[BCM] [BML] [E3] [BIA] [T2] [CBF] [1] Retail & Corporate Banking Services

CBF-1 Retail & Corporate Banking Services

This section presents Part 3: Impact Over Time of Business Functions for CBF-1 Retail & Corporate Banking Services at Bank of Maldives (BML). In accordance with ISO 22301 and the Business Impact Analysis (BIA) methodology described in BCMPedia Part 3, the objective of this assessment is to evaluate how the impact of disruption to key retail and corporate banking sub-functions escalates over time.

The analysis identifies the rate at which impacts increase, the criticality of each Sub-CBF, and the point at which disruption becomes unacceptable to the organisation, customers, regulators, and the Maldivian financial system. Impact severity is measured on a 1–5 scale, where 1 represents minimal impact, and 5 represents severe or intolerable impact.

The outputs of this section support the determination of Recovery Time Objectives (RTOs), Maximum Tolerable Periods of Disruption (MTPDs), and Vulnerable Periods, forming a foundation for recovery strategy selection and continuity planning.

Table P3: Impact Over Time of Business Functions for CBF-1

Sub-CBF Code	Sub-CBF	IT Systems and Applications	RPO	System RTO	Supporting Special Equipment or Resources	Remarks
1.1	Customer Onboarding & Account Opening	CRM/Onboarding Platform, KYC/AML System, Core Banking Customer Module	4 hrs	8 hrs	Secure identity verification devices, biometric scanners	High dependency on identity verification & compliance workflow
1.2	Deposit & Withdrawal Services	Core Banking System, ATM Switch, Teller System, Mobile Banking	1 hr	4 hrs	ATM network hardware, POS terminals	Critical for daily cash operations; peak usage risk
1.3	Payment Processing & Fund Transfers	EFT/ACH Processing System, SWIFT, RTGS, Payment Gateway	30 min	2 hrs	Secure network connectivity, payment switches	Real-time / batch settlement; compliance with cut-off times
1.4	Lending & Credit Management	Loan Origination System (LOS), Credit Scoring and Decisioning, Loan Servicing Module	4 hrs	12 hrs	Underwriting support systems, credit bureau interfaces	Regulatory and risk analytics dependency
1.5	Card Services & Merchant Solutions	Card Management System, POS Acquirer, Card Issuing Platform	1 hr	6 hrs	POS devices, card personalisation hardware	High availability is required for retail transactions
1.6	Digital & Online Banking	Internet Banking Portal, Mobile Banking App, API Gateway, MFA/Security Services	15 min	1 hr	Web servers, application servers, and secure authentication devices	24/7 customer access; high transaction volume
1.7	Trade & Corporate Financial Solutions	Trade Finance System, SWIFT for Corporates, Treasury Management	2 hrs	8 hrs	Secure trade documentation scanners, treasury terminals	Integration with external trade partners
1.8	Account Maintenance & Reporting	Core Banking Maintenance Module, Reporting/Analytics Tools, Regulatory Reporting System	4 hrs	8 hrs	Data warehouse, BI/reporting servers	Back-office function; compliance reporting

Explanation of Columns

IT Systems and Applications: Key systems that support the process; these are usually enterprise applications, middleware, and platform components necessary for delivering the Sub-CBF.
RPO (Recovery Point Objective): Maximum acceptable amount of data loss measured in time (e.g., last backup or transaction sync).
System RTO (Recovery Time Objective): Maximum time allowed to restore system service after an outage.
Supporting Special Equipment or Resources: Hardware or specialised resources required to operate or recover the system (e.g., biometric devices, secure authentication servers, POS devices).
Remarks: Notes on dependencies, usage patterns, or special considerations (e.g., compliance windows or peak usage constraints).

The Impact Over Time analysis for CBF-1 Retail & Corporate Banking Services demonstrates that several Sub-CBFs—particularly deposit and withdrawal services, payment processing, card services, and digital banking—reach critical or intolerable impact levels within hours of disruption.

These functions are essential to financial stability, customer confidence, and regulatory compliance, and therefore require aggressive RTOs and highly resilient recovery strategies.

Other Sub-CBFs, such as customer onboarding, account maintenance, and lending administration, exhibit a more gradual impact escalation, allowing for comparatively longer recovery windows; however, prolonged disruption would still result in significant regulatory, reputational, and financial consequences.

This assessment satisfies ISO 22301 BIA requirements by clearly defining impact escalation, RTOs, MTPDs, and vulnerable periods, enabling Bank of Maldives to prioritise resources, design proportionate continuity strategies, and ensure the ongoing delivery of critical banking services during disruptive events.

