---
title: [OR] [MBSB] [E3] [CBS] [3] [ITo] Establish Impact Tolerances
description: [OR] [MBSB] [E3] [CBS] [3] [ITo] Establish Impact Tolerances
image: https://blog.bcm-institute.org/hubfs/MBSB%20Graphic%20Folder/MBSB%20CBS%203/%5BOR%5D%20%5BMBSB%5D%20%5BE3%5D%20%5BCBS%5D%20%5B3%5D%20%5BITo%5D%20Digital%20Banking%20Services.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Operational Resilience in Action: The MBSB Approach
![BB OR \[A\] 18](https://blog.bcm-institute.org/hs-fs/hubfs/OR%20picture/OR%20Pictures%20A/BB%20OR%20Folder%20A/BB%20OR%20%5BA%5D%2018.jpg?width=2000&height=1333&name=BB%20OR%20%5BA%5D%2018.jpg "BB OR [A] 18")
# \[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[ITo\] Establish Impact Tolerances
[![\[OR\] \[MBSB\] \[Full Banner\] Operational Resilience in Action The MBSB Bank's Approach ](https://no-cache.hubspot.com/cta/default/3893111/567eecca-dbad-4a1a-8465-5d45335ce5da.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/567eecca-dbad-4a1a-8465-5d45335ce5da)
Setting an Impact Tolerance for CBS-3: Digital Banking Services enables MBSB to establish the maximum level of disruption that can be accepted before customers, the bank, connected financial institutions, or the wider financial system experience unacceptable harm.
The assessment must be based on the consequences of disruption to essential banking activities rather than the technical recovery capabilities of individual applications.
It must therefore consider the entire customer journey, from digital access and authentication through account information retrieval, transaction initiation, payment coordination, customer communications, incident management, and service restoration.
Cybersecurity and ICT risks are integral to this assessment because cyberattacks, infrastructure failures, data corruption, network disruption, and technology concentration can impair several interconnected Sub-CBS processes simultaneously, potentially causing CBS-3 to exceed its Impact Tolerance even when some individual systems remain operational.
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/0430108a-ef49-43aa-ac7d-ee6bb474eba8)
[Dr Goh Moh Heng](https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng) Oct 14, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![x \[OR\] \[MBSB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/d779f9ab-aec0-4cdd-a906-81e7841c3e1c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d779f9ab-aec0-4cdd-a906-81e7841c3e1c)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0430108a-ef49-43aa-ac7d-ee6bb474eba8)**CBS-3 Digital Banking Services**
#### Introduction
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/1e4399ef-c884-48b2-a56d-c68bd01abfcf)[![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[ITo\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/56aa144a-f755-4aef-ab05-f29c3cd8ad89.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/56aa144a-f755-4aef-ab05-f29c3cd8ad89)
Setting an Impact Tolerance for CBS-3: Digital Banking Services enables MBSB to set the maximum level of disruption it can accept before customers, the bank, connected financial institutions, or the wider financial system experience unacceptable harm.
The assessment must be based on the consequences of disruption to essential banking activities rather than the technical recovery capabilities of individual applications.
It must therefore consider the entire customer journey, from digital access and authentication through account information retrieval, transaction initiation, payment coordination, customer communications, incident management, and service restoration.
Cybersecurity and ICT risks are integral to this assessment because cyberattacks, infrastructure failures, data corruption, network disruption, and technology concentration can impair several interconnected Sub-CBS processes simultaneously, potentially causing CBS-3 to exceed its Impact Tolerance even when some individual systems remain operational.
For MBSB, the central question is:
How much disruption to Digital Banking Services can we tolerate before customers can no longer perform essential banking activities safely, reliably, and within an acceptable period?
The answer requires measurable service disruption thresholds, customer-harm indicators, data integrity requirements, and management-approved escalation criteria.
The proposed assessment follows an Operational Resilience approach informed by the December 2025 BNM Discussion Paper on Operational Resilience and the BCM Institute's Impact Tolerance methodology.
The numerical thresholds and harm ratings presented below are illustrative implementation recommendations, not verified MBSB risk appetite decisions or prescribed BNM thresholds.
#### **Establishing the Impact Tolerance Assessment Framework**
##### **Definition and Assessment Boundary**
For this chapter, Impact Tolerance is defined as:
The maximum tolerable level of disruption to CBS-3 Digital Banking Services before the disruption causes unacceptable harm to customers, the bank, connected financial institutions, or the wider financial system.
The assessment boundary covers the end-to-end ability of customers to:
- Securely access supported digital banking channels.
- Authenticate and maintain authorised sessions.
- Obtain sufficiently accurate and timely account information.
- Initiate and authorise essential financial transactions.
- Receive reliable transaction outcomes.
- Obtain assistance and use approved alternative arrangements during disruption.
This boundary is broader than the availability of a mobile banking application or an internet banking portal. A customer may be able to log in but still be unable to transfer funds, obtain a reliable balance, or determine whether a payment has been completed.
Such circumstances constitute service degradation and must be evaluated against CBS-3's Impact Tolerance.
##### **Proposed Levels of Harm**
The following five-level scale provides a consistent basis for evaluating the consequences of Sub-CBS disruption.
| Level of Harm | Description | Indicative Application to CBS-3 |
| --- | --- | --- |
| Very Low | Minimal inconvenience with no material loss of essential banking capability. | Minor, short-lived interruption to a non-essential digital function with an effective alternative available. |
| Low | Limited customer inconvenience or operational delay that can be resolved without significant financial consequences. | Temporary inability to change non-critical preferences or access optional information. |
| Medium | Material service degradation affecting a defined customer group, with increasing inconvenience, operational workload or potential financial consequences. | Prolonged unavailability of statements, routine service requests or customer support capabilities. |
| High | Significant disruption to essential customer activities, affecting many customers or causing substantial delays, financial exposure or customer distress. | Widespread inability to access account information, initiate payments or obtain reliable transaction status. |
| Very High | Severe or potentially intolerable harm involving widespread loss of essential banking capability, compromised funds or transaction integrity, major regulatory consequences or possible wider financial-system effects. | Large-scale authentication failure, unauthorised transaction exposure, corrupted account information or simultaneous failure of essential digital banking and recovery arrangements. |
These ratings reflect the potential severity of harm during a prolonged or severe disruption, assuming the relevant process cannot be restored or effectively substituted.
They do not represent the likelihood of disruption or the current effectiveness of MBSB's controls.
##### **Principal Dimensions of Harm**
For CBS-3, the most relevant dimensions are customer access to essential financial services, transaction integrity, the number and vulnerability of affected customers, the duration and geographical extent of disruption, and the availability of safe alternatives.
Also assess financial market and financial stability implications where digital banking disruption affects significant payment flows, connected financial institutions, or shared financial infrastructure.
These consequences should not automatically be assumed for every individual Sub-CBS failure.
The following two tables use all 24 Sub-CBS processes as the primary units of analysis.
#### **[![Banner \[Table\] \[OR\] \[E3\] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/627c33a8-714d-40af-9a2b-0d7957fb8afa.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/627c33a8-714d-40af-9a2b-0d7957fb8afa)**
#### **Impact Tolerance Assessment by Sub-CBS**
This table identifies how disruption to each Sub-CBS could affect overall delivery of Digital Banking Services, the potential harm, and the indicators MBSB should monitor.
Interpretation: Harm ratings are indicative of severe-disruption assessments. Actual severity depends on the duration, customer population, time of occurrence, available alternatives, transaction exposure and effectiveness of mitigating controls.
