[OR] [UBP] [E1] [C5] Identifying Critical Business Services

 eBook 1: Chapter 5 What Are the Critical Business Services of Union Bank of the Philippines for Operational Resilience?

Introduction

When Union Bank of the Philippines implements an operational resilience program, one of the first and most important tasks is to identify its Critical Business Services (CBS). In operational resilience, the focus is not on every internal activity, system, or department in isolation. Instead, the focus is on the services delivered to customers, counterparties, and the wider financial ecosystem that must continue, even during severe disruption.

The BCM Institute defines a critical business service as a service that, if disrupted, could cause intolerable harm to clients or pose a risk to the soundness, stability, or resilience of the financial industry and the orderly operation of markets. It also recommends identifying services through an end-to-end service lens, considering dependencies, stakeholder impact, and recovery requirements.

For a Philippine bank, this approach aligns closely with BSP Circular No. 1203, Series of 2024, which requires BSP-supervised financial institutions to strengthen their ability to deliver critical operations through disruption. The Circular makes clear that the identification of critical operations drives later steps such as setting tolerance for disruption, mapping interconnections and interdependencies, and testing against severe but plausible scenarios.

It also requires the operational resilience framework to be aligned with the bank’s overall governance and risk management system, with board oversight over the identification of critical operations and related disruption tolerances. 

UnionBank’s business model strongly supports a service-led view of resilience. Its official website presents the bank as a digital-led Philippine universal bank offering accounts and transaction services, digital banking, payments, loans, collections, supplier payments, and corporate cash management capabilities.

Its UnionBank Online service highlights features such as opening an account, transferring funds, paying bills, depositing cash, and check deposit, while its corporate pages highlight payment collections, cash management, and supply chain financing. These offerings help indicate which services are most likely to qualify as critical in an operational resilience framework.

What is a Critical Business Service in the Context of UnionBank?

For UnionBank, a CBS should be understood as a customer-facing or market-facing service whose disruption would result in one or more of the following:

• significant harm to retail, SME, corporate, or institutional customers;
• inability of customers to access money, make payments, receive funds, or service obligations;
• failure to meet regulatory or legal obligations;
• serious reputational damage or loss of market confidence; or
• knock-on effects on the Philippine financial system, payment ecosystem, or dependent institutions.

This means that UnionBank should not simply list internal departments such as IT, HR, or Finance as CBS. Those are supporting functions. Instead, it should identify the banking services delivered externally, then map the internal processes, people, technology, facilities, and third parties that support those services. This distinction is consistent with the BCM Institute guidance that regulators are interested in the business service itself, while underpinning and internal services are documented as dependencies rather than presented as the business service.

Proposed Critical Business Services of Union Bank of the Philippines

Below is a practical chapter-level view of the most likely CBS for UnionBank. These are framed as illustrative but strongly grounded in UnionBank’s public offerings and the expectations of BSP Circular No. 1203.

1. Deposit and Account Services

This CBS covers the opening, maintenance, servicing, and access to customer deposit accounts such as savings and current accounts. It includes customer onboarding, account opening, account servicing, balance inquiry, cash deposits, account maintenance, and related customer transactions.

For UnionBank, this is clearly critical because deposit accounts are the foundation of retail and business banking relationships. Disruption would prevent customers from accessing funds, receiving salary credits, maintaining liquidity, or performing basic banking activities. UnionBank’s public channels explicitly promote account opening and ongoing account access through UnionBank Online.

Why it qualifies as critical:

• Customers may lose access to their own funds.
• downstream services such as payments, bills, cards, and loans often depend on deposit accounts;
• Prolonged disruption could create significant customer harm and reputational damage.
• It may affect broader confidence in the bank’s core operations.

2. Payments, Funds Transfer, and Bill Payment Services

This CBS includes domestic funds transfer, transfers to other banks and e-wallets, bill payments, merchant and QR-enabled payment services, and related collections/disbursements capabilities.

UnionBank’s website prominently features the ability to collect payments via QR or link, pay suppliers, pay government and utility bills, and transfer funds through its digital channels. The UnionBank Online pages also highlight send money, InstaPay transfers, e-wallet transfers, and bill payment features. These are classic CBS because payment disruption causes immediate customer harm and may also affect the functioning of the wider financial system.

