[OR] [SBC] [E3] [CBS] [1] [MPR] Map Processes and Resources

Written by Moh Heng Goh | Apr 2, 2026 2:28:08 AM

CBS-1 Retail Deposit & Account Services

Introduction

Mapping Processes and Resources is a critical requirement in implementing operational resilience, as guided by BSP Circular No. 1203 Series of 2024.

This activity enables Security Bank Corporation to identify, document, and understand the full range of resources—people, processes, technology, and third parties—that support the delivery of its Retail Deposit and Account Services (CBS-1).

This mapping provides end-to-end visibility of how each Sub-CBS operates, including upstream and downstream dependencies. It ensures that the bank can assess vulnerabilities, prioritise recovery strategies, and maintain service continuity within defined impact tolerances during disruptions.

Purpose of the Chapter

The purpose of this chapter is to:

Provide a structured mapping of processes and resources supporting each Sub-CBS under CBS-1
Enable identification of critical dependencies and single points of failure
Support scenario testing and impact tolerance validation
Ensure compliance with BSP operational resilience requirements, particularly in end-to-end mapping, third-party risk management, and ICT resilience

Table P3: Map Processes and Resources for CBS-1

Sub-CBF Code	Sub-CBS	Processes	People	Technology (Applications & Infrastructure)	Third-Party Vendors	Upstream / Downstream Dependencies
1.1	Customer Onboarding and Account Application	Account application capture, document collection, and data entry	Branch staff, Relationship Managers, Digital onboarding team	Core banking system (CBS), CRM, onboarding platform, mobile/web apps	eKYC providers, digital signature vendors	Upstream: Customer data input; Downstream: KYC verification (1.2)
1.2	Customer Identification and Verification (KYC/CDD)	Identity verification, sanctions screening, risk profiling	Compliance officers, KYC analysts	AML systems, identity verification systems, and sanctions screening tools	Credit bureaus, government ID databases	Upstream: Onboarding (1.1); Downstream: Account approval (1.3)
1.3	Account Approval and Opening	Approval workflows, account creation, and account number generation	Branch managers, Operations team	Core banking system, workflow engine	None / Regulatory databases	Upstream: KYC (1.2); Downstream: Funding (1.4)
1.4	Initial Funding and Deposit Booking	Cash/check deposit, fund transfer, and account activation	Tellers, Operations staff	Teller system, payment gateway, core banking	Payment networks, clearing houses	Upstream: Account opening (1.3); Downstream: Account setup (1.5)
1.5	Product Terms Setup and Account Parameter Maintenance	Interest setup, fee configuration, and account limits	Product managers, Operations	Core banking product module, parameter configuration tools	None	Upstream: Account creation; Downstream: Transactions (1.6–1.7)
1.6	Deposit Transactions Processing	Cash deposits, transfers, and posting transactions	Tellers, Operations, IT support	Core banking, ATM systems, and payment switch	ATM networks, interbank networks	Upstream: Account setup; Downstream: Balance updates (1.10)
1.7	Withdrawal and Funds Access Processing	Cash withdrawals, ATM withdrawals, fund transfers	Tellers, Customer service, IT support	ATM systems, mobile banking, core banking	ATM networks, card schemes (Visa/Mastercard)	Upstream: Transaction processing; Downstream: Fraud monitoring (1.13)
1.8	Account Servicing and Customer Maintenance	Updates to customer data, account changes, and service requests	Customer service officers, call centre agents	CRM, core banking, ticketing systems	Call centre outsourcing vendors	Upstream: Customer requests; Downstream: Reporting (1.10)
1.9	Interest, Fees, and Charges Processing	Interest calculation, fee deduction, periodic processing	Finance team, Operations	Core banking batch processing systems	None	Upstream: Account balances; Downstream: Reporting (1.10)
1.10	Statement, Passbook, and Balance Reporting	Statement generation, balance inquiry, and reporting	Operations, IT, Customer service	Reporting systems, data warehouse, and online banking	Print vendors, email/SMS providers	Upstream: Transaction data; Downstream: Customer communication
1.11	Digital Account Access and Channel Integration	Online/mobile banking access, authentication, API integration	Digital banking team, IT security	Mobile apps, internet banking platform, API gateway, IAM systems	Cloud providers, fintech partners	Upstream: Core banking data; Downstream: Transactions (1.6–1.7)
1.12	Reconciliation and Exception Management	Account reconciliation, discrepancy resolution	Finance, Operations, Audit	Reconciliation systems, data analytics tools	External auditors	Upstream: Transaction records; Downstream: Regulatory reporting (1.14)
1.13	Fraud Detection and Transaction Monitoring	Transaction monitoring, fraud alerts, and investigation	Fraud analysts, Risk team	Fraud detection systems, AI/analytics tools	Fraud intelligence providers	Upstream: Transaction processing; Downstream: Incident response (1.15)
1.14	Regulatory Reporting and Compliance Monitoring	Regulatory submissions, compliance checks	Compliance officers, Risk team	Regulatory reporting systems, AML systems	Regulators, compliance platforms	Upstream: Reconciliation (1.12); Downstream: Audit/oversight
1.15	Incident Response, Business Continuity, and Recovery	Incident management, crisis response, and DR activation	BCM team, IT DR team, Crisis management team	DR sites, backup systems, and incident management tools	DR site providers, telecom providers	Upstream: All CBS components; Downstream: Service recovery

Regulatory Alignment with BSP Circular No. 1203 (2024)

The mapping above demonstrates compliance with key requirements from BSP Circular No. 1203 Series of 2024, including:

End-to-End Mapping of Critical Business Services

Each Sub-CBS is linked to its supporting resources and dependencies
Example: Transaction processing (1.6) linked to ATM networks and payment switches

Identification of Critical Resources and Interdependencies

Highlights reliance on technology (core banking, digital channels) and third parties (ATM networks, cloud providers)

Third-Party Risk Management

Explicit identification of external vendors, such as payment networks and eKYC providers
Supports regulatory expectations to manage outsourcing risks

ICT and Cyber Resilience Integration

Inclusion of fraud systems, IAM, and digital banking platforms
Example: Sub-CBS 1.11 (Digital Access) integrates cybersecurity controls

Support for Scenario Testing and Impact Tolerance

Enables simulation of disruptions (e.g., ATM outage, cyberattack, third-party failure)
Provides inputs for defining Maximum Tolerable Downtime (MTD)

The mapping of processes and resources for CBS-1 Retail Deposit and Account Services provides Security Bank Corporation with a comprehensive view of how its critical services are delivered and sustained.

By systematically identifying the processes, people, technology, and third-party dependencies for each Sub-CBS, the bank strengthens its ability to anticipate, withstand, and recover from disruptions.

This structured mapping is not merely a documentation exercise—it forms the foundation for impact tolerance setting, scenario testing, and continuous resilience improvement.

In alignment with BSP Circular No. 1203, it ensures that Security Bank can maintain critical services within acceptable levels during severe but plausible scenarios, thereby safeguarding customer trust, financial stability, and regulatory compliance.

Ultimately, this chapter equips stakeholders with the necessary insights to transition from planning to execution, embedding operational resilience into the bank’s day-to-day operations and long-term strategy.

eBook 3: Starting Your OR Implementation
CBS-1 Retail Deposit & Account Services
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.



	If you have any questions, click to contact us.

View full post