[OR] [MBT] [E2] [P2] [S1-S5] [C8] Five Stages of the "Implement" Phase

Implement Phase of Metrobank’s Operational Resilience Planning Methodology

Introduction

The Implement Phase marks a pivotal stage in Metrobank’s journey toward operational resilience.

Following the planning phase, which assessed capability and identified improvement gaps, the implementation process operationalises resilience principles into tangible, measurable, and auditable actions.

This phase ensures that Metrobank can anticipate, withstand, respond to, and recover from disruptions in alignment with the Bangko Sentral ng Pilipinas (BSP) guidelines on Operational Resilience, issued in November 2024.

BSP emphasises that financial institutions must establish a resilient operating model that prioritises continuity of critical business services (CBS), robust risk management, and an effective governance structure.

For Metrobank, this means embedding resilience into its business operations, technology, people, and third-party dependencies.

The Implement Phase consists of five stages, each building on the previous to ensure comprehensive resilience integration:

1. Identify Critical Business Services
2. Map Processes and Resources
3. Set Impact Tolerance
4. Conduct Scenario Testing
5. Improve Lessons Learnt

Stage 1: Identify Critical Business Services

[Implement Phase – Stage 1]

Summary of Implementation Process

At this stage, Metrobank identifies its Critical Business Services (CBS)—the essential functions whose disruption would have a material impact on customers, financial markets, or the overall stability of the Philippine financial system.

To comply with BSP’s operational resilience framework, Metrobank’s Resilience Team collaborates with business unit heads to:

• Define the criteria for “criticality” (e.g., customer impact, regulatory importance, financial exposure).
• Identify services that directly support customers’ financial well-being and payment continuity.
• Map CBS to the bank’s business objectives and BSP regulatory requirements.

Examples of Metrobank’s Critical Business Services

BSP Compliance Reference

Under BSP’s operational resilience expectations, Metrobank must prioritise critical business services that, if disrupted, could affect the broader financial ecosystem.

The identification process ensures Metrobank’s resilience plan focuses on protecting what matters most to customers and regulators alike.

Stage 2: Map Processes and Resources

[Implement Phase – Stage 2]

Summary of Implementation Process

Once CBS is identified, Metrobank maps the supporting processes, systems, people, and third-party dependencies that enable these services.

This mapping provides a detailed understanding of the “end-to-end” service delivery chain and highlights potential vulnerabilities.

Key implementation activities include

• Documenting upstream and downstream dependencies.
• Linking IT systems, applications, and data centres to each CBS.
• Identifying internal teams and external service providers supporting CBS delivery.
• Assessing single points of failure and operational interdependencies.

Example

For CBS-1: Retail and Corporate Payments, Metrobank maps the following:

• Core Processes: Payment instruction validation, transaction authorisation, and settlement reporting.
• Resources: Core Banking System, SWIFT interface, BSP’s PESONet and InstaPay networks.
• Dependencies: Network providers, cloud service partners, and third-party payment gateways.

BSP Compliance Reference

BSP mandates financial institutions to perform comprehensive resource mapping to ensure continuity and resilience across all technology and third-party service layers.

Metrobank aligns with BSP Circular No. 1127 by maintaining updated documentation of critical dependencies and outsourcing arrangements.

Stage 3: Set Impact Tolerance

[Implement Phase – Stage 3]

Summary of Implementation Process

The next step is to define Impact Tolerances (ITs)—the maximum acceptable level of disruption that Metrobank can tolerate for each CBS before it causes intolerable harm to customers or threatens financial stability.

Implementation actions include

• Establishing metrics for impact (e.g., duration, transaction volume affected, financial loss, reputational damage).
• Consulting senior management and Board committees to set thresholds.
• Aligning ITs with recovery time objectives (RTOs) in the Business Continuity Plan (BCP).

Example

BSP Compliance Reference

The BSP requires institutions to quantify tolerances for operational disruption to ensure a balance between customer protection and business viability.

Metrobank’s defined tolerances must align with BSP’s risk appetite framework and be approved by the Board Risk Oversight Committee (BROC).

Stage 4: Conduct Scenario Testing

[Implement Phase – Stage 4]

Summary of Implementation Process

Metrobank conducts scenario-based testing to evaluate its ability to remain within defined impact tolerances during disruptions.

These exercises test both operational and strategic responses to realistic, severe—but plausible— events.

Implementation steps

• Develop scenarios based on historical and emerging threats (e.g., cyberattacks, payment system outages, severe typhoons).
• Test cross-functional response coordination involving operations, IT, and risk teams.
• Measure recovery times and assess the effectiveness of communication with BSP and customers.

Example Scenarios

BSP Compliance Reference

In accordance with BSP guidance, Metrobank’s scenario testing ensures that critical functions can continue within impact tolerances, even during prolonged disruptions.

Test results are reported to BSP under the Operational Resilience Reporting Framework.

Stage 5: Improve Lessons Learnt

[Implement Phase – Stage 5]

Summary of Implementation Process

This final stage focuses on continuous improvement by analysing test outcomes, incident responses, and stakeholder feedback.

Metrobank integrates lessons learnt into its governance, training, and resilience strategies.

Implementation activities include

• Conducting post-incident reviews (PIRs) after every exercise or real disruption.
• Updating the Operational Resilience Framework and BCPs.
• Enhancing training programs and internal awareness.
• Tracking action items and improvement progress through the Resilience Governance Committee.

Example

After a simulated BSP settlement outage exercise, Metrobank discovered that communication delays between IT Operations and Treasury teams prolonged the recovery time. The improvement plan was introduced:

• Automated alert systems for faster escalation.
• Revised communication SOPs.
• Updated recovery playbooks.

BSP Compliance Reference

BSP requires institutions to embed a culture of learning and resilience by formalising lessons learnt processes.

Metrobank documents all outcomes and submits summaries to BSP as part of its Annual Operational Resilience Review Report (AORRR).

The Implement Phase translates Metrobank’s operational resilience strategy into action.

By systematically identifying critical services, mapping dependencies, defining tolerances, testing scenarios, and continuously improving, Metrobank aligns with the BSP’s mission to strengthen the financial sector's stability.

This phase not only ensures regulatory compliance but also reinforces Metrobank’s commitment to safeguarding customers, maintaining trust, and delivering uninterrupted financial services, despite the challenges it faces.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.