[OR] [PIDM] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Identifying Critical Business Services for Perbadanan Insurans Deposit Malaysia (PIDM)

Introduction

Operational resilience is an organisation's ability to continue delivering critical business services during severe but plausible disruptions.

It requires organisations to move beyond protecting individual departments, systems, and processes towards ensuring that services essential to stakeholders remain available within acceptable levels of disruption.

For Perbadanan Insurans Deposit Malaysia (PIDM), operational resilience is particularly significant because it protects eligible depositors and takaful and insurance policy owners, administers protection systems, and contributes to financial system stability.

Unlike a commercial financial institution, PIDM's critical services are not primarily centred on everyday banking transactions.

They include maintaining protection arrangements, preparing for member institution failures, executing intervention and resolution responsibilities within its statutory mandate, and ensuring eligible beneficiaries receive protection when required.

A disruption affecting these services could undermine public confidence, delay protection payments, impede resolution activities, or weaken PIDM's ability to fulfil its statutory responsibilities during periods of financial stress.

Identifying Critical Business Services (CBS) is therefore an important early activity in PIDM's operational resilience programme. It establishes which externally significant services must be protected, how they depend on internal and external resources, and which disruptions require particular management attention.

This chapter introduces the concept of CBS, sets criteria for identifying them, proposes an initial CBS catalogue for PIDM, examines severe but plausible disruption scenarios, and explains how the proposed approach aligns with Bank Negara Malaysia's (BNM) operational resilience framework.

Scope and assumptions: The CBS catalogue presented in this chapter is a proposed implementation model, not PIDM's officially approved service inventory.

PIDM's statutory functions are used as contextual inputs, while service boundaries, criticality classifications, dependencies, and impact tolerances require validation by PIDM's management and relevant service owners.

What Is a Critical Business Service (CBS)?

A Critical Business Service is a service an organisation delivers, directly or through another party, whose disruption could cause intolerable harm to its users or threaten the stability, soundness, or resilience of the wider financial system.

The BCM Institute's operational resilience methodology emphasises identifying services end to end rather than treating individual business functions, technology systems, or supporting activities as standalone critical services.

For PIDM, interpret this definition in the context of its statutory responsibilities and the consequences of failing to deliver protection or resolution services when required.

A service may qualify as critical even when it is rarely activated. For example, deposit reimbursement may remain dormant under normal conditions but become essential immediately after a member bank fails.

Characteristics of a CBS

A proposed PIDM service should exhibit the following characteristics before it is designated as critical.

Define a CBS based on the outcome stakeholders need, not the organisational department responsible for delivering it.

For example, the information technology department may maintain the infrastructure supporting depositor reimbursement, but IT infrastructure management is not the external service itself.

It is an important dependency supporting the delivery of the reimbursement service.

Distinguishing CBS from Critical Business Functions (CBF)

Business Continuity Management (BCM) traditionally identifies critical business functions and establishes recovery arrangements for their supporting resources.

Operational resilience builds on BCM but shifts the primary focus towards the continued delivery of an entire service.

Several CBFs may collectively support one CBS.

For example, insured deposit reimbursement may depend on depositor data validation, eligibility determination, payment calculation, funding authorisation, payment execution, and customer communication.

These activities should be mapped as components of the service rather than automatically classified as separate CBS.

Applying the CBS Concept to PIDM

PIDM's mandate includes administering the Deposit Insurance System (DIS) and the Takaful and Insurance Benefits Protection System (TIPS), protecting eligible beneficiaries, promoting sound risk management, and contributing to financial system stability.

PIDM also performs responsibilities associated with resolving member institutions.

These responsibilities create two broad categories of services for operational resilience purposes.

Continuous services operate during normal business conditions. They include maintaining protection arrangements, managing membership-related obligations, and communicating essential protection information.

Event-driven services become particularly important during a member institution's distress or failure. They include executing resolutions, reimbursing insured deposits, and administering protected takaful and insurance benefits.

Both categories must be considered when identifying CBS. Do not exclude a service merely because it is activated infrequently.

Key Considerations for Identifying CBS at PIDM

PIDM should adopt a structured identification methodology that combines its statutory mandate, stakeholder needs, disruption consequences, and operational dependencies.