Table P4: Establish Impact Tolerance for CBS-3
| Sub-CBS Code | Name of Sub-CBS | Potential Disruption | Potential Harm | Level of Harm | Key Harm Indicators |
| --- | --- | --- | --- | --- | --- |
| CBS-3.1 | Digital Banking Customer Registration and Enrolment | Enrolment and identity verification become unavailable or produce inconsistent registration decisions. | New customers cannot activate digital banking, potentially delaying access to essential financial services. Existing enrolled customers may remain unaffected. | Medium — material onboarding disruption, but usually less immediate harm than loss of existing customer access. | Enrolment outage duration; failed registrations; affected applicants; backlog age; number of customers unable to access an essential service. |
| CBS-3.2 | Digital Banking Access Activation and Maintenance | Legitimate access is suspended incorrectly, or customers cannot reactivate access after credential or device changes. | Affected customers lose digital banking access; compromised accounts may remain exposed if restrictions cannot be applied. | High — access loss can prevent essential transactions, particularly for customers without viable alternatives. | Customers locked out; access restoration time; failed reactivations; unresolved compromise cases; availability of alternative access. |
| CBS-3.3 | Digital Banking Channel Access and Service Availability | Mobile and internet banking channels become inaccessible due to application, network, or hosting failure. | Customers cannot access digital banking, retrieve account information or initiate essential transactions; disruption may extend across multiple channels. | Very High — a widespread channel outage can simultaneously disable several essential customer journeys. | Total and partial outage duration; percentage of active customers affected; unavailable channels; login success rate; essential journey completion rate; geographical scope. |
| CBS-3.4 | Digital Customer Authentication and Identity Verification | Shared authentication becomes unavailable, severely delayed or unreliable. | Customers cannot log in; incorrect authentication decisions may expose accounts to unauthorised access and affect other CBSs. | Very High — authentication is a critical access and security dependency shared across customer journeys. | Authentication success rate; affected customers; login latency; unauthorised access incidents; CBS-8 disruption; duration of access denial. |
| CBS-3.5 | Digital Session Establishment and Management | Sessions cannot be established, terminate unexpectedly or become insecure. | Customers cannot complete banking activities; interrupted sessions may create uncertainty about transaction submission or expose customer information. | High — widespread session instability can make an otherwise available channel unusable. | Session establishment failures; premature terminations; abandoned transactions; affected customers; suspicious session events; session error duration. |
| CBS-3.6 | Digital Access Security and Customer Account Protection | Protective account restrictions fail, are applied incorrectly or cannot be removed securely. | Unauthorised transactions may proceed, or legitimate customers may be denied access to funds and essential banking services. | Very High — compromised account protection can cause direct financial harm and undermine transaction integrity. | Suspected fraudulent access; unauthorised transaction value; time to restrict compromised accounts; false lockouts; unresolved security cases. |
| CBS-3.7 | Digital Account Information Retrieval and Presentation | Account balances or status information become unavailable, stale or inaccurate. | Customers may make financial decisions based on unreliable information, experience failed payments, or lose confidence in account integrity. | Very High — incorrect authoritative account information can cause immediate financial harm even without a prolonged outage. | Balance accuracy exceptions; data latency; unavailable account views; affected accounts; failed transactions caused by inaccurate information. |
| CBS-3.8 | Digital Transaction History and Statement Services | Transaction history and electronic statements cannot be retrieved or contain missing records. | Customers cannot verify previous transactions or obtain records needed for financial management, disputes or time-sensitive obligations. | Medium — material inconvenience and potential financial consequences, generally with a longer harm-development period than payment execution failure. | History retrieval failure rate; statement backlog; record completeness; data accuracy exceptions; affected customers; unresolved document requests. |
| CBS-3.9 | Digital Customer Profile and Banking Preference Management | Customer details or preferences cannot be updated, or the system accepts unauthorised changes. | Customers may miss important notifications; incorrect contact details can undermine account security and service communications. | High — integrity failures may create security and financial exposure, although routine update delays are usually lower harm. | Unauthorised profile changes; failed updates; incorrect contact records; notification failures; time to reverse unauthorised changes. |
| CBS-3.10 | Digital Banking Service Request Management | Digital service requests cannot be submitted, routed or completed. | Customers experience delays in account or financing administration, potentially affecting time-sensitive banking obligations. | Medium — consequences depend on the urgency and nature of the affected requests. | Pending requests; request backlog age; missed processing deadlines; affected customers; availability of manual alternatives. |
| CBS-3.11 | Digital Financial Transaction Initiation | Digital transaction instructions cannot be entered or submitted, or the channel produces ambiguous submission outcomes. | Customers cannot initiate essential payments or may submit duplicate instructions while attempting to complete transactions. | Very High — prolonged inability to initiate essential transactions can cause direct customer and business harm. | Failed initiation rate; essential transactions blocked; affected customers; duplicate submission attempts; transaction backlog; disruption duration. |
| CBS-3.12 | Digital Transaction Validation and Authorisation Coordination | Transaction authorisation fails, becomes unavailable or accepts invalid approvals. | Legitimate payments are blocked, or unauthorised transactions may proceed, compromising customer funds and payment integrity. | Very High — authorisation failure threatens both service continuity and transaction security. | Authorisation failure rate; unauthorised transaction attempts accepted; rejected legitimate payments; affected customers; security-control exceptions. |
| CBS-3.13 | Digital Payment and Funds Transfer Processing Coordination | Authorised digital payment instructions cannot reach payment services, or acknowledgements are lost. | Customers experience delayed or incomplete payments, duplicated instructions or uncertainty about funds transfers; downstream payment services may be affected. | Very High — disruption can prevent completion of essential payments and propagate to CBS-2. | Payment hand-off failure rate; pending transaction value and volume; duplicate instructions; acknowledgement latency; CBS-2 processing status. |
| CBS-3.14 | Digital Financing and Account Servicing Transactions | Financing information, servicing requests or repayment initiation become unavailable or inaccurate. | Customers may be unable to meet financing obligations or verify repayment outcomes, potentially incurring financial consequences. | High — significant harm may arise where repayment deadlines or essential servicing needs are affected. | Failed repayment requests; affected financing accounts; repayment posting delays; inaccurate financing balances; time-sensitive obligations missed. |
| CBS-3.15 | Digital Transaction Status and Completion Management | Transaction completion messages are delayed, lost, or presented incorrectly. | Customers cannot determine whether payments succeeded and may repeat instructions, creating duplicate transactions, disputes or financial uncertainty. | Very High — unreliable completion status can cause direct customer harm even when underlying payments are processing. | Unconfirmed transactions; status latency; incorrect completion messages; duplicate payments; reconciliation exceptions; affected transaction value. |
| CBS-3.16 | Digital Banking Customer Notification and Alert Management | Transaction alerts, security warnings or service notifications are delayed or not delivered. | Customers may not recognise suspicious activity, confirm payments or understand service restrictions and alternatives. | High — failure of security and transaction notifications can amplify fraud exposure and disruption-related harm. | Failed or delayed alerts; security-warning latency; undelivered transaction notifications; affected customers; alternative communication availability. |
| CBS-3.17 | Digital Banking Customer Enquiry and Assistance Management | Customer assistance channels become unavailable or overwhelmed during digital banking disruption. | Customers cannot obtain guidance, confirm transaction status or access assistance when essential digital services fail. | High — simultaneous loss of digital services and assistance can significantly increase customer harm. | Support-channel availability; unanswered enquiries; waiting times; urgent unresolved cases; vulnerable customers affected; CBS-9 capacity. |
