[OR] [PBCOM] [E3] [CBS] [1] [MPR] Map Processes and Resources

Written by Moh Heng Goh | Apr 17, 2026 5:56:13 AM

CBS-1 Deposit & Account Services

Introduction

The “Map Processes and Resources” for CBS-1 Deposit and Account Services is a critical step in implementing operational resilience.

It builds upon dependency mapping by explicitly linking each Sub-Critical Business Service (Sub-CBS) to the processes and resources required for its delivery.

According to BCM Institute’s operational resilience methodology, this mapping ensures that organisations understand how services are delivered, which resources are essential, and where vulnerabilities may arise across people, processes, technology, and third-party dependencies.

For The Philippine Bank of Communications (PBCom), this mapping aligns directly with the expectations of Bangko Sentral ng Pilipinas (BSP) under BSP Circular No. 1203 Series of 2024, which requires BSFIs to identify and map critical operations and their supporting resources end-to-end.

This includes identifying applications, infrastructure, personnel, third-party service providers, and upstream/downstream dependencies, ensuring that disruptions can be managed within defined impact tolerances.

Table P3: Map Processes and Resources for CBS-1

Sub-CBS Code	Sub-CBS	Processes	People	Technology (Applications & Infrastructure)	Third-Party Vendors	Upstream / Downstream Dependencies
1.1	Customer Onboarding and Account Application	Account opening workflow, document capture, and customer profiling	Branch staff, relationship managers, and onboarding officers	Onboarding platform, CRM, document imaging, and branch network	ID verification services, telecom providers	Upstream: Customer initiation; Downstream: KYC (1.2), Approval (1.3)
1.2	Customer Identification and Verification (KYC/CDD)	KYC checks, sanctions screening, risk profiling	Compliance officers, AML analysts	KYC/AML systems, screening engines, and customer database	External watchlist providers	Upstream: Onboarding (1.1); Downstream: Approval (1.3), Fraud Monitoring (1.15)
1.3	Account Approval and Opening	Approval workflow, CIF creation, and account setup	Branch managers, operations approvers	Core banking system (CASA), workflow tools	System vendors, e-sign providers	Upstream: KYC (1.2); Downstream: Funding (1.4), Digital Access (1.11)
1.4	Initial Funding and Deposit Booking	Cash/check acceptance, transaction posting	Tellers, branch operations	Teller system, core banking ledger, clearing interfaces	Payment networks, clearing houses	Upstream: Account Opening (1.3); Downstream: Transactions (1.6), Reconciliation (1.13)
1.5	Product Setup and Account Parameter Maintenance	Product configuration, limit setting, maintenance	Product managers, system admins	Core banking product tables, configuration tools	Core banking vendors	Upstream: Product design; Downstream: Transactions (1.6), Fees (1.9)
1.6	Deposit Transactions Processing	Deposit posting, transfers, batch processing	Tellers, operations staff	Core banking engine, middleware, transaction switch	Payment processors, telecom providers	Upstream: Funding (1.4); Downstream: Reporting (1.10), Fraud Monitoring (1.15)
1.7	Withdrawal and Funds Access Processing	Cash withdrawals, balance validation	Tellers, ATM operations staff	Teller systems, ATM switch, authentication systems	ATM networks, cash logistics providers	Upstream: Transactions (1.6); Downstream: Reconciliation (1.13), Fraud Monitoring (1.15)
1.8	Account Servicing and Customer Maintenance	Data updates, service requests, and account changes	Customer service, branch staff	CRM, customer master database	Messaging/email vendors	Upstream: Customer requests; Downstream: Reporting (1.10), Complaints (1.16)
1.9	Interest, Fees, and Charges Processing	Interest calculation, fee charging	Finance, operations staff	Core banking engine, batch scheduler	System vendors	Upstream: Product setup (1.5); Downstream: Reporting (1.10), Complaints (1.16)
1.10	Statement, Passbook, and Balance Reporting	Statement generation, balance inquiry	Operations staff, customer service	Statement engine, reporting tools, and archive systems	Print/mail vendors, SMS/email providers	Upstream: Transactions (1.6); Downstream: Complaints (1.16), Regulatory Reporting (1.17)
1.11	Digital Account Access Enablement	User enrollment, authentication setup	Digital banking team, IT admins	Mobile/online banking platform, IAM systems	OTP/SMS providers, cloud services	Upstream: Account Opening (1.3); Downstream: Transactions (1.6), Fraud Monitoring (1.15)
1.12	ATM and Card-Based Access Management	Card issuance, PIN management	Card operations, ATM support	Card management system, ATM switch	Card vendors, network schemes	Upstream: Account Opening (1.3); Downstream: Withdrawals (1.7), Fraud Monitoring (1.15)
1.13	Account Reconciliation and Exception Handling	Balancing, exception resolution	Finance, reconciliation analysts	Reconciliation tools, core banking reports	External clearing systems	Upstream: Transactions (1.6); Downstream: Regulatory Reporting (1.17)
1.14	Dormancy, Holds, and Account Restrictions Management	Dormancy tagging, hold placement	Compliance, operations	Core banking restriction modules	Legal/regulatory bodies	Upstream: Account Servicing (1.8); Downstream: Withdrawal Controls (1.7)
1.15	Fraud Monitoring and Transaction Surveillance	Transaction monitoring, alert handling	Fraud analysts, AML teams	Fraud monitoring systems, analytics engines	Fraud intelligence providers	Upstream: Transactions (1.6), Digital Access (1.11); Downstream: Complaints (1.16), Reporting (1.17)
1.16	Complaints, Disputes, and Service Recovery	Complaint handling, dispute resolution	Contact centre, operations	CRM, case management systems	Network partners, service vendors	Upstream: All customer-facing services; Downstream: Reporting (1.17), BCM (1.18)
1.17	Regulatory Reporting and Compliance Monitoring	Regulatory reporting, compliance checks	Compliance officers, reporting teams	MIS/reporting systems, data warehouse	Regulatory portals, audit providers	Upstream: All Sub-CBS; Downstream: Management oversight
1.18	Business Continuity and Service Recovery	Incident response, DR activation, recovery	BCM team, IT DR team, crisis management	DR site, backup systems, resilience tools	DR site providers, telecom vendors	Upstream: All Sub-CBS; Downstream: Service restoration across CBS

