[OR] [PNB] [E1] [C5] Identifying Critical Business Services

eBook 1: Chapter 5

Critical Business Services of the Philippine National Bank for Operational Resilience

Introduction

In operational resilience, a Critical Business Service (CBS) is a service provided to clients that, if disrupted, could cause intolerable harm to customers or threaten the soundness, stability, or orderly operation of the financial system.

BCM Institute’s guidance also notes that organisations should identify CBS through an end-to-end service lens, rather than merely by looking at internal departments or technology components.

For the Philippine National Bank (PNB), this means identifying those services that customers, counterparties, and the wider market rely on continuously.

Public information about PNB shows that it is a large Philippine universal bank with personal banking, corporate banking, digital banking, cards, trade-related services, remittance capabilities, and a wide domestic and overseas footprint.

Those characteristics strongly suggest that PNB’s CBS set must cover both mass retail services and institution-facing banking services.

Purpose of Identifying CBS for PNB

The purpose of identifying CBS is not to create a long inventory of everything the bank does. Instead, it is to determine which services must remain within acceptable disruption limits because failure to do so would materially harm customers, impair confidence, or affect the banking ecosystem.

BSP Circular No. 1203 requires BSFIs to identify critical operations, set tolerance for disruption, determine severe but plausible scenarios, map interconnections and interdependencies, and integrate business continuity and testing into the operational resilience framework.

Accordingly, the CBS for PNB should be those externally delivered banking services that are essential to depositors, borrowers, payment users, remittance beneficiaries, digital banking users, and corporate clients.

The list below is therefore a recommended operational resilience CBS set for PNB, based on the bank’s publicly visible services and the BSP’s resilience requirements. It is not an official PNB-approved list, but it is a sound starting point for a resilience programme.

Recommended CBS of the Philippine National Bank

CBS-1: Retail Deposit and Account Services

This should be treated as a core CBS because PNB provides deposit accounts, ATM/debit access, passbook and checking-related services, and branch-based account servicing.

Disruption here would directly affect customers’ access to funds, their ability to receive credits, make withdrawals, and maintain basic banking relationships.

For a universal bank, this is one of the clearest examples of a service whose outage could cause immediate harm to customers.

Examples at PNB

• Account opening and maintenance
• Deposit posting and balance maintenance
• ATM/debit card-linked access to funds
• Branch and account servicing for retail customers

CBS-2: Payments, Transfers, and Cash Access

Payments and transfers should be identified as a separate CBS because interruptions can quickly affect both retail and business customers. PNB publicly promotes fund transfers, payment capabilities, account monitoring, and cash management solutions.

BSP Circular No. 1203 also addresses time-based recovery expectations and the consideration of affected transaction volumes and values when setting disruption tolerances, which is especially relevant for payment services.

Examples at PNB

• Intra-bank and interbank transfers
• Bills payment
• ATM cash withdrawal access
• Payment processing and account posting
• Corporate payment execution through cash management platforms

CBS-3: Digital Banking and Customer Channel Access

PNB Digital should be considered a CBS because the bank supports customer access through digital enrolment and online servicing for multiple account types.

If digital channels fail, customers may lose the ability to view balances, transact, authenticate, or self-serve. Given the scale of digital dependence in modern banking, channel availability is not merely a convenience issue; it is central to service continuity.

Examples at PNB

• Customer login and authentication
• Balance inquiry and account information access
• Online transfer and payment initiation
• Digital self-service for retail account holders

CBS-4: Remittance and Overseas Filipino Banking Services

PNB has a long-standing position in OFW remittance and maintains overseas offices and remittance channels.

Public materials show multiple remittance products and overseas payment services.

Because remittance flows are often time-sensitive and directly tied to household needs, disruptions could cause intolerable harm to customers, especially for beneficiaries who depend on incoming funds for daily living expenses. This makes remittance a strong candidate for a distinct CBS for PNB.

Examples at PNB

• Inward remittance crediting
• Overseas remittance origination channels
• Remittance-linked prepaid or beneficiary access arrangements
• Overseas bills payment services

CBS-5: Corporate Cash Management and Business Payments

PNB’s corporate banking page highlights corporate cash management, account access, transaction monitoring, transfer capability, and payment streamlining through PNB C@shNet Plus.

This service is critical because disruption would affect payroll, supplier payments, liquidity movement, and day-to-day treasury operations of business customers.

In operational resilience terms, a failure here may harm not only the direct client but also the client’s own downstream employees and suppliers.

Examples at PNB

• Corporate account access and monitoring
• Bulk payment processing
• Business fund transfers
• Treasury-related payment workflows

CBS-6: Trade Finance and Global Trade Services

PNB describes global trade support, including financing and transaction management. For many commercial clients, trade-related instruments and processing are essential to import-export activity and working capital continuity.

Since PNB historically supported agricultural exports and continues to position global trade services within corporate banking, this service is a credible CBS candidate, particularly for its institutional segment.

Examples at PNB

• Trade finance processing
• Documentary trade transactions
• Trade-related settlement and client servicing

CBS-7: Card-Based Transaction Services

PNB offers credit card and debit/ATM-linked services, and customer support explicitly includes lost/stolen card reporting.

Card-based transaction capability is often critical because customers depend on it for purchases, cash access, and account-linked payments.

A sustained outage may cause widespread customer harm and reputational damage, particularly when cards are a primary means of access.