| CBS-3.18 | Digital Banking Complaint and Service Issue Resolution | Complaints cannot be investigated because records, specialists or case management are unavailable. | Customers experience prolonged unresolved financial issues, delayed corrections and potential failures to meet applicable complaint-handling obligations. | High — serious harm may develop where disputed transactions or fraud cases remain unresolved. | Overdue complaints; unresolved financial exposure; investigation delays; missed applicable deadlines; customer redress backlog. |
| CBS-3.19 | Digital Banking Service Performance and Availability Monitoring | Monitoring fails to detect degraded customer journeys, abnormal transaction failures or widespread channel instability. | Service disruption continues without timely intervention, allowing customer harm to accumulate and delaying escalation. | High — detection failure can substantially prolong a disruption that might otherwise be contained. | Detection delay; unmonitored services; alert coverage gaps; customer complaints before alerts; time to recognise service deterioration. |
| CBS-3.20 | Digital Banking Security Event Detection and Response Coordination | Cybersecurity monitoring, incident investigation, or containment can become ineffective during a significant attack. | Malicious activity may spread, compromise customer information or transactions, and force suspension of digital banking services. | Very High — failure to contain a major cyber incident may cause simultaneous confidentiality, integrity and availability harm. | Time to detect and contain; compromised accounts; affected systems; suspected fraudulent value; security event backlog; service shutdown duration. |
| CBS-3.21 | Digital Banking Incident Assessment and Service Escalation | Incident severity is underestimated, escalation is delayed, or cross-functional coordination fails. | Delayed recovery and customer-protection measures increase the duration and scale of service disruption. | High — ineffective escalation can turn a contained incident into a prolonged CBS-level disruption. | Time to classify and escalate; time to activate continuity; affected customers; unresolved decisions; tolerance warning breaches. |
| CBS-3.22 | Digital Banking Continuity and Alternative Service Delivery | Approved alternative banking channels are unavailable, lack capacity or depend on the same failed infrastructure. | Customers cannot perform essential banking activities while normal digital services remain disrupted. | Very High — ineffective alternatives remove an important means of preventing unacceptable customer harm. | Essential service completion through alternatives; alternative-channel capacity; customers without access; backlog; continuity activation time. |
| CBS-3.23 | Digital Banking Technology Recovery and Service Reinstatement | Primary and recovery environments fail, recovery data is unusable or dependent systems cannot be reinstated. | Essential digital banking services remain unavailable beyond acceptable disruption boundaries, potentially affecting several CBSs. | Very High — prolonged or unsuccessful recovery can result in widespread, sustained loss of essential banking capability. | Actual recovery duration; recovery failures; backup integrity; dependency readiness; percentage of essential journeys restored; affected customers. |
| CBS-3.24 | Digital Banking Service Restoration and Post-Incident Validation | Digital channels reopen before transaction, security, or data integrity checks are complete. | Customers encounter incorrect balances, missing transactions, repeated failures or unsafe restored services. | Very High — premature restoration can create new financial harm and extend an existing disruption. | Failed end-to-end validation; unreconciled transactions; post-restoration error rates; reopened incidents; data integrity exceptions; customer complaints. |
##### **Key findings from Table P4: Establish Impact Tolerance for CBS-3**
The assessment indicates that the highest potential harm is concentrated around secure access, authoritative account information, transaction initiation and authorisation, payment coordination, transaction status integrity, cyber response, continuity and recovery.
These processes determine whether customers can complete essential banking activities, not just access a digital interface.
A second important finding is that several processes have relatively low immediate availability consequences but potentially serious integrity consequences.
For example, a short interruption to customer profile updates may be manageable, while an unauthorised change to a customer's contact information could facilitate account compromise.
Accordingly, CBS-3's Impact Tolerance must incorporate both availability-based boundaries and integrity-based boundaries.
#### **Cyber and ICT Risk Integration, Impact Tolerance Breach and Proactive Risk Management**
Cyber and ICT Risks are integrated into the Impact Tolerance assessment because they can affect both the availability and integrity of essential digital banking capabilities.
For example, a Distributed Denial-of-Service (DDoS) attack may prevent customers from accessing digital channels, while a compromised privileged account may permit unauthorised changes to authentication rules, customer information or transaction-processing configurations. A failed technology change may interrupt several interconnected CBSs, and a corrupted recovery database may prevent safe restoration even when infrastructure becomes available.
The following table identifies the relevant risks, potential contribution to a CBS-3 Impact Tolerance breach, recommended preventive and resilience measures, and auditable evidence that MBSB should maintain.
**Table: Cyber and ICT Risk Linkage and Proactive Risk Management**
| Sub-CBS Code | Name of Sub-CBS | Cyber and ICT Risk Linkage | Contribution to Impact Tolerance Breach | Proactive Risk Management Action | Evidence of Proactive Risk Management |
| --- | --- | --- | --- | --- | --- |
| CBS-3.1 | Digital Banking Customer Registration and Enrolment | Identity verification API outage, enrolment database corruption, fraudulent registration attempts or third-party verification failure. | Prolonged enrolment failure prevents new customers from obtaining essential digital access; compromised identity controls may create unauthorised accounts. | Test verification-provider failover; strengthen enrolment fraud controls; establish secure manual exception handling and backlog recovery procedures. | Approved onboarding ICT risk assessment; API failover test results; fraud-control testing; enrolment exception register; remediation records. |
| CBS-3.2 | Digital Banking Access Activation and Maintenance | Identity and Access Management failure, privileged access compromise, incorrect configuration, deployment, or synchronisation failure. | Widespread lockouts prevent customers from using CBS-3; failure to suspend compromised accounts creates integrity and financial harm. | Implement dual control for sensitive access changes, privileged access monitoring, resilient access administration and tested secure reactivation procedures. | Privileged access review; change-control approvals; access restoration exercise; monitoring logs; independent control review. |
| CBS-3.3 | Digital Banking Channel Access and Service Availability | DDoS attack, network routing failure, application outage, infrastructure failure, cloud or hosting disruption, capacity exhaustion. | Multiple essential digital banking journeys become unavailable; prolonged or widespread disruption may directly breach CBS-3 availability and customer-impact boundaries. | Implement DDoS protection, diverse network connectivity, capacity testing, application redundancy, channel failover and end-to-end customer journey monitoring. | DDoS simulation report; penetration testing; capacity stress results; failover test reports; network resilience assessment; service monitoring records. |
| CBS-3.4 | Digital Customer Authentication and Identity Verification | Authentication platform outage, credential attack, identity database failure, third-party authentication disruption or time synchronisation failure. | Customers cannot authenticate, potentially disabling all essential digital journeys; compromised authentication may create immediate security-related intolerance. | Test authentication redundancy, credential-attack detection, time synchronisation monitoring and secure failover without weakening authentication controls. | Authentication resilience test; cyber incident simulation; identity control assessment; synchronisation monitoring; remediation closure records. |
| CBS-3.5 | Digital Session Establishment and Management | Session database failure, application defects, token compromise, failed software deployment or capacity exhaustion. | Customers experience widespread session failures or transaction interruptions; compromised sessions may create unauthorised activity. | Test session resilience under peak demand; enforce secure token handling; validate session recovery and controlled termination after security incidents. | Session stress testing; application security assessment; change test evidence; session incident logs; recovery test results. |