Why it qualifies as critical:

• Customers and businesses depend on the timely movement of money.
• Failed payments may disrupt payroll, supplier settlement, obligations, and commerce.
• Payment outages can affect counterparties and other financial institutions.
• BSP specifically emphasizes protecting critical operations and testing delivery under disruption.

3. Digital Banking and Customer Access Channels

This CBS covers UnionBank Online and other digital access channels through which customers authenticate, view balances, initiate payments, access accounts, and use banking services anytime and anywhere.

Given UnionBank’s positioning as a leading digital bank and its extensive digital self-service functionality, digital access is not merely a convenience layer; it is a primary delivery channel for many customer services. If customers cannot log in or transact digitally, multiple dependent services may effectively fail at once, even if some back-end systems remain available.

Why it qualifies as critical:

• It is the primary access path for many customer journeys.
• disruption can simultaneously impair account access, transfers, payments, and service requests;
• Digital channel failure can produce immediate and visible customer harm at scale.
• The dependency footprint is large, involving authentication, cybersecurity, telecoms, APIs, and third parties.

4. Card-Based Payment and Cash Access Services

This CBS includes debit and credit card transaction processing, ATM cash withdrawal, point-of-sale usage, card-linked digital payments, and related authorization and settlement activities.

UnionBank’s public pages show card-linked services such as debit or credit card use in digital payments and mobile tap-to-pay. In a retail banking environment, this is a critical service because card usage is closely tied to daily access to funds and consumer payment capability. A prolonged outage could prevent customers from purchasing essentials or accessing cash.

Why it qualifies as critical:

• supports daily household and business transactions;
• linked directly to access to customer funds;
• involves external networks and counterparties, increasing systemic importance;
• Disruption may create immediate financial and reputational consequences.

5. Lending and Credit Servicing

This CBS covers loan origination, approval, disbursement, repayment collection, and ongoing servicing for personal and other lending products.

UnionBank publicly promotes loan products with fast approvals and flexible repayment options. Lending becomes a CBS where the service is material to customers’ financial continuity and where operational disruption affects disbursements, repayments, collections, or borrower servicing. While not every lending product may be equally critical, loan servicing for active customers often is.

Why it qualifies as critical:

• borrowers may be unable to access approved financing or service obligations properly;
• errors in repayment processing can trigger customer harm, disputes, and compliance issues;
• Disruption could affect cash flow for households and businesses.
• In a resilience program, loan servicing is often prioritized over purely sales-oriented credit origination. This is an implementation judgment based on the impact lens required by the regulator.

6. Corporate Cash Management and Collections/Disbursements

This CBS covers corporate cash management, payment collections, supplier payments, account management, disbursements, and related services delivered to corporate and institutional customers.

UnionBank’s corporate pages explicitly promote cash management, payment collections, supplier payments, and related portal-based services. These are likely CBS because many business customers rely on them for liquidity management, payables, receivables, and treasury operations. Disruption would not only affect the corporate client but may also ripple through suppliers, employees, and counterparties.

Why it qualifies as critical:

• enables day-to-day liquidity and payment operations for businesses;
• failures can cascade into supply chains and settlement obligations;
• High transaction values and dependency chains increase materiality.
• often involves multiple third parties and network dependencies.

7. Supply Chain Financing and Embedded Business Finance Services

UnionBank publicly highlights supply chain financing as a service that helps business communities improve cash flows through financing embedded in automated processes. For a digital-led bank serving business ecosystems, this can qualify as a CBS where disruption would materially affect buyers, suppliers, and SME financing flows.

Why it may qualify as critical:

• supports working capital and ecosystem financing;
• Disruption can affect many parties across a commercial network.
• has strong third-party and platform dependencies;
• may be prioritized where UnionBank has high market reliance or concentration in this service.

8. Remittance and Customer Fund Receipt Services

UnionBank Online also promotes the ability to receive funds via QR code and includes remittance-related capabilities. For many customers, especially in the Philippine context, receipt of funds is a high-impact service because it affects household liquidity, personal obligations, and business cashflows.

