[OR] [P2] [S2] [MII] [C17] Case Study – Banking Sector CBS Mapping

[P2] [S2] Chapter 17

Case Study – Banking Sector CBS Mapping

Introduction

To translate theory into practice, this chapter presents a banking sector case study illustrating how to map interconnections and interdependencies for Critical Business Services (CBS). The objective is to demonstrate how mapping moves from high-level identification to end-to-end dependency visibility, enabling actionable operational resilience outcomes.

The case study focuses on two commonly identified CBS in banks:

• CBS-1: Deposit & Account Services
• CBS-2: Payments & Funds Transfer Services

These services are foundational to banking operations and are typically prioritised by regulators and institutions due to their customer impact, systemic importance, and regulatory significance.

Purpose of the Chapter

The purpose of this chapter is to:

• Provide a practical illustration of CBS mapping
• Demonstrate end-to-end dependency mapping
• Show how interconnections span people, processes, technology, and third parties
• Highlight how mapping supports operational resilience analysis

Overview of Selected CBS

CBS-1: Deposit & Account Services

This CBS includes services related to:

• Customer onboarding and account opening
• Deposit and withdrawal transactions
• Account maintenance and servicing
• Balance reporting and statements

Key Characteristics:

• High customer dependency
• Continuous availability expectations
• Regulatory reporting requirements

CBS-2: Payments & Funds Transfer Services

This CBS includes services related to:

• Domestic and cross-border payments
• Fund transfers between accounts
• Bill payments and standing instructions
• Clearing and settlement processes

Key Characteristics:

• Time-critical processing
• Integration with external payment networks
• High systemic importance

End-to-End Mapping Approach

For both CBS, mapping follows an end-to-end service delivery approach, covering:

1. Service initiation
2. Processing and validation
3. Execution and settlement
4. Completion and reporting

Each stage is supported by:

• Processes
• People
• Technology
• Data
• Third-party providers

CBS-1: Deposit & Account Services – Dependency Mapping

Sub-CBS Structure

Sample Dependency Mapping

Key Observations

• Heavy reliance on core banking systems (shared dependency)
• Integration with external networks (ATM, KYC providers)
• Sequential dependencies across onboarding → approval → activation
• Potential concentration risk in centralised systems and data platforms

CBS-2: Payments & Funds Transfer – Dependency Mapping

Sub-CBS Structure

Sample Dependency Mapping

Key Observations

• Strong reliance on external payment networks (external dependency)
• Multiple real-time system integrations (API connectivity)
• Sequential dependencies with high time sensitivity
• Concentration risk in authentication and payment processing systems

End-to-End Interdependency Illustration

Combined Dependency Flow

An example of end-to-end interconnection for a payment transaction:

1. Customer initiates payment via mobile app
2. Authentication system verifies identity
3. Fraud detection engine screens transaction
4. Core banking system checks funds
5. Payment engine processes transaction
6. External payment network performs clearing
7. Settlement occurs between banks
8. Notification system confirms transaction

Interdependency Characteristics

• Sequential Dependencies: Each step must occur in order
• Shared Dependencies: Core banking and authentication systems support multiple CBS
• External Dependencies: Payment networks and third-party providers
• Data Dependencies: Continuous data flow across systems

Key Risks Identified

Single Points of Failure

• Core banking system
• Authentication platform

Critical Dependencies

• Payment processing engine
• KYC system
• Customer database

Concentration Risks

• Single cloud or infrastructure provider
• Centralised data centres
• Shared third-party vendors

Link to Operational Resilience

 Impact Tolerance

• Mapping identifies critical points affecting downtime thresholds
• Helps define acceptable disruption levels

Scenario Testing

• Enables design of realistic scenarios such as:
• Payment network outage
• Core banking system failure
• Cyberattack on authentication systems

Recovery Planning

• Supports prioritisation of recovery actions
• Ensures restoration of end-to-end service delivery

Lessons Learned

1. Service-Centric Mapping is Critical

Focusing on CBS ensures alignment with customer outcomes and regulatory expectations.

2. Interdependencies are Complex and Multi-Layered

Dependencies span across internal systems, external providers, and data flows.

3. External Dependencies Drive Risk Exposure

Third-party and ecosystem dependencies significantly influence resilience.

4. Mapping Enables Actionable Insights

Identifies vulnerabilities, concentration risks, and recovery priorities.

This case study demonstrates how interconnection and interdependency mapping can be applied in a banking context to provide end-to-end visibility of Critical Business Services.

By mapping:

• CBS-1: Deposit & Account Services
• CBS-2: Payments & Funds Transfer Services

organisations can clearly understand how services are delivered, where dependencies exist, and how disruptions may propagate.

The outcome is a comprehensive and actionable view of operational resilience, enabling:

• Better risk identification
• More effective scenario testing
• Stronger recovery planning

Ultimately, this practical illustration reinforces the central theme of this eBook—moving from complexity to clarity, ensuring that interconnections and interdependencies are not only mapped, but fully understood and effectively managed.