---
title: [OR] [MBT] [E3] [CBS] [9] [SuPS] Identify Severe but Plausible Scenarios
description: [OR] [MBT] [E3] [CBS] [9] [SuPS] Identify Severe but Plausible Scenarios
image: https://blog.bcm-institute.org/hubfs/Metrobank%20PH%20Graphic%20Folder/Metrobank%20E3%20Morepost/Metrobank%20CBS%209/%5BOR%5D%20%5BMBT%5D%20%5BE3%5D%20%5BCBS%5D%20%5B9%5D%20%5BSuPS%5D%20Identify%20Severe%20but%20Plausible%20Scenarios.png
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Building Resilient Banking Operations: The Metrobank Operational Resilience Implementation Guide
# \[OR\] \[MBT\] \[E3\] \[CBS\] \[9\] \[SuPS\] Identify Severe but Plausible Scenarios
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/87e7f49d-dbef-4f23-931f-4a1f511f70bf)
As part of Metrobank’s Operational Resilience framework, identifying severe but plausible scenarios is a critical step in stress testing the resilience of its Credit Card Issuing and Acquiring Services (CBS-9).
Severe but plausible scenarios are realistic yet extreme situations that could disrupt operations beyond normal contingencies, assessing the organisation’s ability to continue delivering critical services within impact tolerances.
These scenarios consider cyber, ICT, operational, and third-party risks and are used to validate Metrobank’s response capabilities and recovery measures.
By anticipating these events, Metrobank ensures proactive management of vulnerabilities across its credit card lifecycle, from application and issuance to merchant settlement and fraud monitoring.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Dec 2, 2025
###### Operational Resilience Certified Planner-Specialist-Expert
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/2196d2c2-e6e2-49b4-ba01-e7d03071dd00)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)**CBS-9 Credit Card Issuing and Acquiring Services**
[![\[OR\] \[MBT\] \[E3\] \[CBS\] \[9\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/85351d9a-b59d-4b31-ac51-4affa7fd70e1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/85351d9a-b59d-4b31-ac51-4affa7fd70e1)
As part of Metrobank’s Operational Resilience framework, identifying severe but plausible scenarios is a critical step in stress testing the resilience of its Credit Card Issuing and Acquiring Services (CBS-9).
Severe but plausible scenarios are realistic yet extreme situations that could disrupt operations beyond normal contingencies, assessing the organisation’s ability to continue delivering critical services within impact tolerances.
These scenarios consider cyber, ICT, operational, and third-party risks and are used to validate Metrobank’s response capabilities and recovery measures.
By anticipating these events, Metrobank ensures proactive management of vulnerabilities across its credit card lifecycle, from application and issuance to merchant settlement and fraud monitoring.
[![Banner \[Table\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86)
##### Table P5: Identify Severe but Plausible Scenarios for CBS-9
| Sub-CBS Code | Sub-CBS | Severe but Plausible Scenario | Impact / Effect | Proactive Risk Management Action | Link to Integration of Cyber and ICT Risks |
| --- | --- | --- | --- | --- | --- |
| 9.1 | Credit Card Application and Onboarding | Prolonged outage in the customer onboarding platform due to database corruption or malware attack | Inability to process new credit card applications; customer dissatisfaction; reputational damage | Implement secure data backup and recovery processes; conduct regular vulnerability scanning; enable redundancy in onboarding platforms | Aligns with ICT risk management for data integrity and availability; integrates cyber risk through endpoint protection and secure coding standards |
| 9.2 | Card Issuance and Fulfilment | Third-party card production vendor suffers a ransomware attack, halting fulfilment | Delay in issuing cards to customers; breach of SLA; reputational impact | Maintain alternate vendors and business continuity agreements; validate incident response readiness of third parties | Integrated through third-party cyber due diligence and ICT continuity monitoring |
| 9.3 | Transaction Authorisation and Processing | Network or payment switch failure caused by a DDoS cyberattack or a hardware malfunction | Authorisation failures leading to transaction decline across ATMs and POS; financial and reputational loss | Implement DDoS mitigation, transaction rerouting, and high-availability infrastructure | Direct integration with cyber resilience and ICT network redundancy strategies |
| 9.4 | Merchant Acquiring and Onboarding | Major API or portal outage due to a software patch error during system upgrade | Merchant onboarding delays; inability to process new merchant accounts | Deploy patch management testing in staging environments; enforce change control procedures | Integrated with ICT change management and cyber security validation processes |
