backlogs. Systemic access issues may remain undetected if exception information is fragmented. |
|
CBS-1.11 Account Restriction and Access Restoration |
Operations personnel; fraud/security teams; compliance specialists; customer-servicing staff; authorised approvers |
Core account-control functionality; authentication platform; case-management workflow; access-management system |
Restriction reason; account status; customer evidence; investigation outcomes; authorisation to restore access |
Operational servicing locations |
External authorities where restrictions originate from legal or statutory instructions |
CBS-8 Customer Transaction Authentication and Authorisation Services; CBS-9 Customer Support and Assistance During Banking Disruptions |
Restoration depends on accurate determination that restriction conditions have been resolved and synchronised removal of restrictions across account and channel controls. |
Customers may remain locked out after the original issue is resolved, or access could be restored prematurely. High volumes of unresolved restrictions could create material customer detriment. |
|
CBS-1.12 Deposit Account Reconciliation and Integrity Management |
Reconciliation specialists; finance/operations personnel; application-support teams; database specialists |
Reconciliation platform/tools; core account platform; ledger systems; transaction repositories; reporting and exception-management tools |
Account postings; source transaction records; ledger records; exception items; reconciliation balances; recovery records |
Operational processing and technology locations |
External payment counterparties where transaction confirmation is needed |
CBS-2, CBS-4, CBS-6, CBS-7 |
Relies on access to complete source and destination transaction datasets. This dependency becomes particularly critical following outage or recovery. |
Inability to reconcile may leave balances or transaction histories unreliable. MBSB may need to restrict or delay full service restoration until account integrity is established. |
|
CBS-1.13 Account Access Service Monitoring and Exception Escalation |
Service-management personnel; operations control; Network/Security Operations personnel; incident managers; application-support specialists |
Infrastructure and application-monitoring platforms; service-management platform; security monitoring; operational dashboards; alerting capability |
Availability metrics; error rates; transaction failures; backlog volumes; customer complaints; security alerts; incident records |
Operations control centres; technology and security operations locations |
Telecommunications, infrastructure and technology service providers supplying alerts or service-status information |
CBS-3, CBS-4, CBS-8, CBS-9 where shared disruptions are detected |
Depends on timely, consolidated observability across customer channels, applications, infrastructure and operational indicators. Fragmented monitoring may prevent MBSB from recognising CBS-level degradation. |
Delayed detection or escalation can increase disruption duration, customer impact and the likelihood that impact tolerance is exceeded. |
|
CBS-1.14 Customer Account Access Incident Management |
Incident managers; business service owner; senior operations personnel; technology/cyber specialists; BCM/crisis management; communications; risk and compliance |
Incident-management and collaboration systems; monitoring platforms; recovery-management tools; communication capabilities |
Incident details; customer impact; affected processes; technology status; recovery estimates; decision logs; escalation information |
Primary or alternate command/coordination locations; secure remote-working capability |
Critical technology providers; telecommunications providers; other affected service providers; relevant external authorities depending on incident |
CBS-3, CBS-4, CBS-8, CBS-9, and any payment CBS affected by the same incident |
Requires coordinated information and decision-making across functions. The process is dependent on timely situational awareness and authority to invoke continuity and recovery actions. |
Poor coordination may extend disruption, result in inconsistent priorities, delay customer support and create uncontrolled recovery activity. |
|
CBS-1.15 Disrupted Account Access Customer Assistance |
Contact-centre agents; branch staff; customer-support specialists; communications personnel; incident liaison staff |
Customer Relationship Management Platform; telephony/contact-centre capability; digital notification services; account enquiry functionality |
Approved customer messages; service status; account status; customer contact information; case records; alternative-service instructions |
Contact centres, branches and alternate working locations |
Telecommunications providers; communication service providers |
CBS-9 Customer Support and Assistance During Banking Disruptions; CBS-3 Digital Banking Services where digital communications are used |
Depends on accurate and timely incident information plus functioning communication channels. It may also depend on account information remaining available even when transaction capability is degraded. |
Customers may receive inadequate or inconsistent guidance, increasing financial hardship, complaints, attempted repeat transactions and pressure on remaining service channels. |