| CBS-3.6 | Digital Access Security and Customer Account Protection | Account takeover, privileged access abuse, malware, compromised fraud rules or security-control integration failure. | Unauthorised account activity or inability to apply protective restrictions can cause immediate unacceptable financial harm. | Strengthen behavioural detection, account restriction controls, fraud-response integration and secure customer access restoration; test containment during active attacks. | Fraud-control effectiveness results; incident response exercises; privileged access reviews; penetration testing; fraud investigation and remediation records. |
| CBS-3.7 | Digital Account Information Retrieval and Presentation | Core banking interface failure, database corruption, stale cache, API latency, unauthorised data modification or failed replication. | Customers receive unavailable or inaccurate balances, potentially creating unsafe financial decisions and undermining transaction integrity. | Implement authoritative data validation, freshness controls, interface monitoring, reconciliation and suppression of unreliable information. | Data integrity test results; reconciliation reports; API monitoring; database recovery tests; approved data-quality exception records. |
| CBS-3.8 | Digital Transaction History and Statement Services | Transaction repository failure, ransomware, document corruption, data synchronisation failure or unauthorised disclosure. | Customers lose access to important financial records; prolonged data loss or disclosure can create financial and regulatory consequences. | Maintain protected transaction records, immutable or otherwise tamper-resistant backups, document integrity checks and tested restoration. | Backup restoration results; integrity-check records; access-control reviews; vulnerability assessments; records recovery test reports. |
| CBS-3.9 | Digital Customer Profile and Banking Preference Management | Customer database compromise, API manipulation, unauthorised profile changes, synchronisation defects or messaging integration failure. | Incorrect or malicious changes may redirect notifications, undermine account security or prevent essential communications. | Require strong authorisation for sensitive profile changes, independent alerts, change audit trails and reconciliation with authoritative customer records. | Profile change-control testing; security event logs; data reconciliation; privileged access review; customer-data integrity assessment. |
| CBS-3.10 | Digital Banking Service Request Management | Workflow application outage, failed integration, corrupted request records or unauthorised approval changes. | Essential service requests accumulate or are processed incorrectly, potentially causing time-sensitive customer harm. | Implement workflow queue monitoring, request integrity controls, controlled manual processing and tested backlog recovery. | Workflow resilience test; request backlog monitoring; approval-control testing; exception records; business continuity exercise. |
| CBS-3.11 | Digital Financial Transaction Initiation | Digital transaction interface failure, API disruption, malware, failed change, network latency or duplicate submission defects. | Customers cannot initiate essential transactions or may unintentionally create duplicate instructions; breach risk increases with duration and the volume of affected transactions. | Test transaction initiation under peak load and partial failure; implement unique transaction references, duplicate detection and safe retry controls. | API resilience testing, capacity reports, duplicate prevention test results, change validation, and transaction monitoring records. |
| CBS-3.12 | Digital Transaction Validation and Authorisation Coordination | Authentication compromise, transaction-rule manipulation, authorisation API outage, privileged access misuse or fraud-control failure. | Legitimate transactions are blocked, or unauthorised transactions are accepted, threatening both service availability and transaction integrity. | Apply secure transaction authorisation, dual control for critical rules, continuous fraud monitoring and tested fail-closed arrangements for high-risk failures. | Authorisation penetration tests; fraud-rule change approvals; control effectiveness tests; cyber simulations; privileged access monitoring. |
| CBS-3.13 | Digital Payment and Funds Transfer Processing Coordination | Payment API failure, network disruption, message queue corruption, payment gateway outage, time synchronisation failure or third-party ICT incident. | Payment instructions may be delayed, duplicated or left unconfirmed; disruption can propagate to CBS-2 and affect essential payment completion. | Implement resilient payment interfaces, durable message handling, duplicate detection, queue recovery, time synchronisation checks and end-to-end reconciliation. | Payment interface failover tests; transaction reconciliation; message integrity testing; network resilience reports; third-party assurance. |
| CBS-3.14 | Digital Financing and Account Servicing Transactions | Financing platform outage, database corruption, payment integration failure, failed deployment or ransomware. | Customers may be unable to initiate repayments or access accurate financing information before time-sensitive deadlines. | Test financing-service recovery, repayment interface continuity, data integrity controls and customer assistance arrangements for urgent obligations. | Financing recovery test; repayment reconciliation; application change testing; continuity exercise; exception and remediation registers. |
| CBS-3.15 | Digital Transaction Status and Completion Management | Lost acknowledgements, event messaging failures, database inconsistencies, delayed data feeds, or incorrect transaction-state processing. | Customers may repeat completed payments or remain unaware of failed transactions; material transaction integrity errors may breach tolerance immediately. | Implement authoritative status reconciliation, message replay controls, transaction-state validation, idempotency controls and alerting for prolonged pending status. | Transaction-state test results; reconciliation exceptions; messaging resilience tests; duplicate-payment controls; customer journey test evidence. |
| CBS-3.16 | Digital Banking Customer Notification and Alert Management | Messaging provider outage, telecommunications disruption, notification queue failure, compromised templates or customer contact data corruption. | Delayed security warnings and transaction alerts may amplify fraud and customer uncertainty, especially during wider digital service disruption. | Establish alternative communication channels, delivery monitoring, message integrity controls and priority handling for security-critical alerts. | Messaging failover testing; delivery monitoring; template change approvals; provider assurance; records of customer communication exercises. |
| CBS-3.17 | Digital Banking Customer Enquiry and Assistance Management | Contact centre system outage, telecommunications failure, cyber incident affecting case records or loss of remote support access. | Customers cannot obtain urgent assistance during a disruption; concurrent failure with CBS-3 or CBS-9 can accelerate customer harm. | Test alternative contact channels, support-capacity surge arrangements, secure remote access, and access to essential customer-service information. | Contact centre continuity test; capacity exercise; telecommunications resilience review; customer assistance logs; CBS-9 joint exercise results. |
| CBS-3.18 | Digital Banking Complaint and Service Issue Resolution | Case management database failure, ransomware, loss of transaction evidence, unauthorised case alteration or third-party information delays. | Customers may face prolonged unresolved disputes or fraud losses, increasing financial and regulatory exposure. | Protect complaint records, test case restoration, prioritise financially harmful cases and maintain secure investigation evidence and alternative processing. | Case recovery test; complaint ageing reports; audit trail reviews; evidence retention tests; remediation closure records. |
| CBS-3.19 | Digital Banking Service Performance and Availability Monitoring | Monitor platform failures, telemetry gaps, false-negative alerts, compromised monitoring credentials, and time synchronisation errors. | Customer-facing disruption remains undetected, increasing outage duration and allowing tolerance boundaries to be crossed before escalation. | Implement independent synthetic monitoring, customer journey indicators, alert coverage validation, clock synchronisation controls and monitoring failover. | Monitoring coverage review; synthetic test results; alert simulation; time synchronisation logs; detection-gap remediation records. |
| CBS-3.20 | Digital Banking Security Event Detection and Response Coordination | Ransomware, advanced persistent attack, security monitoring compromise, log tampering, privileged access abuse or delayed containment. | Cyber incidents may compromise customer information, transaction integrity and digital availability across multiple CBSs. | Conduct threat-led cyber exercises, strengthen detection engineering, segregate security administration, test containment and maintain clean recovery capabilities. | Cyber threat assessment; detection testing; incident simulation report; vulnerability remediation; privileged access review; cyber recovery test. |