Examples at PNB

• Debit card transaction authorization
• Credit card usage and merchant payment capability
• Card blocking, support, and continuity handling during incidents

Suggested Prioritised CBS Set for PNB

If PNB wants a concise first-wave CBS inventory for operational resilience implementation, the most defensible initial set would be:

1. Retail Deposit and Account Services
2. Payments, Transfers, and Cash Access
3. Digital Banking and Customer Channel Access
4. Remittance and Overseas Filipino Banking Services
5. Corporate Cash Management and Business Payments
6. Trade Finance and Global Trade Services
7. Card-Based Transaction Services

This prioritisation follows the BCM Institute definition of CBS and aligns with BSP’s focus on critical operations whose disruption could materially affect customers or broader financial stability.

Regulatory Requirements from BSP Circular No. 1203 Relevant to PNB

PNB must identify its critical operations / critical business services

The Circular requires BSFIs to identify critical operations and use governance processes to review and approve them.

The self-assessment questions in Annex A specifically ask whether the BSFI has identified critical operations, the criteria used, and the assumptions and justifications for their criticality.

For PNB, this means that each proposed CBS should be supported by documented evidence of customer harm, systemic importance, transactional significance, and regulatory rationale.

Example for PNB:

“Payments, Transfers, and Cash Access” would qualify because disruption could prevent customers and corporates from moving funds, settling obligations, and accessing cash within required timeframes.

PNB must set a tolerance for disruption for each CBS

The Circular requires a clearly defined tolerance for disruption using quantitative and/or qualitative measures, including, at a minimum, a time-based metric and, where relevant, metrics such as number of customers affected or value/volume of impacted transactions.

Example for PNB:

For “Digital Banking and Customer Channel Access,” PNB could set a maximum tolerable outage period, a threshold for the number of affected active users, and a threshold for failed transaction volume before the disruption is considered outside tolerance.

This would be fully consistent with the Circular’s expectation of time, customer, and transaction-based measures.

PNB must determine severe but plausible scenarios

The Circular states that a robust operational resilience framework requires identifying a broad range of severe but plausible scenarios relevant to the institution’s risk profile and operations.

These scenarios should assess the impact on identified critical operations.

Example for PNB:

A ransomware attack affecting digital channels, a major telecom outage disrupting branch and ATM connectivity, or a third-party payment gateway failure affecting card and online payment services would all be appropriate, severe but plausible scenarios for testing PNB’s CBS.

This is an inference based on BSP’s scenario requirement and PNB’s digital, card, and payment service profile.

PNB must map interconnections and interdependencies

Annex A asks whether the BSFI has mapped interconnections and interdependencies involving critical operations and identified the resources used to support them.

This means PNB must understand the people, processes, technology, facilities, data, and third parties that support each CBS.

Example for PNB:

For “Remittance and Overseas Filipino Banking Services,” PNB would need to map overseas offices, remittance channels, beneficiary crediting processes, payment rails, support teams, and dependencies on communication networks and external counterparties.

PNB must manage third-party risk affecting CBS

The Circular states that third-party service providers supporting critical operations must have resilience arrangements, and critical third-party arrangements must include provisions on maintaining service during disruptions or enabling exit and substitution strategies.

Annex A also asks whether the BSFI has assessed the substitutability of critical third parties, including the option of in-house services where necessary.

Example for PNB:

If a third-party vendor supports digital authentication, payment switching, cloud hosting, or card processing, PNB should define fallback arrangements, substitutes, or manual/in-house workarounds for the affected CBS.

PNB must integrate BCM and testing with operational resilience

The Circular requires BCM to be integrated into the operational resilience framework, including business impact analyses, recovery strategies, incident response and recovery plans, crisis communication, and periodic exercises based on severe but plausible scenarios.

Example for PNB:

For “Retail Deposit and Account Services,” PNB should ensure BIA assumptions, recovery procedures, branch fallback arrangements, customer communications, and scenario exercises are all designed to keep the service within its approved disruption tolerance.

Board and senior management oversight are required

The Circular places responsibility on governance structures, including the board and senior management, to oversee the operational resilience approach.

It also indicates that the criteria for critical operations and tolerance for disruption should be reviewed, challenged, and approved by the board.

Example for PNB:

The final CBS inventory, disruption tolerances, and scenario catalogue should be presented to the appropriate board-level committee and senior management forums for challenge, approval, and investment prioritisation.

Implementation is phased and requires self-assessment and disclosure

Circular No. 1203 provides a phased implementation approach. Within one year from effectivity, BSFIs must submit a self-assessment questionnaire with gap analysis and action plans.

Within two years, universal, commercial, and digital banks and other specified complex institutions are expected to have developed and/or integrated the operational resilience framework into existing risk management systems.

The Circular also introduces public disclosure of the operational resilience approach in annual reports after the relevant implementation phase.

Example for PNB:

As a Philippine universal bank, PNB falls into the category for which the two-year integration timeline is especially relevant.

That makes early identification and approval of CBS a foundational step, because the rest of the resilience framework depends on it.

For the Philippine National Bank, the most appropriate CBS inventory should centre on services that preserve customer access to money, ensure payment continuity, maintain digital banking availability, deliver remittances, support corporate transactions, support trade, and enable card usage.

These are the services most likely to cause intolerable harm to customers or broader disruption if unavailable.

In practical terms, PNB should treat the identification of CBS as the anchor for the rest of its operational resilience programme under BSP Circular No. 1203.

Once CBS are approved, the bank can then map dependencies, set tolerances, select scenarios, align BCM and crisis management, and demonstrate to regulators that its resilience framework is built around the continuous delivery of services that matter most.

Blogs marked [x] are under construction

eBook 1: Understanding Your Organisation: Philippine National Bank
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

 

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.