|
CBS-1.16 Alternative Account Access and Continuity Processing |
Business continuity teams; branch/contact-centre personnel; operational staff; authorised decision-makers; technology support |
Alternate processing capability; recovery systems; alternative channels; secure remote access; manual/workaround procedures where approved |
Essential account data; customer identification information; priority instructions; continuity records; transaction logs created during workaround operation |
Alternate sites; available branches; recovery facilities; secure remote-working locations |
Critical technology, telecommunications, hosting or operational service providers |
CBS-3, CBS-4, CBS-8, CBS-9, depending on the alternate customer-access solution |
Alternate service is only resilient if it does not share the same failed dependency as the primary service. Capacity, data access and authentication remain key dependencies. |
Failure or inadequate capacity of alternate arrangements may leave MBSB without a viable way of maintaining essential account access, increasing the likelihood of impact-tolerance breach. |
|
CBS-1.17 Deposit Account Processing Recovery and Reconciliation |
Technology recovery specialists; database administrators; application teams; account operations; reconciliation specialists; incident management |
Disaster recovery environment; backup/replication technology; core account platform; transaction queues; reconciliation tools; integration services |
Backup or replicated account data; recovery checkpoints; queued transactions; transaction logs; reconciliation information; recovery-status data |
Disaster recovery/data recovery facilities; alternate operational locations |
Hosting, cloud, telecommunications and specialist technology-support providers where relevant |
CBS-2, CBS-3, CBS-4, CBS-6, CBS-7, CBS-8 where shared systems or transaction interfaces require coordinated recovery |
Depends on recoverable technology, valid data and orderly restoration of upstream/downstream interfaces. Recovery sequence is important because connected services may otherwise introduce duplicate or missing transactions. |
Failed or incomplete recovery can extend the outage or introduce data-integrity problems. The customer-facing service may remain unavailable even after infrastructure is technically restored. |
|
CBS-1.18 Account Access Service Restoration and Validation |
Service owner; operations teams; application and infrastructure specialists; reconciliation teams; incident management; customer-support leadership |
Restored core account platform; customer channels; monitoring platforms; authentication services; reconciliation capability; service-management tools |
Restoration evidence; reconciled balances; transaction status; exception backlog; service-performance metrics; customer-impact data |
Normal and recovery operating locations during transition |
Relevant technology and telecommunications providers confirming service restoration |
CBS-3, CBS-4, CBS-8, CBS-9 and affected payment CBS |
Full restoration depends on all material end-to-end components operating together, not merely recovery of the originating failed system. Validation must include data integrity, channel access and stable service performance. |
Premature restoration could expose customers to incorrect balances, failed transactions or repeated outages. Delayed validation prolongs disruption and may increase the likelihood of exceeding impact tolerance. |
The mapping identifies several dependencies that warrant particular attention in MBSB's subsequent resilience analysis.
A core account-processing capability is likely to be one of the most significant points of concentration for CBS-1 because multiple Sub-CBS rely on the same authoritative account, balance, and transaction records.
The failure of this capability may simultaneously affect:
Resilience should therefore not be assessed solely by the platform's nominal availability target. MBSB should determine whether the surrounding integration, data, database, hosting, network and recovery components contain hidden single points of dependency.
CBS-1 has a material relationship with CBS-8 Customer Transaction Authentication and Authorisation Services.
If multiple access channels use the same underlying identity or authentication service, the apparent diversification provided by mobile, web, contact centre, or branch access may be less resilient than it first appears.
MBSB should therefore test whether:
This is an important distinction between channel redundancy and genuine service resilience.
Customer access and internal processing can rely heavily on network and telecommunications connectivity.
A telecommunications dependency may span:
The mapping should therefore identify whether different services described as "alternative" routes depend upon the same telecommunications infrastructure.
During a major disruption, CBS-9 may experience a rapid increase in customer demand precisely when CBS-1 becomes unavailable.
This creates an important two-way dependency:
while simultaneously:
This dependency should be reflected in both impact tolerance assessment and scenario testing.
Disaster recovery arrangements are sometimes treated as resilience solutions rather than dependencies.