Why it may qualify as critical:

• directly affects customers’ ability to receive and use funds;
• Often time-sensitive and linked to daily living needs;
• Disruption may cause disproportionate customer harm even if the transaction values are modest.

Suggested CBS Inventory for UnionBank

A practical initial CBS inventory for UnionBank could therefore be stated as follows:

Regulatory Requirements UnionBank Should Apply When Identifying CBS

Under BSP Circular No. 1203, UnionBank should not stop at naming the services. The bank should also ensure that the identification of CBS:

1. Is approved through governance and board oversight

The Circular says the operational resilience framework must align with governance and risk management, and that the criteria for identifying critical operations and setting disruption tolerances should be reviewed, challenged, and approved by the board.

Example for UnionBank:

The board or a board-level risk committee should approve the criteria used to classify “Payments” or “Digital Banking Access” as critical.

2. Drives tolerance for disruption

The Circular states that identified critical operations drive the setting of disruption tolerances. These tolerances should include at least a time-based metric, and may also include customer numbers, transaction volume, and transaction value affected.

Example for UnionBank:

For Instapay and bill payment services, UnionBank may define the maximum acceptable outage duration, the maximum affected transaction volume, and the maximum number of impacted customers before harm becomes intolerable.

3. Requires mapping of interconnections and interdependencies

The BSP self-assessment questions explicitly ask whether the BSFI has mapped the activities, interconnections, interdependencies, and key resources supporting critical operations.

Example for UnionBank:

For UnionBank Online, the bank would map customer authentication, mobile app infrastructure, core banking interfaces, payment gateways, telecoms, cloud or hosting dependencies, fraud controls, and third-party service providers.

4. Must consider severe but plausible scenarios and testing

The Circular requires disruption tolerance to be tested against severe but plausible scenarios, and it requires periodic business continuity exercises covering identified critical operations, interconnections, and key dependencies.

Example for UnionBank:

UnionBank should test scenarios such as mobile banking unavailability, core payment switch failure, cyberattack on digital channels, third-party telecom outage, or a failure affecting corporate payment processing.

5. Must include third-party resilience considerations

The Circular emphasizes that third-party service arrangements affecting critical operations must include details on how services will be maintained during disruptions or what exit and substitution arrangements exist.

Example for UnionBank:

If card processing, cloud hosting, telecom connectivity, or corporate payment platforms rely on third parties, the resilience standards and fallback arrangements for those providers must be explicitly addressed.

Key Considerations When Finalising UnionBank’s CBS

UnionBank should not treat all business services as equally critical. Instead, it should apply a structured assessment based on:

• customer harm if the service is unavailable;
• financial and liquidity impact;
• regulatory consequences;
• market or systemic impact;
• concentration of usage through digital channels;
• reliance on third parties and public infrastructure;
• substitutability of the service or channel.

In practice, UnionBank will probably find that Deposit and Account Services, Payments and Transfers, and Digital Banking Access sit at the top of the criticality hierarchy because they affect the broadest customer base and create the fastest and most visible harm when disrupted. Corporate cash management and selected lending or financing services may then be prioritized based on transaction value, dependency profile, and strategic importance.

The critical business services of Union Bank of the Philippines, for purposes of operational resilience, should be identified through the lens of customer impact, service continuity, and systemic importance. Based on UnionBank’s public business model and the expectations of BSP Circular No. 1203, the most likely CBS include Deposit and Account Services; Payments, Funds Transfer, and Bills Payment Services; Digital Banking and Customer Access Channels; Card-Based Payment and Cash Access Services; Lending and Credit Servicing; Corporate Cash Management and Collections/Disbursements; Supply Chain Financing; and Remittance/Fund Receipt Services.

These CBS should then become the foundation for the next stages of UnionBank’s operational resilience program: mapping processes and resources, identifying interdependencies, setting tolerance for disruption, determining severe but plausible scenarios, and conducting scenario testing. That is precisely the path envisaged both by the BCM Institute’s operational resilience methodology and by BSP’s regulatory framework for Philippine banks.

Blogs marked [x] are under construction.

eBook 1: Understanding Your Organisation
C1	C2 [x]	C3 [x]	C4 [x]
C5	C6 [x]	C7 [x]	C8 [x]

For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

 

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.

	If you have any questions, click to contact us.