The identification exercise should involve senior management, business service owners, risk management, BCM, information technology, legal, finance, and relevant external stakeholders.

Consideration 1: Alignment with PIDM's statutory mandate

Start by identifying services that directly enable PIDM to fulfil its legal responsibilities.

These include administering protection arrangements, responding to member institution failures and supporting orderly resolution.

Services should be defined precisely enough to distinguish their intended outcomes.

For example, maintaining deposit insurance protection and executing reimbursement are related but distinct services.

The former concerns the ongoing administration of protection, while the latter concerns delivering the financial protection following a qualifying failure.

Consideration 2: Potential harm to depositors and policy owners

PIDM should evaluate the consequences of a disruption from the perspective of affected beneficiaries.

Relevant factors include:

• Number of depositors or policy owners affected.
• Value of insured deposits or protected benefits involved.
• Duration of delayed access to funds or benefits.
• Financial vulnerability of affected beneficiaries.
• Availability of alternative arrangements.
• Potential for widespread uncertainty or loss of confidence.

A delay in reimbursement following a bank failure could have substantially different consequences from an interruption to routine administrative reporting.

Criticality should therefore reflect the severity and timing of the potential harm rather than transaction volumes alone.

Consideration 3: Financial system stability

PIDM should consider whether a service disruption could affect confidence in other member institutions or the broader financial system.

The assessment should examine potential consequences such as delayed resolution, uncertainty about protection arrangements, contagion concerns, and interruptions affecting multiple member institutions.

The importance of a service may increase significantly during a systemic event involving several institutions simultaneously.

Consideration 4: Time sensitivity and activation conditions

Different PIDM services may have different operating patterns.

Some operate continuously, while others must activate within a short period after a defined event.

The identification process should document:

• Normal operating conditions.
• Events that trigger service activation.
• Required mobilisation arrangements.
• Time-sensitive decision points.
• Expected service outcomes.
• Consequences of delayed activation.

This is particularly important for resolution and reimbursement services.

Consideration 5: Interconnections and interdependencies

PIDM's ability to deliver critical services may depend on resources outside its direct control.

Potential dependencies include member institutions, depositor and policyholder records, payment channels, banking partners, technology providers, telecommunications services, and relevant authorities.

Assess a service across its complete delivery chain.

A functioning internal reimbursement system, for example, may still be insufficient if depositor information is unavailable or the payment channel cannot process disbursements.

Consideration 6: Concentration and common-point-of-failure risks

PIDM should identify situations where multiple services rely on the same resources.

Examples include a shared data centre, identity management platform, cloud provider, telecommunications network, or small group of specialist personnel.

The simultaneous loss of such resources could affect several CBS.

The identification process should therefore record shared dependencies early, even though detailed mapping will be undertaken during the implementation phase.

Consideration 7: Service ownership and governance

Each CBS should have a clearly designated accountable owner.

The service owner should maintain the service definition, validate dependencies, propose impact tolerances, participate in scenario testing, and report material resilience weaknesses.

Senior management should review the proposed CBS inventory, challenge the criticality assessments, and submit the final catalogue for approval through PIDM's established governance arrangements.

Proposed Critical Business Services of PIDM

Based on PIDM's statutory mandate and the potential consequences of service disruption, this chapter proposes an initial catalogue of ten CBS.

The catalogue separates ongoing protection administration from event-driven protection and resolution services.

It also recognises that public communication, institutional readiness, and the availability of financial resources may become essential to delivering PIDM's mandate during a crisis.

Assess the proposed services individually to determine whether disruption would meet PIDM's agreed criticality threshold. Their inclusion here does not imply that all ten have already been designated critical.

Table 5.1: Proposed Enterprise CBS Catalogue for PIDM

Illustrative catalogue for management validation. Service codes are proposed identifiers, not official PIDM classifications.

Interpretation of the Proposed Enterprise CBS Catalogue

The ten services represent an initial enterprise-wide view of PIDM's operational resilience responsibilities.

CBS-1 and CBS-3 address the continuous administration of the two protection systems. CBS-2 and CBS-4 address delivering protection after qualifying failures.