For Operational Resilience purposes, however, recovery capabilities should themselves be mapped and tested as dependencies.
A recovery environment may depend upon:
The existence of a disaster recovery environment therefore does not automatically demonstrate resilience.
CBS-1 depends not only on system availability but also on the accuracy, completeness, and integrity of account data.
For deposit services, restoring an application without confidence in customer balances may not constitute an effective restoration of the Critical Business Service.
MBSB should therefore treat data integrity, reconciliation and transaction completeness as key conditions when determining whether CBS-1 has returned within acceptable service parameters.
The following relationships merit explicit consideration when MBSB develops its enterprise-wide CBS map.
|
Interconnected CBS |
Principal Relationship with CBS-1 |
Potential Cascading Effect |
|
CBS-2 Domestic Funds Transfer and Payment Services |
Transfers into or from deposit accounts depend on account availability, balance information, and transaction posting. |
CBS-1 disruption may prevent or delay payment initiation/posting; CBS-2 disruption may delay expected account credits or debits. |
|
CBS-3 Digital Banking Services |
Provides a major channel for customers to access CBS-1 information and initiate account-related activities. |
Digital channel failure may render CBS-1 inaccessible to customers even when underlying account processing remains operational. |
|
CBS-4 Cash Access and Cash Transaction Services |
Provides an alternative means to obtain or deposit physical cash associated with customer accounts. |
Common account or authentication failure may affect both digital and cash access, reducing effective channel substitution. |
|
CBS-6 Corporate Payment and Bulk Transaction Services |
Corporate account transactions may create high-volume debit or credit postings against relevant deposit accounts. |
Bulk-processing disruption can create large transaction backlogs and reconciliation pressure on CBS-1. |
|
CBS-7 High-Value and Interbank Payment Services |
Certain account credits or debits may depend upon high-value or interbank settlement processes. |
Settlement disruption can delay final account positions and create liquidity, customer and reconciliation implications. |
|
CBS-8 Customer Transaction Authentication and Authorisation Services |
Provides critical validation enabling authorised access to accounts and transactions. |
A common authentication failure can deny account access across several channels simultaneously. |
|
CBS-9 Customer Support and Assistance During Banking Disruptions |
Supports customers during disruption and communicates alternative arrangements or service status. |
If CBS-1 and CBS-9 are simultaneously degraded, MBSB may experience substantially greater customer harm and reduced ability to mitigate disruption. |
The enterprise Operational Resilience map should eventually enable MBSB to identify dependencies that recur across several CBSs.
These recurring components should be considered candidates for an enterprise concentration risk analysis.
The mapping provides the foundation for the next implementation activity: Establish Impact Tolerances [iTo].
Impact tolerance should be established for the customer-facing Critical Business Service, rather than merely adopting the recovery objectives of individual systems or processes.
For CBS-1, the dependency map helps MBSB determine:
For example, establishing that an application can recover within a specified time does not demonstrate that CBS-1 will remain within tolerance if:
The dependency map therefore allows MBSB to test the credibility of the impact tolerance, rather than treating it as an isolated numerical threshold.
Mapping also provides the evidence base for identifying Severe but Plausible Scenarios [SbPS].
A useful scenario should challenge important dependencies identified in the service architecture rather than merely select a generic disruptive event.
For CBS-1, scenario themes could include:
A failure affecting CBS-8 prevents customer authentication across mobile, online and assisted channels despite the continued availability of the core account platform.
This tests whether apparent channel diversity provides genuine resilience.
A severe technology incident renders the core account-processing capability unavailable, affecting balances, transactions, and multiple customer access channels.
This tests concentration risk and recovery sequencing.
Account processing remains technically operational, but the integrity of balance or transaction data becomes uncertain.
This tests reconciliation, decision-making and MBSB's criteria for restricting or restoring access.
A common connectivity problem affects branches, digital channels, third-party interfaces or the recovery environment.
This tests whether alternative arrangements share hidden common dependencies.
A critical external provider experiences a prolonged outage while MBSB's internal systems remain available.
This tests contractual recovery assumptions, provider escalation and alternative arrangements.