| CBS-3.21 | Digital Banking Incident Assessment and Service Escalation | Incident platform outage, incomplete service telemetry, compromised communication tools, or dependency-visibility failure. | Delayed or incorrect decisions can let disruption worsen, potentially exceeding duration, customer impact, or integrity boundaries. | Establish CBS-level escalation triggers, alternative incident communications, dependency-aware impact assessment and crisis decision exercises. | Approved escalation matrix; crisis exercise results; incident decision logs; impact assessment templates; management review minutes. |
| CBS-3.22 | Digital Banking Continuity and Alternative Service Delivery | Shared infrastructure failure, telecommunications outage, alternative-channel capacity exhaustion, cyber compromise or third-party disruption. | Essential services cannot be delivered through normal or alternative channels, increasing the likelihood of a CBS-level breach. | Validate independence of alternatives, reserve essential capacity, test customer prioritisation, maintain secure workarounds and conduct multi-channel continuity exercises. | Alternative-channel dependency assessment; capacity test; business continuity exercise; third-party resilience evidence; corrective-action tracking. |
| CBS-3.23 | Digital Banking Technology Recovery and Service Reinstatement | Simultaneous primary and recovery outage, ransomware affecting backups, infrastructure concentration, database corruption or failed disaster recovery change. | Recovery cannot restore essential digital banking capability within acceptable disruption boundaries; integrity concerns may prohibit reopening. | Test independent recovery environments, immutable or protected backups, clean restoration, recovery sequencing and dependent CBS readiness under combined failure conditions. | Disaster recovery test; cyber recovery exercise; backup integrity report; architecture concentration review; management-approved remediation. |
| CBS-3.24 | Digital Banking Service Restoration and Post-Incident Validation | Residual malware, incomplete database replication, incorrect transaction states, failed interface restoration or premature production release. | Restored services may produce incorrect balances, duplicate payments, or renewed outages, causing severe customer harm. | Require formal business and security acceptance, end-to-end transaction testing, reconciliation, enhanced monitoring and controlled rollback arrangements. | Restoration sign-off; end-to-end test results; reconciliation evidence; security clearance; post-incident review; remediation closure records. |
##### **Interpretation of Cyber and ICT Risk Linkages**
Table 2 demonstrates that Cyber and ICT Risks affect CBS-3 through several distinct pathways.
Availability failures prevent customers from reaching or using digital banking services.
These include DDoS attacks, application outages, network disruption, failed technology changes and infrastructure failures.
Integrity failures compromise the reliability of account information, transaction instructions, authorisation decisions or completion status.
These failures can cause unacceptable harm before a prolonged outage occurs.
Security-control failures may permit unauthorised access or transactions, or may incorrectly deny legitimate customers access.
Concentration failures arise when several processes and CBSs depend on a common authentication platform, core banking interface, hosting environment, network provider or recovery arrangement.
Response and recovery failures prolong disruption because the bank cannot detect incidents, make timely decisions, activate viable alternatives or safely restore services.
Consequently, CBS-3's Impact Tolerance should not be expressed as a single application uptime target. It must address the combined consequences of these failure pathways.
#### **Recommended Impact Tolerance for Digital Banking Services**
##### **Proposed Impact Tolerance Statement**
For this implementation guide, MBSB should consider adopting the following illustrative Impact Tolerance statement for CBS-3:
CBS-3 Digital Banking Services should continue to provide customers with secure access to essential account information, authorised financial transaction initiation and reliable transaction outcomes during severe operational disruption.
A disruption should not prevent a material proportion of customers from completing essential digital banking activities for more than two consecutive hours without an effective, secure and demonstrably available alternative.
Treat any material compromise of customer funds, transaction authorisation, or authoritative financial data integrity as potentially intolerable, regardless of disruption duration.
This statement combines a duration boundary with customer impact, essential service capability, alternative arrangements and data integrity.
The two-hour threshold is an illustrative assessment assumption, not an approved MBSB Impact Tolerance or a BNM-prescribed limit.
MBSB should validate whether a shorter or longer boundary is justified by actual customer harm, transaction volumes, customer vulnerability, service usage, and the consequences of disruption during critical operating periods.
##### **Recommended quantitative and qualitative measures**
Illustrative CBS-3 Impact Tolerance profile
These figures are proposed starting points for a harm-based assessment. They are not regulatory limits or evidence of current MBSB performance.
Interpret the proposed measures together, not as independent permissions to allow disruption.
| Impact Tolerance Dimension | Indicative Measure or Boundary | Assessment Rationale |
| --- | --- | --- |
| Maximum tolerable disruption duration | No more than 2 consecutive hours when customers cannot complete essential digital banking journeys without an effective alternative. | Prolonged loss of account access and payment capability may prevent customers from meeting urgent financial needs. |
| Affected customer population | Up to 20% of active digital banking customers may be unable to complete essential journeys during a material disruption. | Establishes a measurable scope boundary and recognises that widespread disruption can create unacceptable harm before the duration threshold is reached. |
| Essential service completion capability | Maintain at least 80% successful completion of legitimate attempted essential journeys, or provide equivalent outcomes through validated alternatives. | Focuses on actual customer outcomes rather than application availability. |
| Customer transaction response and latency | Issue an illustrative warning at twice the approved normal response-time baseline for an essential journey, sustained for 15 minutes; evaluate resulting failures against the completion and customer-impact boundaries. | Persistent latency may make a service practically unusable even when the channel remains technically available. |
| Account information freshness | Account information required for essential financial decisions should remain authoritative and current. An illustrative warning may be set at 5 minutes of unexpected data staleness, subject to the underlying service's normal processing design. | Prevents customers from relying on misleading account information. The warning threshold does not allow materially incorrect balances to be displayed. |
| Transaction status integrity | No material unresolved inconsistency between authoritative transaction records and customer-facing completion status. | Incorrect payment confirmation or ambiguous transaction status may cause duplicate payments and immediate financial harm. |
| Security and authorisation integrity | Do not accept transactions known to be unauthorised because a required security control has failed. | Transaction integrity and customer fund protection cannot be traded against service availability. |
| Geographical and channel scope | Assess the simultaneous loss of mobile and internet banking, including regional concentration and common telecommunications dependencies. | Multiple channel failures may leave customers without viable digital alternatives. |
| Alternative service capability | Alternative arrangements must be demonstrably available, secure, adequately staffed, and able to meet essential customer needs. | An alternative that depends on the same failed infrastructure does not meaningfully reduce customer harm. |
| Regulatory and financial system impact | Escalate immediately where disruption creates a suspected material regulatory breach, significant financial harm or consequential effects on connected payment services. | Some consequences may become unacceptable before quantitative duration or customer-population limits are reached. |
Important interpretation: The 20% customer boundary and 80% completion measure are illustrative assessment parameters, not an assertion that a disruption affecting fewer customers is always acceptable.
Fewer customers may still experience intolerable harm when urgent payments, vulnerable customers, significant financial losses, or security compromise are involved.
##### **How the Proposed Boundaries Should Operate**
The proposed Impact Tolerance should use a multi-dimensional breach assessment.
A breach may occur when any approved material-harm boundary is crossed, even if the other measures remain within their thresholds.
For example:
- A two-hour digital channel outage affecting a material customer population could breach the duration boundary.
- A shorter outage affecting nearly all customers may breach the customer-scope boundary within two hours.
- A functioning channel that accepts unauthorised transactions may create an immediate integrity-related breach.
