[OR] [RCBC] [E1] [C5] Identifying Critical Business Services

What Are the Critical Operations or Critical Business Services of Rizal Commercial Banking Corporation (RCBC) When Implementing its Operational Resilience Program?

Introduction

For operational resilience purposes, RCBC should identify its Critical Business Services (CBS) by examining the services it delivers to customers and the wider financial system, and then determining which of those services would cause intolerable harm if disrupted.

BCM Institute describes a critical business service as a service provided to one or more clients that, if disrupted, could cause intolerable harm to customers or pose a risk to the soundness, stability, or orderly operation of the financial system.

BSP Circular No. 1203 uses the closely related concept of “critical operations” and requires BSFIs to identify, approve, map, protect, and test those operations through disruption. Note that in this eBook, "Critical Operations" is "Critical Business Services" or "CBS".

For RCBC, this exercise should be grounded in the Bank’s actual business model and delivery channels. RCBC states that it offers consumer, commercial, and corporate lending products; deposits and cash management solutions; treasury products; remittance services; and mobile banking services.

Its operating footprint also includes branches, ATMs, ATMGo terminals, and internet/mobile banking, which means its resilience program must cover both physical and digital service delivery. (RCBC)

What Regulators Require a Philippine Bank to Do

BSP Circular No. 1203 requires a Philippine BSFI to establish board-approved criteria for identifying and prioritising critical operations, using an end-to-end view of delivery rather than focusing only on an individual process, person, or system.

The Board must approve the identified critical operations, which then drive the next steps: setting tolerance for disruption and mapping interconnections and interdependencies.

The Circular also requires BSFIs to set a tolerance for disruption for each identified critical operation, using at least a time-based metric and, where relevant, other measures such as the number of customers affected or the volume and value of affected transactions.

Those tolerances must be tested against severe but plausible scenarios.

In addition, BSP expects banks to map interconnections and interdependencies, integrate operational resilience with operational risk, business continuity, third-party risk, and ICT risk, and assess vulnerabilities arising from third-party providers and public infrastructure such as telecommunications and energy.

The Circular specifically highlights severe but plausible scenarios such as pandemics, natural calamities, failure of key service providers, and major cyber incidents.

Recommended Critical Business Services for RCBC

The table below sets out a recommended CBS inventory for RCBC.

This is a reasoned operational resilience view based on RCBC’s publicly described services and the BSP’s requirements.

It should be treated as a starting point for RCBC’s internal validation, not as RCBC’s officially disclosed CBS list. (RCBC)

Explanation of the Recommended CBS

CBS-1: Deposit and Account Services

This should be treated as a primary CBS because it is central to customer relationships and underpins many downstream services, including debit card usage, digital banking access, cash withdrawals, transfers, and fee or interest processing.

In BSP terms, it is an end-to-end service whose disruption can materially affect customers and can cascade into other critical operations.

CBS-2: Payments, Funds Transfer, and Cash Management Services

Payments and transfer capability are typically among the most visible critical services in a bank because they support day-to-day economic activity.

For RCBC, this includes retail and corporate payment flows, collections, disbursements, transaction banking, and cash management APIs and online capabilities.

This CBS is likely to have extensive interdependencies across core banking, digital channels, telecoms, settlement partners, and third parties.

CBS-3: Digital Banking and Channel Access Services

RCBC’s positioning as a digital banking leader makes this a strong CBS candidate.

RCBC highlights mobile and internet banking, RCBC Pulz, corporate online banking, and DiskarTech as important parts of customer service delivery.

Because a large share of customers may rely on these channels as their primary service interface, a prolonged outage, a cyber disruption, or an authentication failure would be operationally significant.

CBS-4: ATM, Card, and Cash Access Services

Even when digital channels are available, access to cash remains a critical customer outcome.

RCBC’s ATM and ATMGo footprint, including reach into underserved and remote areas, means cash access is not merely a support channel but an important service outcome in itself.

In resilience terms, this CBS must account for dependencies on network connectivity, power, card rails, terminal providers, and field support.

CBS-5: Lending and Credit Services

Lending may not require the same minute-by-minute continuity as payments, but it can still qualify as a CBS where disruption would materially harm customers, especially for drawdowns, loan restructuring, collections, salary loans, digital unsecured loans, and credit card servicing.

For RCBC, the breadth of consumer, SME, and corporate financing supports its inclusion as a critical service domain.

CBS-6: Remittance and Global Filipino Banking Services

Because remittances are often time-sensitive and essential to household cash flow, prolonged disruption may cause direct harm to customers.

RCBC’s remittance and Global Filipino Banking offerings support treating this as a distinct CBS or, depending on internal design, as part of a broader payments-and-transfers CBS.

The final classification should depend on RCBC’s internal assessment of customer harm, transaction significance, and interdependency with other service lines.

CBS-7: Treasury, Foreign Exchange, and Liquidity-Related Client Services

For a universal bank such as RCBC, treasury and FX services can be critical for institutional, corporate, and high-value clients, particularly when disruptions may affect liquidity access, hedging, settlement readiness, or foreign currency obligations.

Whether RCBC treats this as a standalone CBS or folds it into corporate and transaction banking should depend on internal materiality, customer harm assessment, and systemic relevance.

Practical Examples of BSP Operational Resilience Requirements Applied to RCBC

Using BSP Circular No. 1203, RCBC should apply board-approved criteria to determine which of the above services are truly critical, and then define disruption tolerances for each.

For example, for Deposit and Account Services, the tolerance may include the maximum acceptable downtime before customer harm becomes intolerable; for Payments and Funds Transfer, it may also include transaction backlog, value of delayed payments, and number of affected customers; for Digital Banking, it may include failed logins, transaction success rates, and availability thresholds.

RCBC should then map the people, processes, systems, third parties, and public infrastructure that support each CBS.

For example, Digital Banking and Payments would depend on authentication services, core banking, network connectivity, cybersecurity controls, telecom providers, API integrations, ATM/card networks, and cloud or hosting arrangements, where used. BSP explicitly requires mapping of interconnections and interdependencies and expects due diligence and fallback arrangements where third parties support critical operations.

Finally, RCBC should test each CBS against severe but plausible scenarios. BSP gives examples that are directly relevant to RCBC, including pandemics, natural calamities, major cyber incidents, and failure of key service providers.

For RCBC, this could mean testing whether Deposit Services, Payments, and Digital Banking can continue within tolerance during a cyberattack, a telecommunications outage, a data centre disruption, or a widespread branch-and-ATM-network outage caused by severe weather.

For RCBC, the most defensible starting point for an operational resilience program is a CBS inventory centred on Deposit and Account Services; Payments, Funds Transfer, and Cash Management; Digital Banking and Channel Access; ATM, Card, and Cash Access; Lending and Credit; Remittance; and Treasury/Foreign Exchange services.

These service domains reflect RCBC’s publicly stated business model and delivery channels, and they align with BSP Circular No. 1203’s requirement to identify and protect critical operations that matter most to customers, the institution, and the financial system. (RCBC)

The next step after identifying these CBS is not merely to list them, but to break each one into detailed sub-services, map their dependencies, set tolerances for disruption, identify severe but plausible scenarios, and design scenario tests and recovery actions.

In that sense, the CBS list is the foundation of RCBC’s operational resilience program because it defines what the bank must continue to deliver even when disruption occurs.

I can also turn this into a more formal ebook-style chapter with a “Purpose of the Chapter” section and a refined CBS table for direct insertion into your document.

Blogs marked [x] are under construction

eBook 1: Understanding Your Organisation: Philippine National Bank
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

 

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.