Digital banking is unavailable while contact-centre capacity is materially constrained by a surge in customer demand.
This tests the CBS-1/CBS-3/CBS-9 relationship.
The primary service is unavailable, and the expected recovery capability fails to operate as designed.
This tests whether MBSB can remain within impact tolerance when assumed resilience controls are themselves unavailable.
BCM Institute's methodology highlights that dependency mapping supports scenario design by making visible the pathways through which disruption can propagate and by identifying single points of failure and shared dependencies.
For regulatory or supervisory review, the completed mapping should allow MBSB to demonstrate that it understands CBS-1 as an end-to-end service, rather than as a list of systems or departments.
A reviewer should be able to trace:
BNM's recent supervisory commentary reinforces the relevance of this analysis. Its 2025 review work highlighted the importance of identifying single points of failure and improving joint continuity testing with critical third-party service providers, while recognising increasing complexity of dependencies across customer-facing financial services.
The CBS-1 map should be treated as a living Operational Resilience artefact.
It should be reviewed whenever there is a material change involving:
The map should also be updated where a scenario test reveals a previously unidentified dependency.
This is important because dependency structures evolve. A service that appears resilient today can gradually become concentrated around a new shared technology, provider, platform or specialist team.
The completed Mapping of Interconnections and Interdependencies provides MBSB with a structured end-to-end view of CBS-1 Customer Deposit and Account Access Services.
The analysis demonstrates that CBS-1 is not delivered by a single application, department, or customer channel.
It is produced through a connected ecosystem of account establishment, customer and account maintenance, transaction processing, account information, customer access, authentication, exception management, monitoring, incident response, customer support, continuity processing, recovery, reconciliation and restoration.
The interconnection map shows how these components interact and how services, data, instructions and decisions move through the end-to-end service chain.
The interdependency map shows what each Sub-CBS relies on and how disruptions to those dependencies could affect the customer-facing service.
Together, the two maps reveal several potential areas requiring further analysis, including:
This information provides the foundation for Establishing Impact Tolerances [iTo]. MBSB can use the map to determine which components are essential to maintaining acceptable customer outcomes, whether assumed alternative arrangements are genuinely independent, and whether underlying recovery capabilities are compatible with the tolerance established for CBS-1.
The mapping also provides the basis for Identify Severe but Plausible Scenarios [SbPS] and Perform Scenario Testing [ST]. Rather than testing generic incidents, MBSB can select scenarios that deliberately challenge identified concentration points, common dependencies, critical hand-offs and cross-CBS relationships.
The implementation sequence for CBS-1 Customer Deposit and Account Access Services
The mapping should ultimately support management decisions about where additional resilience investments are justified.
This may include eliminating single points of failure, strengthening recovery capabilities, increasing capacity, diversifying dependencies, enhancing monitoring, improving data recovery, strengthening third-party arrangements or establishing more credible alternative operating procedures.
Most importantly, the mapping should not become a static inventory produced solely for documentation or regulatory purposes.
Its value lies in enabling MBSB to understand where CBS-1 could fail, how disruption could propagate across the service ecosystem, and what must be strengthened to ensure that customers retain acceptable access to their deposit accounts during severe operational disruption.
This end-to-end perspective provides the necessary bridge from process identification to measurable and testable Operational Resilience.
The mapping approach in this chapter has been informed by BCM Institute's Operational Resilience methodology, which distinguishes between connectivity and reliance and uses mapping to support identification of failure points, concentration risk, impact tolerance setting and scenario testing.
It also takes account of Bank Negara Malaysia's developing Operational Resilience expectations.
BNM issued its Discussion Paper on Operational Resilience on 19 December 2025, and its subsequent Financial Stability Review highlighted supervisory attention to single points of failure, critical customer-facing services, third-party continuity arrangements and increasingly complex operational dependencies.
| eBook 3: Starting Your OR Implementation |
||||
| CBS-1 Customer Deposit and Account Access Services | ||||
| CBS-1 DP | CBS-1 MII | CBS-1 ITo | CBS-1 SbPS | CBS-1 ST |
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
|
If you have any questions, click to contact us. |
||
|
|