- A channel that remains available but cannot complete essential payments may breach the minimum service capability boundary.
- An outage affecting a small customer population may still create unacceptable harm if it prevents urgent access to funds and no safe alternative exists.
The precise breach criteria should be formalised in an approved CBS-3 Impact Tolerance statement, with separate warning, escalation and breach conditions.
##### **Illustrative Escalation Thresholds**
The following thresholds are proposed as management triggers, not as additional regulatory Impact Tolerances.
| Escalation Status | Illustrative Trigger | Required Management Response |
| --- | --- | --- |
| Normal operations | Essential customer journeys remain within approved performance, security and integrity boundaries. | Continue service monitoring, control testing and preventive risk management. |
| Early warning | Material degradation persists for 15 minutes, or customer journey failure and latency indicators deteriorate significantly. | Initiate cross-functional investigation, identify affected dependencies and assess customer harm. |
| Significant disruption | Essential service degradation persists for 30 minutes, or a material customer group is unable to complete essential activities. | Escalate to the CBS Owner, activate incident coordination and prepare continuity options. |
| Critical disruption | Essential service loss approaches 60 minutes, affects a large customer population or involves major shared dependencies. | Activate appropriate crisis or continuity arrangements, prioritise customer protection and reassess the likelihood of a tolerance breach. |
| Impact Tolerance breach | Any approved duration, customer harm, minimum capability, or material integrity boundary is crossed. | Record the breach, execute the approved response, consider applicable regulatory notification requirements and initiate formal remediation and management reporting. |
Adjust these escalation triggers based on measured recovery capability and the speed at which harm develops.
MBSB should not wait until the two-hour boundary is reached before activating continuity arrangements.
#### **Rationale for the Recommended Impact Tolerance**
##### **Customer Dependence on Digital Banking**
Digital banking supports activities that customers may need to perform urgently, including accessing account information, transferring funds, managing repayments, and verifying transaction completion.
A prolonged inability to perform these activities can cause financial inconvenience, missed obligations, and customer distress.
The severity depends on which activities are unavailable, the disruption's timing, and whether secure alternatives exist.
The proposed two-hour boundary provides an initial assessment point for determining whether MBSB's continuity and recovery arrangements can prevent material customer harm.
Do not adopt it without evidence from customer and transaction analysis.
##### **Shared Technology and Interconnected CBS Dependencies**
CBS-3 relies on other Critical Business Services, particularly:
- CBS-1 Customer Deposit and Account Access Services.
- CBS-2 Domestic Funds Transfer and Payment Services.
- CBS-5 Financing Account Servicing and Repayment Services.
- CBS-8 Customer Transaction Authentication and Authorisation Services.
- CBS-9 Customer Support and Assistance During Banking Disruptions.
A failure of shared core banking, authentication, or payment interfaces may affect several of these services simultaneously.
Consequently, the CBS-3 Impact Tolerance must consider the cumulative consequences of interconnected disruption rather than assuming each service can be recovered independently.
##### **Data Integrity and Customer Fund Protection**
A prolonged availability disruption is not the only source of unacceptable harm.
Incorrect balances, compromised authentication, unauthorised transactions or misleading payment completion status can cause significant harm even during a relatively short incident.
For this reason, the proposed tolerance includes integrity-based conditions that can trigger immediate escalation and protective action.
Where the integrity of transaction processing cannot be assured, temporarily restricting the affected activity may be safer than maintaining apparently available but unreliable services.
##### **Effective Alternative Service Delivery**
Alternative channels may reduce harm, but only where they provide equivalent essential customer outcomes within acceptable limits.
For example, branch or contact centre arrangements may support certain urgent activities during a digital banking outage.
However, their usefulness depends on operating hours, capacity, customer accessibility, security controls, and whether they share the same failed core banking infrastructure.
MBSB should therefore validate alternative service capability rather than assuming that another channel automatically prevents an Impact Tolerance breach.
#### **Critical Sub-CBS Processes for Remaining Within Impact Tolerance**
The following processes should be prioritised in resilience planning because their failure can directly prevent essential customer outcomes or significantly amplify disruption.
| Priority Group | Critical Sub-CBS | Reason for Priority | Principal Resilience Requirement |
| --- | --- | --- | --- |
| Essential digital access | CBS-3.3 Digital Banking Channel Access and Service Availability; CBS-3.4 Digital Customer Authentication and Identity Verification; CBS-3.5 Digital Session Establishment and Management | Failure may prevent customers from using all or most digital banking functions. | Resilient channel architecture, secure authentication, capacity management, and tested failover. |
| Customer fund and information integrity | CBS-3.6 Digital Access Security and Customer Account Protection; CBS-3.7 Digital Account Information Retrieval and Presentation | Failure may expose customers to fraud or unreliable account information. | Effective security restrictions, authoritative data validation, fraud controls, and trusted information recovery. |
| Essential transaction delivery | CBS-3.11 Digital Financial Transaction Initiation; CBS-3.12 Digital Transaction Validation and Authorisation Coordination; CBS-3.13 Digital Payment and Funds Transfer Processing Coordination | Failure may prevent customers from initiating or completing essential payments. | Secure transaction initiation, reliable authorisation, resilient interfaces, and duplicate prevention. |
| Transaction outcome assurance | CBS-3.15 Digital Transaction Status and Completion Management | An incorrect transaction status may cause repeated payments, financial uncertainty, and disputes. | Reconcile transaction states authoritatively and provide reliable customer confirmation. |
| Threat detection and escalation | CBS-3.19 Digital Banking Service Performance and Availability Monitoring; CBS-3.20 Digital Banking Security Event Detection and Response Coordination; CBS-3.21 Digital Banking Incident Assessment and Service Escalation | Delayed detection or escalation may allow harm to accumulate beyond approved boundaries. | End-to-end monitoring, cybersecurity response, customer-harm assessment, and timely escalation. |
| Continuity and safe recovery | CBS-3.22 Digital Banking Continuity and Alternative Service Delivery; CBS-3.23 Digital Banking Technology Recovery and Service Reinstatement; CBS-3.24 Digital Banking Service Restoration and Post-Incident Validation | Ineffective continuity or unsafe recovery may prolong disruption or introduce further financial harm. | Independent alternatives, tested recovery capability, data integrity validation, and controlled restoration. |
Continue assessing the remaining Sub-CBS processes because disruption to supporting activities can compound the effects of a major incident.
#### **Distinguishing Impact Tolerance from Recovery and Service Performance Measures**
Impact Tolerance should not be confused with RTO, RPO, MTPD, or service availability measures.
| Measure | Primary Purpose | Relationship with CBS-3 Impact Tolerance |
| --- | --- | --- |
| Impact Tolerance | Defines the maximum disruption to CBS-3 before unacceptable harm occurs. | Establishes the overarching customer-outcome boundary against which resilience is assessed. |
| Recovery Time Objective (RTO) | Defines the target time to recover a process, application, or supporting capability. | Supporting RTOs should allow sufficient time to restore essential end-to-end customer journeys before the Impact Tolerance is breached. |
| Recovery Point Objective (RPO) | Defines the maximum targeted period of data loss associated with recovery. | RPOs support data recovery planning but do not define what transaction loss, duplication, or financial data inconsistency customers accept. |
| Maximum Tolerable Period of Disruption (MTPD) | Establishes the maximum disruption period for a business activity or function within BCM analysis. | Provides useful input but may not capture the full customer-facing consequences of simultaneous process and CBS failures. |
| System Availability Target | Defines expected technical availability over a reporting period. | A system can meet its availability target while a short, severe incident causes unacceptable customer harm. |
| Service Level Agreement (SLA) | Establishes agreed service performance obligations between parties. | SLAs support supplier accountability but do not replace MBSB's responsibility for maintaining essential customer outcomes. |
For example, if MBSB adopts an illustrative two-hour CBS-3 Impact Tolerance, it should not automatically assign a two-hour RTO to every supporting application.