Regulatory Requirements and Examples (BSP Circular 1203)

Under BSP Circular No. 1203 Series of 2024, Philippine banks such as The Philippine Bank of Communications are required to:

Map critical operations and supporting resources end-to-end, including people, processes, technology, facilities, and third parties
Identify interdependencies and single points of failure across systems and service providers
Assess vulnerabilities and concentration risks, especially in third-party arrangements
Ensure substitutability or fallback arrangements for critical resources
Maintain updated documentation of mapping to reflect operational or system changes

Examples relevant to CBS-1:

A core banking system outage impacting deposit posting and balance inquiry (affects 1.6, 1.7, 1.10)
A telecommunications failure disrupting mobile banking and OTP delivery (affects 1.11)
A third-party ATM network failure is limiting customer access to funds (affects 1.12, 1.7)
A cyberattack or ransomware incident impacting customer data and transaction processing (affects 1.2, 1.6, 1.15)
A natural disaster (e.g., earthquake or typhoon) affecting branch operations and staff availability (affects 1.1–1.8 broadly)

These examples reinforce the need for integrated mapping across all Sub-CBS, ensuring that PBCom can maintain operations within defined disruption tolerances.

The Map Processes and Resources for CBS-1 Deposit and Account Services provides PBCom with a structured, regulator-aligned view of how its most critical retail banking service is delivered.

By linking each Sub-CBS to its underlying processes, people, technology, and third-party dependencies, the bank gains a clear understanding of operational interconnections and potential vulnerabilities across the service lifecycle.

In line with the Bangko Sentral ng Pilipinas' expectations, this mapping must be continuously updated, validated, and integrated into broader operational resilience activities, such as impact tolerance setting, scenario testing, third-party risk management, and business continuity planning.

Ultimately, this ensures that PBCom can sustain, adapt, and recover its Deposit and Account Services even under severe but plausible disruptions—protecting customers, maintaining financial stability, and meeting regulatory obligations.

eBook 3: Starting Your OR Implementation
CBS-1 Deposit & Account Services
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.



	If you have any questions, click to contact us.

View full post