CBF-1 Retail & Corporate Banking Services

This section identifies and documents the supporting IT systems, applications, and critical resources that enable the delivery of Retail & Corporate Banking Services (CBF-1) at Bank of Maldives.

In line with ISO 22301, the objective of this part is to establish clear visibility of technology dependencies, system recovery priorities, and data recovery requirements (RTO and RPO) for each Sub-CBF.

Understanding these dependencies is essential for effective business continuity planning, IT disaster recovery, and operational resilience, particularly given the bank’s nationwide branch network, reliance on digital channels, and the systemic importance of uninterrupted banking services in the Maldives.

Banner [Table] [BCM] [E3] [BIA] [P4] Supporting IT Systems and Applications [BIAQ]

Table P4: Supporting IT Systems and Applications for CBF-1

Sub-CBF Code	Sub-CBF	IT Systems and Applications	RPO	System RTO	Supporting Special Equipment / Resources	Remarks
1.1	Customer Onboarding & Account Opening	Core Banking System (CBS), Customer Information File (CIF), KYC/AML Screening System, Document Management System	≤ 15 minutes	≤ 2 hours	Branch workstations, document scanners, secure network connectivity	Regulatory-driven process; data integrity and customer identity data are critical
1.2	Deposit & Withdrawal Services	Core Banking System (CBS), Teller System, Cash Management System	≤ 15 minutes	≤ 1 hour	Cash counters, vaults, branch terminals, secure LAN/WAN	High customer impact; essential for branch operations and public confidence
1.3	Payment Processing & Fund Transfers	CBS, Payment Switch, SWIFT, RTGS, ACH Interfaces, Reconciliation System	≤ 5 minutes	≤ 1 hour	Secure payment gateways, HSMs, and network firewalls	Time-sensitive and systemic; strong dependency on external clearing systems
1.4	Lending & Credit Management	Loan Origination System (LOS), CBS, Credit Scoring System, Collateral Management System	≤ 30 minutes	≤ 4 hours	Credit officers’ workstations, document repositories	Moderate tolerance; backlog is manageable in short-term disruptions
1.5	Card Services & Merchant Solutions	Card Management System, Card Switch, POS/ATM Network, Fraud Monitoring System	≤ 5 minutes	≤ 1 hour	ATMs, POS terminals, card embossing equipment, and network connectivity	High transaction volume; reputational and financial risk if unavailable
1.6	Digital & Online Banking	Internet Banking Platform, Mobile Banking App, API Gateway, Authentication Server	≤ 5 minutes	≤ 1 hour	Data centre infrastructure, load balancers, mobile app platforms	Customer-facing and availability-critical; key digital channel for BML
1.7	Trade & Corporate Financial Solutions	Trade Finance System, CBS, SWIFT, Document Management System	≤ 30 minutes	≤ 4 hours	Secure document handling systems, corporate banking portals	Contractual and regulatory obligations; lower transaction frequency
1.8	Account Maintenance & Reporting	CBS, Data Warehouse, MIS/Reporting Tools, Statement Generation System	≤ 24 hours	≤ 24 hours	Batch processing servers, printers, and archival storage	Non-real-time; suitable for deferred processing during disruptions

The identification of supporting IT systems, applications, and special resources for CBF-1 Retail & Corporate Banking Services provides a foundational input to the Bank of Maldives’ Business Continuity Management System (BCMS).

By defining RTO and RPO targets for each Sub-CBF, the bank establishes clear recovery expectations that guide IT disaster recovery strategies, crisis response prioritisation, and investment decisions.

In accordance with ISO 22301, this mapping ensures that critical banking services can be restored within acceptable timeframes following disruptive incidents, while maintaining compliance, customer trust, and financial stability.

The outputs from this section should be reviewed regularly and integrated with IT DR plans, crisis management procedures, and testing programmes to sustain operational resilience across all retail and corporate banking operations.

Note that the icon marked with [x] is under construction

Ensuring Service Continuity and Compliance: ISO 22301 BCMS at Bank of Maldives
eBook 3: Starting Your BCM Implementation
MBCO	P&S [x]	RAR T1 [x]	RAR T2 [x]	RAR T3 [x]	BCS T1 [x]	CBF List

CBF-1 Retail & Corporate Banking Services
DP	BIAQ T1	BIAQ T2	BIAQ T3	BCS T2	BCS T3	PD

More Information About Business Continuity Management Courses

To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].