Critical authentication, transaction authorisation and payment interfaces may need materially shorter recovery targets to allow sufficient time for incident detection, escalation, technology recovery, business validation and restoration of essential customer journeys.
The recovery design must also accommodate situations in which restoration is technically successful but customer-facing services remain unusable.
#### **Regulatory Considerations for a Malaysian Financial Services Institution**
BNM's Operational Resilience Discussion Paper, issued on 19 December 2025, provides important context for establishing disruption tolerances at the critical-service level.
The document discusses the need to consider customer and stakeholder outcomes, the limitations of internal recovery metrics, the significance of internal and external dependencies, and the importance of assessing resilience through severe but plausible scenarios.
The following distinction is important: the December 2025 document is a Discussion Paper describing emerging policy direction and considerations, not itself a final operational resilience policy prescribing the numerical thresholds in this chapter.
##### **Regulatory Themes and Implementation Implications**
| BNM Discussion Paper Theme | Relevance to CBS-3 | Recommended MBSB Implementation |
| --- | --- | --- |
| Continuity of critical financial services | Digital banking provides customers with access to essential financial services. | Define CBS-3 around essential customer outcomes and validate its service boundary. |
| Tolerances based on customer and external harm | Internal recovery metrics alone may not adequately reflect customer consequences. | Assess duration, affected customers, minimum service capability and transaction integrity together. |
| Internal and external dependencies | Digital banking relies on shared systems, telecommunications, authentication and payment infrastructure. | Maintain an end-to-end dependency map covering all 24 Sub-CBS processes and interconnected CBSs. |
| Technology and cyber resilience | Cyber incidents and technology failures can affect critical service delivery. | Integrate cyber threats, ICT failure modes and data integrity into tolerance assessments and testing. |
| Third-party concentration | Shared external providers may cause simultaneous service disruptions and limit substitutability. | Evaluate provider concentration, recovery capability and alternative arrangements. |
| Severe but plausible scenario assessment | Isolated technology recovery tests may not reveal cumulative customer harm. | Test simultaneous failures, dependency propagation and recovery under adverse conditions. |
| Governance and accountability | Board and senior management oversight is important for resilience outcomes. | Establish accountable ownership, management challenge, documented approval and regular reporting. |
| Continuous improvement | Operational resilience must evolve in response to incidents and changing dependencies. | Update tolerance assumptions following incidents, scenario testing and material service changes. |
The BNM paper discusses these themes, including its sections on operational resilience concepts and the relationship with existing BCM, Risk Management in Technology, and outsourcing requirements.
##### **Recommended Governance and Approval Process**
Before approving the CBS-3 Impact Tolerance, MBSB should undertake the following assessment and governance activities:
1. **Validate the CBS-3 service boundary.** Confirm the essential digital banking activities, customer populations, and interconnected CBSs.
2. **Establish a customer-harm baseline.** Analyse actual digital banking usage, transaction values, peak demand, customer vulnerability, incident history, and available alternatives.
3. **Calibrate tolerance thresholds.** Test whether the proposed duration, customer-scope, and minimum capability measures reflect the point at which harm becomes unacceptable.
4. **Validate supporting capabilities.** Compare the proposed boundaries with dependency mapping, technology recovery arrangements, cyber response, and continuity capabilities.
5. **Conduct a management challenge.** Obtain input from the CBS Owner, Operational Risk, Operational Resilience, Technology, Cybersecurity, BCM, Compliance, and Customer Service.
6. **Approve and document the decision.** Record the rationale, assumptions, accountable owner, approved thresholds, escalation arrangements, and residual risks through MBSB's applicable governance structure.
7. **Review after testing and change.** Reassess the tolerance when scenario testing, material incidents, customer behaviour, or technology dependencies indicate that the original assumptions are no longer appropriate.
Retain the resulting assessment as a controlled document suitable for management review and supervisory examination.
#### **Validating the Impact Tolerance Through Severe but Plausible Scenario Testing**
A proposed Impact Tolerance cannot be considered adequately validated solely because it has been approved.
MBSB should test whether its operational arrangements can maintain essential digital banking services within the approved boundaries when severe disruption occurs.
##### **Recommended Scenario Portfolio**
| Severe but Plausible Scenario | Principal Sub-CBS Affected | Impact Tolerance Dimension Tested | Expected Assessment |
| --- | --- | --- | --- |
| Widespread digital channel outage caused by DDoS and infrastructure overload | CBS-3.3, 3.19, 3.21–3.24 | Duration, customer population, and essential journey completion | Determine whether secure access and essential banking capability can be maintained or restored before unacceptable harm occurs. |
| Shared authentication platform failure affecting multiple CBSs | CBS-3.2, 3.4–3.6, 3.12 | Customer access, authorisation, cross-CBS concentration | Assess whether secure authentication and alternative access arrangements prevent a material CBS-3 disruption. |
| Corruption of account balance information following a failed technology change | CBS-3.7, 3.11, 3.15, 3.23–3.24 | Data integrity, customer financial harm | Verify that inaccurate information is detected, contained, and corrected before unsafe customer transactions occur. |
| Payment interface failure with lost or delayed completion acknowledgements | CBS-3.11–3.13, 3.15–3.16 | Transaction completion, status integrity, customer harm | Assess whether payments can be reconciled and duplicate submissions prevented during interface disruption. |
| Ransomware is affecting digital banking and shared technology infrastructure | CBS-3.3–3.7, 3.19–3.24 | Availability, integrity, cyber containment, recovery | Test coordinated cyber response, clean recovery, and restoration of essential customer services. |
| Regional telecommunications outage affecting digital channels and customer support | CBS-3.3, 3.16–3.17, 3.21–3.22 | Geographical scope, alternative channels, and customer assistance | Determine whether customers can obtain essential services and support through independent arrangements. |
| Simultaneous primary and recovery infrastructure failure | CBS-3.19, 3.21–3.24 | Maximum disruption duration, recovery independence | Determine whether recovery arrangements remain viable under common-cause failure. |
| Premature restoration following a major cyber incident | CBS-3.6, 3.12–3.15, 3.20, 3.23–3.24 | Security and transaction integrity | Verify that business and security validation prevent unsafe reopening of digital services. |
##### **Measurements and Evidence to Collect**
During scenario testing, MBSB should capture actual customer journey completion rates, disruption duration, affected customer populations, transaction backlogs, data integrity results, incident detection and escalation times, recovery decisions, alternative-channel capacity, and the time at which each approved tolerance boundary is approached or crossed.
The evidence should demonstrate not only whether technology recovered, but also whether customers could continue receiving essential banking services safely.
Test results should distinguish:
- **Within tolerance:** Essential customer outcomes remain within all approved harm boundaries.
- **Approaching tolerance:** The disruption is consuming the remaining time, capacity, or customer-harm allowance, requiring enhanced management intervention.
- **Tolerance breached:** One or more approved unacceptable-harm boundaries have been crossed.
