[OR] [MLRE] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Critical Business Services of Malaysian Life Reinsurance in Operational Resilience

Introduction

Operational resilience has become a central focus for financial institutions in Malaysia, particularly in light of increased digitalisation, complex third-party dependencies, and emerging systemic risks.

Maintaining critical business services (CBS) during disruptions is essential not only for client protection and business continuity, but also for sustaining regulatory compliance and market confidence.

This chapter examines the CBS of Malaysian Life Reinsurance Group Berhad (MLRe) and links it to evolving regulatory expectations, including those articulated in Bank Negara Malaysia’s (BNM) operational resilience discussion paper and in existing risk-governance frameworks.

Purpose of the Chapter

The purpose of this chapter is to establish a clear and consistent understanding of Critical Business Services (CBS) within the context of Malaysian Life Reinsurance’s operational resilience programme.

As regulatory expectations in Malaysia evolve—particularly with Bank Negara Malaysia’s increasing focus on service continuity, impact tolerance, and systemic stability—organisations need to move beyond internal process views and instead adopt a service-centric perspective.

This chapter provides the foundational rationale for identifying which services are truly critical, based on the potential for harm to policyholders, ceding insurers, and the wider financial ecosystem if those services are disrupted.

By reading this chapter, the reader is expected to gain clarity on why certain services must be prioritised for resilience planning, how CBS differs from traditional critical functions, and how this identification supports compliance with emerging operational resilience requirements. 

The chapter sets the stage for subsequent activities such as dependency mapping, impact tolerance setting, scenario testing, and governance oversight by ensuring that resilience efforts are anchored to the services that matter most to customers, regulators, and market confidence.

What Is a Critical Business Service?

A Critical Business Service in operational resilience is defined as a service provided by an organisation (or on its behalf) that, if disrupted, could:

1. Cause intolerable harm to customers, or
2. Pose a risk to the soundness, stability or resilience of the financial industry or market.

This definition shifts the focus from isolated internal functions to value-chain services that underpin client dealings, regulatory obligations, and systemic confidence.

Overview of Malaysian Life Reinsurance Group Berhad

Malaysian Life Reinsurance Group Berhad (MLRe)is Malaysia’s leading local life reinsurer, providing life reinsurance solutions and technical support in underwriting, pricing, claims and training.

Its offerings cover life and biometric risk products, ranging from mortality and morbidity coverage to personal accident and specialist life products.

As a reinsurer, MLRe’s operational footprint is deeply integrated with the broader insurance industry ecosystem, making operational resilience critical not only for its own business continuity but for market stability and client confidence.

Critical Business Services (CBS) for MLRe

Below are the key CBS that an operational resilience program should prioritise at MLRe, based on the definition of critical services and typical insurance/reinsurance value chains.

Reinsurance Contract Underwriting and Pricing

Why It’s Critical

• Underwriting and pricing determine risk acceptance, capital adequacy and product profitability. Disruption here could result in inaccurate pricing, regulatory non-compliance or misaligned risk exposures.
• These processes directly affect clients (ceding insurers), especially during market stress (e.g., a sudden surge in morbidity claims during pandemics).

Examples of Operational Risk

• System failure in pricing engines
• Loss of actuarial data

Resilience Activities

• Redundant systems, real-time backups
• Cross-functional coverage for key actuarial personnel

Claims Servicing and Settlement

Why It’s Critical

• Claims servicing is key to client trust and financial stability. Delay or failure to settle valid claims can cause intolerable harm to policyholders and ceding insurers.

Operational Dependencies

• IT systems for claims processing
• Third-party service providers for documentation or medical verification

Resilience Measures

• Service level objectives with impact tolerances
• Backup communication channels

Policy Management (Inception, Renewal, Amendments)

Why It’s Critical

• Policy lifecycle management influences the legal validity of contracts, premium flows, and compliance with regulatory reporting obligations.

Disruption Impact

• Policy data loss or corruption can impede renewals or result in regulatory violations.

Compliance, Reporting and Regulatory Filings

Why It’s Critical

• Reinsurance firms are subject to regulatory reporting (capital adequacy, solvency margins, risk disclosures). Failure to deliver these services can trigger enforcement actions or reputational damage.

Resilience Consideration

• Strong regulatory change management and automated reporting

Pricing and Product Development Support

While related to underwriting, the product development cycle—including product innovation, pricing support, and actuarial consultancy for ceding insurers—underpins MLRe’s market value proposition.

Third-Party & Outsourced Services

Many processes, such as data hosting, actuarial modelling platforms or external advisors, are delivered by third parties. The failure of these can directly impair CBS outcomes.

Operational Resilience Focus

• Third-party risk assessments
• Contract clauses for recovery and exit arrangements

Table: Critical Business Services (CBS) of Malaysian Life Reinsurance

Regulatory Requirements & Examples for Malaysian Insurers

Bank Negara Malaysia’s Operational Resilience Expectations

Although Malaysia’s operational resilience framework for insurance is still in discussion (2025 BNM Discussion Paper on Operational Resilience), key themes indicate what regulators expect:

• Focus on continuity of critical financial services — regulators emphasise the ability to prevent, respond to, recover from, and adapt to operational disruptions that could affect essential services.
• Heightened governance and accountability — clear roles for Board and senior management in embedding resilience.
• Risk-based scenario testing and impact tolerances — institutions must understand tolerances and plan responses accordingly.

Although this discussion paper is consultative, it signals a regulatory shift toward more formal operational resilience obligations and reporting standards.

Existing Frameworks Relevant to Insurance

While direct operational resilience regulations specific to insurance may evolve, existing BNM frameworks provide important foundations:

• Risk Management in Technology (RMiT): Issues and expectations regarding secure, resilient IT systems and third-party oversight—especially relevant to CBS with technology dependencies.
• Business Continuity Management Guidelines: Embedded within broader operational risk management frameworks, mandating continuity planning, testing, and recovery objectives.
• Governance & Board Accountability Policies: Emphasise senior leadership oversight — a foundational element of resilience.

In practice, these frameworks require insurers (including reinsurers such as MLRe) to identify dependencies, assess risks, define tolerances, test continuity plans, and report to regulators.

Practical Examples of CBS-Focused Operational Resilience Preparations

Example 1: Scenario Testing for Claims Processing

MLRe might conduct regular “severe but plausible” disruption tests—for instance, simulating a cyber incident that affects claims systems and measuring the impact on claims turnaround times and recovery objectives.

Example 2: Third-Party Provider Failover

MLRe should validate that third-party data hosting services have failover capabilities that meet predefined impact tolerances for underwriting and policy servicing systems.

Operational resilience transforms how MLRe must think about its critical business services — moving from isolated risk and continuity functions to an integrated, service-centric model that supports regulatory expectations and client trust.

Identifying Critical Business Services is a foundational step in implementing an effective operational resilience programme at Malaysian Life Reinsurance.

By clearly defining which services must remain available during severe but plausible disruptions, the organisation ensures that resilience efforts are focused on outcomes that matter most—protecting customers, supporting ceding insurers, and maintaining confidence in the Malaysian insurance sector.

This chapter establishes the baseline for subsequent operational resilienceactivities, including dependency mapping, impact tolerance definition, scenario testing, and governance oversight.

With CBS clearly articulated, Malaysian Life Reinsurance is better positioned to demonstrate regulatory alignment, strengthen service continuity, and embed resilience as a core organisational capability rather than a standalone compliance exercise.

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.