[OR] [WFP] [E3] [CBS] [1] [MPR] Map Processes and Resources

Mapping processes and resources is a critical step in operational resilience, as it enables an organisation to understand how its critical business services (CBS) are supported end-to-end. For CBS-1 Payment & Transaction Processing, this involves identifying the full ecosystem of people, processes, technology, and third parties that collectively ensure the uninterrupted execution of payment services.

In alignment with BSP Circular No. 1203, Series of 2024, financial institutions must demonstrate a clear understanding of interdependencies, vulnerabilities, and the criticality of resources. This mapping supports:

Identification of single points of failure
Assessment of impact tolerances
Strengthening of response and recovery capabilities
Integration of third-party risk management and ICT resilience

The following table provides a comprehensive mapping of the processes and resources that support each Sub-CBS under Payment & Transaction Processing.

Table P3: Map Processes and Resources for CBS-1

Sub-CBF Code	Sub-CBS	Processes	People	Technology (Applications & Infrastructure)	Third-Party Vendors	Upstream / Downstream Dependencies
1.1	Payment Initiation and Capture	Payment input via channels (online, branch, API)	Frontline staff, digital channel teams	Online banking platforms, mobile apps, API gateways	Fintech channel partners	Upstream: Customer channels; Downstream: Authentication
1.2	Customer Authentication and Authorization	Identity verification, MFA, access control	IAM teams, cybersecurity specialists	IAM systems, MFA tools, biometrics systems	Authentication service providers	Upstream: Initiation; Downstream: Validation
1.3	Payment Validation and Compliance Screening	Sanctions screening, AML checks, validation rules	Compliance officers, AML analysts	AML systems, sanctions screening engines	Regulatory data providers (e.g., sanctions lists)	Upstream: Authentication; Downstream: Routing
1.4	Transaction Routing and Network Integration	Routing to internal/external payment networks	Payment operations team	Payment switch, routing engines	SWIFT network, local clearing networks	Upstream: Validation; Downstream: Funds check
1.5	Funds Availability Check and Reservation	Balance validation, fund reservation	Core banking operations team	Core banking system, liquidity engines	None / internal	Upstream: Routing; Downstream: Execution
1.6	Payment Processing and Execution	Debit/credit posting, transaction execution	Payments processing team	Core banking system, transaction processors	Payment processors	Upstream: Funds check; Downstream: Clearing
1.7	Interbank Clearing and Settlement Processing	Clearing file exchange, settlement processing	Treasury ops, settlement team	Clearing systems, settlement engines	Central banks, clearing houses	Upstream: Execution; Downstream: Reconciliation
1.8	Cross-Border Payment Processing	FX conversion, international routing	FX desk, cross-border specialists	FX platforms, SWIFT messaging systems	Correspondent banks, FX providers	Upstream: Execution; Downstream: Settlement
1.9	Transaction Monitoring and Fraud Detection	Real-time fraud monitoring, alert handling	Fraud analysts, risk teams	Fraud detection systems, AI monitoring tools	Fraud intelligence providers	Upstream: Execution; Downstream: Exception handling
1.10	Exception Handling and Repair Processing	Error handling, transaction repair workflows	Operations support teams	Case management systems	None / limited vendors	Upstream: Monitoring; Downstream: Reconciliation
1.11	Reconciliation and Ledger Balancing	GL reconciliation, mismatch resolution	Finance and reconciliation teams	Reconciliation systems, GL systems	Audit support vendors	Upstream: Settlement; Downstream: Reporting
1.12	Payment Status Notification and Reporting	Customer notifications, reporting	Customer service teams	Notification systems (SMS/email), reporting tools	Messaging service providers	Upstream: Processing; Downstream: Customers
1.13	Customer Dispute and Claims Handling	Dispute intake, investigation, and resolution	Customer support, dispute teams	Case management, CRM systems	Card schemes, arbitration bodies	Upstream: Notifications; Downstream: Regulatory reporting
1.14	Regulatory Reporting and Compliance Monitoring	Regulatory submissions, compliance monitoring	Compliance teams, reporting officers	Regulatory reporting systems	Regulators, compliance vendors	Upstream: Reconciliation; Downstream: Regulators
1.15	Liquidity and Settlement Risk Management	Liquidity monitoring, risk controls	Treasury, risk management teams	Liquidity management systems	Market data providers	Upstream: Funds check; Downstream: Settlement
1.16	Third-Party and Correspondent Bank Coordination	Vendor coordination, SLA management	Vendor management teams	Vendor management systems	Correspondent banks, service providers	Upstream: Cross-border; Downstream: Settlement
1.17	System Availability and Infrastructure Support	System monitoring, uptime management	IT operations, infrastructure teams	Data centers, cloud platforms, and network infrastructure	Cloud providers, telecom providers	Supports all Sub-CBS
1.18	Incident Response and Service Recovery	Incident management, DR activation	Crisis management teams, IT recovery teams	Incident management tools, DR sites	DR service providers	Supports all Sub-CBS

Regulatory Alignment and Operational Resilience Considerations

In accordance with BSP Circular No. 1203 Series of 2024, this mapping demonstrates several key regulatory expectations:

1. End-to-End Visibility of Critical Services

Institutions must map complete service chains, including upstream inputs (e.g., customer channels) and downstream outputs (e.g., regulators, clearing houses).
Example: Payment routing (1.4) explicitly links to external networks such as SWIFT and clearing systems.

2. Identification of Critical Resources

Clear identification of:

People (e.g., AML analysts, fraud teams)
Technology (e.g., core banking, fraud systems)
Third parties (e.g., correspondent banks)

Enables prioritisation during disruption scenarios.

3. Third-Party Risk Management

Heavy reliance on:

Correspondent banks (1.8, 1.16)
Network providers (1.4)

Requires robust SLAs, contingency arrangements, and substitution strategies.

4. ICT and Cyber Resilience Integration

Critical reliance on:

Payment systems
IAM and fraud monitoring platforms

Regulators expect resilience testing, redundancy, and cyber incident response integration.

5. Support for Scenario Testing and Impact Tolerance

This mapping forms the foundation for:

Severe but plausible scenario design
Impact tolerance setting

Example: Failure of SWIFT connectivity impacts 1.4, 1.8, and 1.7 simultaneously.

The mapping of processes and resources for CBS-1 Payment & Transaction Processing provides Wells Fargo Philippines with a holistic view of its operational ecosystem, highlighting the intricate interdependencies that underpin payment services.

By clearly identifying supporting processes, critical personnel, enabling technologies, and external dependencies, the organisation is better positioned to anticipate disruptions and respond effectively.

More importantly, this structured mapping aligns with regulatory expectations under BSP Circular No. 1203 Series of 2024 by enabling:

Proactive identification of vulnerabilities
Strengthened third-party and ICT risk management
Enhanced preparedness for disruption scenarios
Improved recovery and continuity strategies

Ultimately, this exercise is not merely documentation—it is a strategic resilience tool that supports Wells Fargo Philippines in maintaining continuous, reliable, and secure payment services, even under severe but plausible disruptions.

Wells Fargo Title Banner

eBook 3: Starting Your OR Implementation
CBS-1 Payment & Transaction Processing
CBS-1 DP	CBS-1 MD	CBS-1 MPR	CBS-1 ITo	CBS-1 SuPS	CBS-1 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.