[OR] [PBCOM] [E1] [C5] Identifying Critical Business Services

What Are the Critical Business Services of The Philippine Bank of Communications When Implementing an Operational Resilience Program?

Introduction

For a Philippine bank, this approach aligns closely with BSP Circular No. 1203, Series of 2024, which requires BSFIs to identify and prioritise critical operations using board-approved criteria, taking into account factors such as the impact of disruption on the institution’s viability, its customers, and the financial system.

The BSP also states that identification should cover the end-to-end activities necessary to deliver the service, rather than focusing only on a person, process, or system.

For the Philippine Bank of Communications (PBCOM), the starting point is its actual service portfolio. PBCOM publicly offers personal and business banking services, including account services, savings and checking, time deposits, digital services, bill payment, payroll services, wire transfers, investments, loans, and cash management solutions.

The Philippine Stock Exchange’s company information for PBCOM also states that the bank offers deposit products, credit and loan facilities, trade-related services, treasury and foreign exchange trading, cash management services, and trust and investment management services to both individual and corporate clients.

Against that background, the following are the most reasonable critical business services for PBCOM’s operational resilience program.

Purpose of the Chapter

The purpose of this chapter is to identify the business services of the Philippine Bank of Communications that are most likely to meet the threshold of being “critical” from an operational resilience perspective.

The chapter also explains why these services matter, how they relate to BSP expectations, and which regulatory requirements a Philippine bank should consider when defining and protecting them.

Recommended Critical Business Services for PBCOM

The list above is an implementation-oriented CBS view, not a regulatory filing template.

It translates PBCOM’s publicly visible service offerings into service lines that can be assessed under BSP’s operational resilience requirements.

It also follows the BCM Institute's view that CBS should be framed as services experienced by customers and stakeholders, while the underlying processes, systems, people, facilities, and vendors are mapped later as dependencies.

How BSP Circular No. 1203 Shapes the Identification of PBCOM’s CBS

BSP Circular No. 1203 requires a bank to adopt board-approved criteria for identifying and prioritising critical operations.

In practice, this means PBCOM should not label every important activity as a CBS. It should prioritise services whose disruption would create material customer harm, threaten the bank’s viability, or generate broader financial system risk.

The number of identified critical operations should also be proportionate to the bank’s size, nature, and complexity.

The Circular further requires the bank to establish a tolerance for disruption for each critical operation. At a minimum, BSP expects a time-based metric showing how quickly the bank must restore the service before material risk arises.

Other measures may include the number of affected customers or the volume and value of disrupted transactions. These requirements strongly support treating Deposit and Account Services and Payments and Funds Transfer Services as top-tier CBS for PBCOM because both involve large customer populations and time-sensitive transactional activity.

The BSP also requires banks to determine severe but plausible scenarios and test whether critical operations can remain within tolerance during disruption.

For PBCOM, relevant examples would likely include a major online banking outage, an ATM network disruption, a cyberattack affecting account access or payments, branch unavailability, a third-party service failure, or a disruption affecting cash management and payroll processing.

These are exactly the kinds of cross-functional scenarios that justify defining CBS at the service level rather than by isolated departments.

Another key requirement is mapping interconnections and interdependencies.

BSP’s self-assessment questions explicitly ask whether the institution has mapped personnel, activities, interconnections, interdependencies, and key resources that support critical operations.

The Circular also defines supporting assets broadly to include people, technology, information, facilities, internal processes, IT systems, clearing and settlement facilities, and outsourced services.

This means each PBCOM CBS should later be decomposed into its supporting sub-processes, applications, branch operations, payment rails, call centre support, vendors, and recovery arrangements.

Third-party dependency is especially important. BSP states that where third-party providers support critical operations, the bank should ensure that those providers align with its operational resilience framework.

Service arrangements affecting critical operations must include provisions on maintaining service during disruption or an exit strategy if the provider cannot deliver, including substitutes or bringing the service back in-house.

For PBCOM, this would be highly relevant to digital channels, payment connectivity, ATM services, outsourced technology, and other externally supported services.

Finally, BSP makes clear that business continuity management (BCM) is an essential component of operational resilience and that periodic exercises should test the bank’s ability to deliver critical operations through disruption.

This means the CBS list is not merely descriptive; it becomes the basis for tolerance setting, dependency mapping, scenario design, response planning, and resilience testing.

Practical Interpretation for PBCOM

In practical terms, PBCOM should treat CBS-1 Deposit and Account Services, CBS-2 Payments and Funds Transfer Services, and CBS-3 Digital, ATM, and Branch-Based Customer Access as the most immediate candidates for priority analysis because they are customer-facing, high-volume, and central to everyday banking.

The bank’s public channels show strong emphasis on accounts, digital access, transfers, bill payment, and branch/ATM availability, all of which are typical first-wave CBS in a bank resilience program.

The next layer would usually include Lending and Credit Facilities, Cash Management and Corporate Transaction Banking, and Treasury/FX services, especially where disruption could affect borrower access to funds, corporate operations, settlement capability, or liquidity management.

Trust and Investment Management and Trade-Related Banking Services may also qualify as CBS where the impact of disruption on fiduciary duties, customer assets, or trade execution is material enough to breach tolerance for disruption.

That prioritisation decision should be made using the BSP’s board-approved criteria and the bank’s own business impact analysis.

For The Philippine Bank of Communications, the most defensible approach is to identify critical business services from the perspective of the end-to-end services the bank must continue delivering to customers and the market, rather than from internal departmental silos.

Based on PBCOM’s published services and BSP Circular No. 1203, the strongest CBS candidates are deposit and account services, payments and funds transfers, customer access channels, lending, cash management, treasury/FX, trust and investment services, and trade-related banking services.

These CBS should then serve as the foundation for the next stages of the operational resilience program: defining detailed sub-processes, mapping dependencies, setting tolerances for disruption, identifying severe but plausible scenarios, and conducting testing.

That is the point where PBCOM moves from a high-level service inventory to a working operational resilience framework aligned with BSP expectations.

Blogs marked [x] are under construction

eBook 1: Understanding Your Organisation: PBCOM
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

 

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.