[OR] [MBT] [E3] [CBS] [9] [SuPS] Identify Severe but Plausible Scenarios

Sub-CBS Code

Sub-CBS

Severe but Plausible Scenario

Impact / Effect

Proactive Risk Management Action

Link to Integration of Cyber and ICT Risks

9.1

Credit Card Application and Onboarding

Prolonged outage in the customer onboarding platform due to database corruption or malware attack

Inability to process new credit card applications; customer dissatisfaction; reputational damage

Implement secure data backup and recovery processes; conduct regular vulnerability scanning; enable redundancy in onboarding platforms

Aligns with ICT risk management for data integrity and availability; integrates cyber risk through endpoint protection and secure coding standards

9.2

Card Issuance and Fulfilment

Third-party card production vendor suffers a ransomware attack, halting fulfilment

Delay in issuing cards to customers; breach of SLA; reputational impact

Maintain alternate vendors and business continuity agreements; validate incident response readiness of third parties

Integrated through third-party cyber due diligence and ICT continuity monitoring

9.3

Transaction Authorisation and Processing

Network or payment switch failure caused by a DDoS cyberattack or a hardware malfunction

Authorisation failures leading to transaction decline across ATMs and POS; financial and reputational loss

Implement DDoS mitigation, transaction rerouting, and high-availability infrastructure

Direct integration with cyber resilience and ICT network redundancy strategies

9.4

Merchant Acquiring and Onboarding

Major API or portal outage due to a software patch error during system upgrade

Merchant onboarding delays; inability to process new merchant accounts

Deploy patch management testing in staging environments; enforce change control procedures

Integrated with ICT change management and cyber security validation processes

9.5

Merchant Transaction and Settlement Services

Payment gateway compromise leading to unauthorised access or data tampering

Delayed or incorrect settlements; potential data breach liabilities

Implement encryption of payment data; enhance transaction reconciliation controls

Integration with cyber and ICT incident response and data loss prevention systems

9.6

Cardholder Servicing and Collections

CRM and collections system downtime due to internal system failure or cyber intrusion

Disrupted customer service and payment collections; potential rise in delinquencies

Maintain mirrored CRM systems; automate alerts for system degradation; provide alternate service channels

Integrated through ICT business continuity plans and cyber intrusion detection

9.7

Fraud Detection and Security Monitoring

Failure of the fraud detection system caused by AI model corruption or malware infiltration

Increased undetected fraudulent transactions; financial and regulatory exposure

Establish failover for fraud analytics engines; perform continuous model validation

Integrated with cyber risk governance for fraud detection and ICT resilience testing

9.8

Compliance and Regulatory Management

Data breach exposing regulatory reporting or KYC data due to an insider threat or an API vulnerability

Regulatory penalties; compliance breaches; reputational impact

Conduct periodic security awareness and access control audits; enhance data encryption for KYC and regulatory reports

Integrated with cyber compliance monitoring and ICT security audit frameworks