- **Unable to demonstrate compliance:** Available evidence is insufficient to establish whether essential customer outcomes remained within tolerance.
An inability to demonstrate compliance should trigger further testing or evidence improvement rather than being treated automatically as a successful result.
#### **Proactive Risk Management and Management Oversight**
Setting Impact Tolerance is not merely about establishing a threshold.
It guides preventive controls, resilience investment, operational preparedness, and timely management decisions.
##### **Recommended Management Action Register**
| Priority | Proactive Risk Management Action | Accountable Function | Required Evidence |
| --- | --- | --- | --- |
| Very High | Validate end-to-end essential digital banking customer journeys and identify common points of failure. | CBS-3 Owner; Digital Banking; Technology | Approved customer journey map; dependency assessment; management validation. |
| Very High | Strengthen authentication, transaction authorisation, and resilience of customer account protection. | Cybersecurity; Identity Management; Fraud Operations | Security control tests; cyber simulation; authentication failover results; remediation closure. |
| Very High | Validate authoritative account and transaction data integrity during disruption and recovery. | Core Banking; Data Management; Payment Operations | Reconciliation results, database recovery tests, and integrity control assessments. |
| Very High | Test primary and recovery environment independence under combined cyber and infrastructure failure. | Technology Recovery; Infrastructure; Cybersecurity | Disaster recovery and cyber recovery test reports; architecture review; corrective-action evidence. |
| High | Establish CBS-level customer journey monitoring and Impact Tolerance early-warning indicators. | Digital Banking Operations; Technology Monitoring; Operational Resilience | Approved monitoring thresholds, dashboards, alert testing, and escalation records. |
| High | Validate the capacity and independence of alternative customer service channels. | BCM; Branch Operations; Customer Service | Alternative-channel capacity assessment; continuity exercises; CBS-9 coordination evidence. |
| High | Assess critical third-party and telecommunications concentration. | Third-Party Risk; Technology; Operational Risk | Provider risk assessments; assurance reports; concentration analysis; contingency tests. |
| High | Integrate Impact Tolerance breaches into incident and crisis escalation arrangements. | Incident Management; Crisis Management; Operational Resilience | Approved escalation criteria; crisis exercises; decision logs; management minutes. |
| High | Establish a structured programme of end-to-end testing of severe but plausible scenarios. | Operational Resilience; CBS-3 Owner; Technology; Cybersecurity | Approved scenario portfolio, test plans, observation reports, and remediation register. |
| High | Report tolerance exposures, test findings, and remediation progress to the appropriate governance committees. | Operational Risk; Operational Resilience; Senior Management | Committee papers; risk acceptance records; action tracking; independent assurance findings. |
##### **Recommended Management Reporting Indicators**
A CBS-3 management dashboard should provide visibility over both current resilience and the bank's ability to remain within its approved tolerance.
Management reporting should identify emerging concentrations, scenarios that could exceed the tolerance, overdue corrective actions, and any residual risks requiring formal acceptance.
The reporting process should also demonstrate how management decisions influence the bank's resilience investment and control improvement priorities.
[![Banner \[Summing\] \[OR\] \[E3\] Establish Impact Tolerance](https://no-cache.hubspot.com/cta/default/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/5e80e50f-5e3e-44ea-8c43-16bf42d4f3b5)
Setting an Impact Tolerance for CBS-3: Digital Banking Services establishes a clear boundary between acceptable operational disruption and the point at which customers, connected financial institutions or the wider financial system may experience unacceptable harm.
The detailed assessment of all 24 Sub-CBS processes demonstrates that digital banking resilience depends on much more than the availability of a mobile application or internet banking platform.
Secure authentication, authoritative account information, transaction authorisation, payment coordination, reliable completion status, customer assistance, and controlled recovery must function together to deliver essential customer outcomes.
Integrating Cyber and ICT Risks into the assessment strengthens MBSB's understanding of how cyberattacks, technology failures, data corruption, third-party disruption, and infrastructure concentration can propagate across interconnected processes and Critical Business Services.
It also highlights the need for both availability-based and integrity-based tolerance boundaries.
The proposed two-hour maximum disruption duration, supported by customer-impact, essential service capability, and data integrity measures, provides an illustrative starting point for MBSB's internal assessment.
The bank should validate and formally approve it through its applicable governance arrangements, considering customer harm, operational capabilities, risk appetite, and relevant regulatory requirements.
Evidence from risk assessments, control testing, cyber simulations, recovery exercises, transaction reconciliation, and management oversight will be essential in demonstrating whether MBSB has the capabilities required to remain within its approved tolerance.
Ultimately, the Impact Tolerance should guide the design of Severe but Plausible Scenarios, end-to-end Scenario Testing, remediation priorities, technology and operational resilience investment, and continuous improvement.
The objective is not simply to recover digital banking systems within a target time.
It is to ensure MBSB can continue delivering essential digital banking outcomes safely and reliably, with an acceptable level of customer harm, even under severe operational disruption.
Implementation Note from Author: Both assessment tables cover all 24 Sub-CBS processes, CBS-3.1 through CBS-3.24. Harm ratings, numerical thresholds, risk controls, and recovery assumptions are illustrative recommendations requiring MBSB validation. The BNM source is the Discussion Paper dated 19 December 2025; the chapter does not represent its proposed numerical thresholds as BNM requirements.
[![\[OR\] \[MBSB\] \[3/4 Banner\] Operational Resilience in Action The MBSB Bank's Approach ](https://no-cache.hubspot.com/cta/default/3893111/8c32162b-ac29-4c9c-9413-3d8869a65490.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/8c32162b-ac29-4c9c-9413-3d8869a65490)
| **eBook 3: Starting Your OR Implementation** | | | | |
| --- | --- | --- | --- | --- |
| **CBS-3 Digital Banking Services** | | | | |
| **CBS-3 DP** | **CBS-3 MII** | **CBS-3 ITo** | **CBS-3 SbPS** | **CBS-3 ST** |
| [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[DP\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/46949462-c4aa-464d-bef5-c0a9b2e6bab6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/46949462-c4aa-464d-bef5-c0a9b2e6bab6) | [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[MII\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/74c4f462-7a20-49b5-aaf1-068e2f4956e9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/74c4f462-7a20-49b5-aaf1-068e2f4956e9) | [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[ITo\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/56aa144a-f755-4aef-ab05-f29c3cd8ad89.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/56aa144a-f755-4aef-ab05-f29c3cd8ad89) | [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[SbPS\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/6e7f0ef7-370b-4182-8814-6b83fe57964a.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e7f0ef7-370b-4182-8814-6b83fe57964a) | [![\[OR\] \[MBSB\] \[E3\] \[CBS\] \[3\] \[ST\] Digital Banking Services](https://no-cache.hubspot.com/cta/default/3893111/c22a5556-09bb-4c57-b9a4-7ea2ab5be915.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/c22a5556-09bb-4c57-b9a4-7ea2ab5be915) |
**[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)**
For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the **OR-5000 Operational Resilience Expert Implementer course**, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Your Comments Here:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Dr Goh Moh Heng",
"url" : "https://blog.bcm-institute.org/ebook-or/author/dr-goh-moh-heng"
},
"dateModified" : "2026-10-14T12:24:06.589Z",
"datePublished" : "2026-10-14T03:03:08.000Z",
"headline" : "[OR] [MBSB] [E3] [CBS] [3] [ITo] Establish Impact Tolerances",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-mbsb-e3-cbs-3-ito-establish-impact-tolerances",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```