| 9.5 | Merchant Transaction and Settlement Services | Payment gateway compromise leading to unauthorised access or data tampering | Delayed or incorrect settlements; potential data breach liabilities | Implement encryption of payment data; enhance transaction reconciliation controls | Integration with cyber and ICT incident response and data loss prevention systems |
| 9.6 | Cardholder Servicing and Collections | CRM and collections system downtime due to internal system failure or cyber intrusion | Disrupted customer service and payment collections; potential rise in delinquencies | Maintain mirrored CRM systems; automate alerts for system degradation; provide alternate service channels | Integrated through ICT business continuity plans and cyber intrusion detection |
| 9.7 | Fraud Detection and Security Monitoring | Failure of the fraud detection system caused by AI model corruption or malware infiltration | Increased undetected fraudulent transactions; financial and regulatory exposure | Establish failover for fraud analytics engines; perform continuous model validation | Integrated with cyber risk governance for fraud detection and ICT resilience testing |
| 9.8 | Compliance and Regulatory Management | Data breach exposing regulatory reporting or KYC data due to an insider threat or an API vulnerability | Regulatory penalties; compliance breaches; reputational impact | Conduct periodic security awareness and access control audits; enhance data encryption for KYC and regulatory reports | Integrated with cyber compliance monitoring and ICT security audit frameworks |
[![Banner \[Summing\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/446ccb83-e056-40d0-aae5-834d73c13f43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/446ccb83-e056-40d0-aae5-834d73c13f43)
The identification of severe but plausible scenarios for Metrobank’s Credit Card Issuing and Acquiring Services reinforces its ability to anticipate and mitigate operational disruptions. Each scenario represents a realistic threat that tests Metrobank’s resilience across technology, people, process, and third-party dependencies.
Integrating cyber and ICT risk management within these scenarios ensures that digital and system vulnerabilities are not viewed in isolation but as integral components of the bank’s operational resilience strategy.
By proactively managing these risks and embedding them into scenario testing exercises, Metrobank strengthens its capability to maintain critical financial services continuity and uphold customer trust under the most challenging circumstances.
| Building Resilient Banking Operations: The Metrobank Operational Resilience Implementation Guide | | | | | |
| --- | --- | --- | --- | --- | --- |
| **eBook 3: Starting Your OR Implementation** | | | | | |
| **CBS-9 Credit Card Issuing and Acquiring Services** | | | | | |
| **CBS-9 DP** | **CBS-9 MD** | **CBS-9 MPR** | **CBS-9 ITo** | **CBS-9 SuPS** | **CBS-9 ST** |
| [![\[OR\] \[MBT\] \[E3\] \[CBS\] \[9\] \[DP\] Credit Card Issuing and Acquiring Services](https://no-cache.hubspot.com/cta/default/3893111/7b2ea4c9-1299-4e60-a149-6c31912dd8f1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7b2ea4c9-1299-4e60-a149-6c31912dd8f1) | [![\[OR\] \[MBT\] \[E3\] \[CBS\] \[9\] \[MD\] Map Dependency](https://no-cache.hubspot.com/cta/default/3893111/40bb72bb-5111-440d-8adb-eb87f4ec1d5f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/40bb72bb-5111-440d-8adb-eb87f4ec1d5f) | [![\[OR\] \[MBT\] \[E3\] \[CBS\] \[9\] \[MPR\] Map Processes and Resources](https://no-cache.hubspot.com/cta/default/3893111/2ec68e79-e822-44b3-bc6e-d8842015c697.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/2ec68e79-e822-44b3-bc6e-d8842015c697) | [![\[OR\] \[MBT\] \[E3\] \[CBS\] \[9\] \[ITo\] Establish Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/a25c5343-8362-4595-904c-3634b82c3cd9.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/a25c5343-8362-4595-904c-3634b82c3cd9) | [![\[OR\] \[MBT\] \[E3\] \[CBS\] \[9\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/85351d9a-b59d-4b31-ac51-4affa7fd70e1.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/85351d9a-b59d-4b31-ac51-4affa7fd70e1) | [![\[OR\] \[MBT\] \[E3\] \[CBS\] \[9\] \[ST\] Perform Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/01715f59-24f7-415e-9b5a-991b9213f22e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/01715f59-24f7-415e-9b5a-991b9213f22e) |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2025-12-02T07:18:52.128Z",
"datePublished" : "2025-12-02T07:18:52.000Z",
"headline" : "[OR] [MBT] [E3] [CBS] [9] [SuPS] Identify Severe but Plausible Scenarios",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-mbt-e3-cbs-9-sups-identify-severe-but-plausible-scenarios",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```