CBS-5 and CBS-6 address resolution execution and the preparedness necessary to activate it.

CBS-7, CBS-8, and CBS-10 concern activities that may either constitute distinct critical services or form part of the delivery chain for other CBS, depending on the final service boundaries.

CBS-9 recognises the potential consequences of an inability to provide reliable information during a member institution's failure.

Important classification consideration: CBS-6, CBS-7, CBS-8, and CBS-10 should receive particular scrutiny.

PIDM should determine whether each delivers a sufficiently distinct service outcome or is better classified as a critical supporting function or dependency.

The final catalogue should avoid treating every important internal capability as a separate CBS.

Recommended service boundaries and stakeholders

A CBS catalogue becomes more useful when each service has a defined beginning, ending, and recipient.

The following table provides a proposed starting point.

Table 5.2: Proposed Service Boundaries and Stakeholders

Test the proposed boundaries against actual operating arrangements.

For example, CBS-2 should not end merely when PIDM instructs a payment. Its outcome should account for whether insured depositors can access the reimbursed funds through the applicable disbursement arrangement.

Similarly, CBS-4 should reflect the protection mechanism used for the relevant insurer failure. The required outcome may involve benefit payment, continuation of coverage or another legally authorised arrangement.

Example Severe but Plausible Scenarios Affecting PIDM's CBS

Identifying CBS establishes what must be protected. The next step is to understand how these services could be disrupted.

Severe but plausible scenarios should challenge PIDM's ability to maintain service delivery under conditions that exceed routine incidents while remaining credible.

Scenario design should consider simultaneous failures, unavailable personnel, compromised information, technology outages, third-party disruptions, and exceptional demand.

The following examples are hypothetical testing scenarios, not descriptions of incidents that have occurred at PIDM.

Table 5.3: Severe but Plausible Disruption Scenarios

Selecting Scenarios for Detailed Testing

PIDM should select scenarios according to their ability to expose vulnerabilities in end-to-end service delivery.

A scenario involving a ransomware attack, for example, should not be limited to restoring an application.

It should assess whether PIDM can still obtain accurate depositor records, determine reimbursement amounts, authorise funding, execute payments, and communicate with affected depositors.

The test should also consider what happens when normal recovery assumptions fail.

For example, backup systems may be unavailable, a critical supplier may experience the same incident, or specialist personnel may be unable to access the recovery environment.

These complications help establish whether PIDM can maintain the service within its approved impact tolerance.

Linking Scenarios to Impact Tolerances

Once the CBS catalogue has been approved, PIDM should establish measurable impact tolerances for each service.

Potential measures include maximum disruption duration, the number of affected beneficiaries, the value of delayed payments, the volume of unprocessed cases, and minimum acceptable service capacity.

For event-driven services, measurement should begin from a clearly defined activation point, such as the applicable authorisation or failure event.

Distinguish impact tolerances from internal recovery time objectives.

An application may be restored within its recovery time objective while the associated service remains unavailable because of missing information, failed payment arrangements, or unresolved processing errors.

PIDM should therefore test the actual service outcome rather than relying exclusively on technology recovery results.

Regulatory Alignment with Bank Negara Malaysia

Understanding the regulatory context

BNM issued its Discussion Paper on Operational Resilience on 19 December 2025.

It sets out emerging regulatory considerations to strengthen the continuity of critical financial services, including managing dependencies, disruption tolerances, severe but plausible scenario testing, and governance accountability.

Treat the paper as a discussion document rather than a final, universally applicable operational resilience policy.

An important distinction applies to PIDM: it is a statutory deposit insurer and resolution authority, not a conventional BNM-regulated bank or insurer.

The discussion paper's stated definition of financial institutions does not expressly include PIDM.

Consequently, the proposed alignment in this chapter is a recommended supervisory and good-practice benchmark. It does not establish that every requirement applicable to BNM-regulated financial institutions is legally binding on PIDM.

PIDM should determine its actual obligations under the PIDM Act, other applicable legislation, and relevant arrangements with BNM before finalising its compliance framework.

Alignment with BNM's Operational Resilience Principles

BNM's discussion paper identifies several interconnected capabilities: preserving critical services, mapping dependencies, managing third parties, setting tolerances, and assessing resilience through severe but plausible scenarios.

