[OR] [PTC] [E3] [CBS] [1] [SbPS] Identify Severe but Plausible Scenarios

Sub-CBS Code

Sub-CBS

Severe but Plausible Scenario

Impact / Effect

Proactive Risk Management Action

Link to Integration of Cyber and ICT Risks

1.1

Customer Onboarding and Account Application

Prolonged outage of the digital onboarding platform due to cloud service failure

Inability to acquire new customers; reputational impact

Multi-channel onboarding fallback (branch/manual); cloud redundancy; onboarding SLAs

Cloud resilience, digital channel availability monitoring

1.2

Customer Identification and Verification (KYC/CDD)

Failure of the e-KYC/ID verification API due to a third-party outage

Delays in onboarding; regulatory non-compliance risk

Alternate KYC procedures; cached verification; vendor redundancy

Third-party ICT risk management; API monitoring

1.3

Account Approval and Opening

Core banking approval workflow failure due to a system upgrade error

Backlog in account openings; customer dissatisfaction

Change management controls; rollback procedures; manual approval workflows

Change management controls; system resilience testing

1.4

Initial Funding and Deposit Booking

Payment gateway disruption is preventing initial deposits

Failed account activation; liquidity delays

Multiple funding channels, reconciliation controls, and payment gateway redundancy

Payment system integration resilience; transaction monitoring

1.5

Product Terms Setup and Account Parameter Maintenance

Misconfiguration of account parameters due to a system patch error

Incorrect interest/fees; financial loss; compliance breach

Maker-checker controls; configuration audits; automated validation

Configuration management; system integrity controls

1.6

Deposit Transactions Processing

Core banking system downtime due to database corruption

Inability to process deposits; widespread service outage

High-availability architecture; database replication; DR site activation

Core banking resilience, data integrity, and backup controls

1.7

Withdrawal and Funds Access Processing

ATM and teller system outage during the peak period

Customers unable to access funds; reputational damage

ATM network redundancy; branch fallback; cash contingency planning

ATM network security; endpoint resilience

1.8

Account Servicing and Customer Maintenance

CRM system outage due to ransomware attack

Inability to update customer details; service delays

Cyber incident response plan; data backup; endpoint protection

Cyber resilience (ransomware defense, SOC monitoring)

1.9

Interest, Fees, and Charges Processing

Batch processing failure due to job scheduler malfunction

Incorrect balances; customer disputes

Automated reconciliation; batch monitoring; rerun capability

Batch processing monitoring; system job controls

1.10

Statement, Passbook, and Balance Reporting

Data extraction/reporting system failure

Customers are unable to view balances/statements

Backup reporting tools; alternate channels (branch/mobile)

Data warehouse resilience; reporting system redundancy

1.11

Digital Account Access and Channel Integration

Mobile/online banking outage due to DDoS attack

Loss of digital access; customer complaints

DDoS protection; traffic filtering; alternate channels

Cybersecurity (DDoS mitigation, network security)

1.12

ATM and Card-Based Access Management

Card switch network failure or compromise

ATM/POS transactions declined; fraud exposure

Network redundancy, card controls, and fraud monitoring systems

Card system security; network resilience

1.13

Account Reconciliation and Exception Handling

Reconciliation system failure, causing unresolved mismatches

Financial misstatements; operational risk exposure

Automated reconciliation tools; exception tracking; manual override

Data reconciliation system integrity; audit trails

1.14

Dormancy, Holds, Restrictions, and Account Control Administration

Erroneous mass account freeze due to a system logic error

Customer funds inaccessible; complaints escalation

Segregation of duties; control validation; emergency override procedures

Access control systems; system logic validation

1.15

Fraud Monitoring and Transaction Surveillance

Failure of the fraud detection system due to an AI model malfunction

Undetected fraudulent transactions; financial losses

Real-time monitoring fallback rules; manual review escalation

Cyber fraud analytics; SOC integration

1.16

Complaints, Disputes, and Service Recovery

Contact centre system outage during service disruption

Delayed complaint handling; reputational damage

Multi-channel support (branch/email); crisis communication plan

Contact center system resilience; communication systems

1.17

Regulatory Reporting and Compliance Monitoring

Regulatory reporting system failure near submission deadline

Non-compliance penalties; regulatory sanctions

Backup reporting templates; manual submission protocols

Regulatory reporting systems; data governance controls

1.18

Incident Response, Business Continuity, and Recovery

Simultaneous cyberattack and data centre outage

Prolonged service disruption; systemic impact

Integrated BCM and cyber response; DR testing; crisis management framework

Integration of BCM, DR, and cyber incident response