[OR] [MBT] [E2] [C20] Conclusion for eBook 2

Sustaining the Momentum – Building Resilience for the Future

Introduction

Operational resilience is not a destination but a continuous journey — a commitment by Metrobank to safeguard its customers, people, and reputation in an increasingly complex financial ecosystem.

This guide, Building Resilient Banking Operations: The Metrobank Operational Resilience Implementation Guide, outlines how the Bank can build and sustain its resilience capabilities in alignment with guidelines issued by the Bangko Sentral ng Pilipinas (BSP) and global best practices.

From Compliance to Culture: The Road to Resilience

Operational resilience was introduced at Metrobank as a regulatory mandate under BSP Circular No. 1149 (2022) on Operational Resilience and BSP Circular No. 1122 (2021) on Operational Risk Management.

However, through this journey, it evolved beyond compliance into a strategic enabler — embedding resilience in every layer of the organisation’s operations, governance, and culture.

At its core, resilience is about continuing to deliver critical business services (CBS) — such as deposit and withdrawal services, fund transfers, loan processing, and digital banking — even in the face of severe yet plausible disruptions. Metrobank’s approach integrates people, processes, technology, and third parties into one coherent resilience framework.

1. The Plan Phase – Establishing the Foundation

The Plan Phase laid the groundwork for resilience by helping Metrobank understand its current capabilities, identify gaps, and chart a clear roadmap for development.

• Assess Capability and Maturity:
  The Bank conducted an assessment of its resilience maturity across governance, risk management, and business continuity disciplines. This helped benchmark its practices against BSP expectations and international standards such as ISO 22301 and the Basel Committee’s principles.
• Analyse Gap:
  A detailed gap analysis was then conducted, revealing areas that needed enhancement — such as dependency mapping, impact tolerance definition, and third-party risk oversight.
• Develop Strategy and Roadmap:
  From these insights, a resilience strategy and implementation roadmap were crafted, aligning resources and milestones to Metrobank’s long-term risk management goals.
• Confirm Risk Appetite:
  Metrobank formalised its resilience-related risk appetite, defining acceptable disruption thresholds for each CBS, ensuring that strategic decisions remained consistent with the Board’s risk tolerance.
• Develop and Embed Governance:
  A governance framework was institutionalised, clarifying roles across the Board, Operational Resilience Committee, Business Units, and Risk and Compliance functions. The framework established oversight mechanisms to ensure accountability and escalation of material incidents.

Throughout the Plan Phase, Metrobank transitioned from a conceptual understanding to a structured, actionable resilience strategy.

2. The Implement Phase – Bringing the Strategy to Life

The Implement Phase operationalised the strategy, turning plans into measurable actions across critical business services.

• Identify Critical Business Services (CBS):
  Metrobank identified eight CBS essentials to its operations — including deposits, fund transfers, ATM operations, and digital banking. Each service was assessed for its importance to customers and the wider financial ecosystem.
• Map Processes and Resources:
  The Bank mapped dependencies across people, technology, facilities, and third parties for each CBS, establishing a clear picture of how disruptions might cascade across operations.
• Set Impact Tolerances:
  Impact tolerances — measurable limits on the duration or extent of service disruption — were defined in alignment with BSP requirements. For instance, recovery times for digital banking platforms were benchmarked against regulatory expectations and customer demand.
• Conduct Scenario Testing:
  Severe but plausible disruption scenarios were simulated, including cyber incidents, data centre outages, and large-scale payment system failures. The outcomes informed response playbooks and guided improvements to continuity measures.
• Improve Lessons Learnt:
  Lessons from scenario testing, incident management, and audits were reviewed and integrated into an improvement cycle, ensuring that resilience capabilities evolved in response to emerging threats.

By the end of the Implement Phase, resilience was no longer theoretical — it was embedded in daily operations, decision-making, and testing routines.

3. The Sustain Phase – Embedding Resilience into Culture

The Sustain Phase ensures that operational resilience remains an ongoing capability — one that adapts, matures, and grows with the Bank.

• Introduce Cultural Change:
  Metrobank cultivated a culture of resilience through leadership commitment, continuous dialogue, and integration of resilience principles into its corporate values.
• Develop Communication Strategy:
  Clear internal and external communication protocols were established to ensure consistent messaging during incidents and resilience initiatives.
• Implement Training and Awareness:
  Comprehensive training programs for executives, operational teams, and third-party partners helped reinforce roles and response expectations under the resilience framework.
• Provide Self-Assessment:
  Periodic self-assessments enabled Metrobank to monitor compliance with BSP guidelines, identify emerging risks, and track progress against the defined roadmap.
• Conduct an Independent Quality Review:
  Independent audits and reviews validated the effectiveness of Metrobank’s operational resilience framework, ensuring alignment with regulatory expectations and international best practices.

This phase cemented resilience as part of the Bank’s DNA — a continuous cycle of learning, adaptation, and improvement.

4. Key Takeaways and Looking Ahead

Through its Plan, Implement, and Sustain Phases, Metrobank has built an operational resilience framework that:

• Aligns with BSP’s operational resilience guidelines and expectations;
• Protects customer trust and financial stability;
• Enhances strategic agility and reputation; and
• Embeds resilience into corporate governance and risk management structures.

As threats evolve — from cyberattacks to climate-related disruptions — Metrobank’s focus will remain on testing, learning, and adapting. Resilience must be viewed as a competitive advantage, not merely a compliance requirement.

Operational resilience at Metrobank represents the convergence of foresight, governance, and culture. It is about ensuring that when disruption occurs, the Bank continues to deliver essential services, support the Philippine economy, and uphold customer confidence.

Metrobank’s journey demonstrates that resilience is not just built through frameworks and policies — it is sustained through people, leadership, and an unwavering commitment to continuity.

“Resilience is not built overnight; it is cultivated through every decision, every process, and every person who ensures Metrobank never stops serving its customers — no matter what lies ahead.”

	Building Resilient Banking Operations: The Metrobank Operational Resilience Implementation Guide
	ebook 2: Implementing Operational Resilience for Metrobank
		C1			C20	C21
	"Plan" Phase of the Operational Resilience Planning Methodology
	C2	C3	C4	C5	C6	C7
	"Implement" Phase of the Operational Resilience Planning Methodology
	C8	C9	C10	C11	C12	C13
	"Sustain" Phase of the Operational Resilience Planning Methodology
	C14	C15	C16	C17	C18	C19

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.