It also emphasises leadership and continuous improvement.

PIDM can use these themes to structure its own operational resilience implementation.

Table 5.4: Proposed PIDM Alignment with BNM's December 2025 Discussion Paper

Source basis: BNM, Discussion Paper on Operational Resilience, 19 December 2025, particularly Sections 3, 4, 6, and 7. The PIDM implementation measures are proposed applications, not direct quotations of regulatory requirements.

Integrating Operational Resilience with Existing BCM Arrangements

PIDM should avoid establishing operational resilience as an entirely separate programme disconnected from its existing risk management and BCM capabilities.

Instead, it should integrate the CBS catalogue with relevant arrangements for business continuity, technology recovery, cyber incident management, crisis management, and third-party risk management.

Existing business impact analyses can provide valuable information about critical functions, recovery objectives, and supporting resources.

However, these assessments should be extended to examine the consequences of disruption across the entire service delivery chain.

For example, an existing BCM assessment may identify the recovery requirements of PIDM's reimbursement processing function.

An operational resilience assessment should additionally establish whether depositors can receive their insured funds when other dependencies, including information sources and payment arrangements, are disrupted.

The objective is to build on existing capabilities while closing gaps that become apparent when viewed from an end-to-end service perspective.

Governance and approval

PIDM should establish a formal approval process for the proposed CBS catalogue.

Senior management should validate the service definitions, identify accountable owners, and challenge the justification for each service's criticality.

The board, or the appropriate governing body under PIDM's governance arrangements, should provide oversight and approve the catalogue through the established decision-making framework.

The approved catalogue should then guide dependency mapping, impact tolerance setting, scenario testing, and resilience investment decisions.

This approach is consistent with the governance direction discussed by BNM, which emphasises board oversight, senior management accountability, and cross-functional coordination.

Practical Implementation: Validating PIDM's CBS Catalogue

The proposed catalogue should be converted into a controlled enterprise document through a structured validation exercise.

The exercise should establish whether the services have been defined at the correct level, whether they genuinely meet the criticality criteria, and whether important service outcomes have been omitted.

Table 5.5: Recommended CBS Validation Activities

Maintain the approved register as a controlled document and review it whenever material changes occur to PIDM's mandate, operating arrangements, technology, third-party relationships, or risk environment.

Recommended Outputs from This Chapter

At the end of the CBS identification exercise, PIDM should have a set of documented outputs to support the subsequent stages of operational resilience implementation.

CBS identification checklist

• [ ] An approved enterprise catalogue of Critical Business Services.

• [ ] Documented definitions, boundaries, and intended outcomes for each CBS.

• [ ] A criticality assessment explaining the potential consequences of disruption.

• [ ] Identified stakeholders and accountable service owners.

• [ ] A preliminary register of supporting functions and shared dependencies.

• [ ] An initial list of severe but plausible scenarios.

• [ ] A governance record documenting review, challenge, and approval.

These deliverables provide the foundation for moving from service identification to detailed implementation.

Identifying Critical Business Services is a foundational activity in establishing operational resilience at PIDM.

The process requires PIDM to move beyond identifying important departments and systems towards understanding which end-to-end services must continue during severe disruptions to protect depositors, takaful certificate and insurance policy owners, and the wider financial system.

This chapter has proposed ten candidate CBS covering protection administration, reimbursement, benefit fulfilment, resolution, preparedness, financial resource availability, communication, and critical information coordination.

The proposed catalogue is an initial framework, not a final classification. PIDM should validate each service against its statutory mandate, intended outcomes, potential disruption consequences, and dependencies before obtaining formal approval.

Once approved, the CBS catalogue will provide the basis for the subsequent implementation activities: mapping interconnections and interdependencies, establishing impact tolerances, conducting severe but plausible scenario testing, and implementing improvements based on identified weaknesses.

The ultimate objective is not simply to restore individual processes after a disruption. It is to ensure that PIDM can continue fulfilling its essential protection and resolution responsibilities when its services are most needed.

Blogs marked [x] are under construction

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, offer in-depth insights and practical toolkits to embed this model effectively.