The analysis identifies the rate at which impacts increase, the criticality of each Sub-CBF, and the point at which disruption becomes unacceptable to the organisation, customers, regulators, and the Maldivian financial system. Impact severity is measured on a 1–5 scale, where 1 represents minimal impact, and 5 represents severe or intolerable impact.
The outputs of this section support the determination of Recovery Time Objectives (RTOs), Maximum Tolerable Periods of Disruption (MTPDs), and Vulnerable Periods, forming a foundation for recovery strategy selection and continuity planning.
|
Sub-CBF Code |
Sub-CBF |
IT Systems and Applications |
RPO |
System RTO |
Supporting Special Equipment or Resources |
Remarks |
|
1.1 |
Customer Onboarding & Account Opening |
CRM/Onboarding Platform, KYC/AML System, Core Banking Customer Module |
4 hrs |
8 hrs |
Secure identity verification devices, biometric scanners |
High dependency on identity verification & compliance workflow |
|
1.2 |
Deposit & Withdrawal Services |
Core Banking System, ATM Switch, Teller System, Mobile Banking |
1 hr |
4 hrs |
ATM network hardware, POS terminals |
Critical for daily cash operations; peak usage risk |
|
1.3 |
Payment Processing & Fund Transfers |
EFT/ACH Processing System, SWIFT, RTGS, Payment Gateway |
30 min |
2 hrs |
Secure network connectivity, payment switches |
Real-time / batch settlement; compliance with cut-off times |
|
1.4 |
Lending & Credit Management |
Loan Origination System (LOS), Credit Scoring and Decisioning, Loan Servicing Module |
4 hrs |
12 hrs |
Underwriting support systems, credit bureau interfaces |
Regulatory and risk analytics dependency |
|
1.5 |
Card Services & Merchant Solutions |
Card Management System, POS Acquirer, Card Issuing Platform |
1 hr |
6 hrs |
POS devices, card personalisation hardware |
High availability is required for retail transactions |
|
1.6 |
Digital & Online Banking |
Internet Banking Portal, Mobile Banking App, API Gateway, MFA/Security Services |
15 min |
1 hr |
Web servers, application servers, and secure authentication devices |
24/7 customer access; high transaction volume |
|
1.7 |
Trade & Corporate Financial Solutions |
Trade Finance System, SWIFT for Corporates, Treasury Management |
2 hrs |
8 hrs |
Secure trade documentation scanners, treasury terminals |
Integration with external trade partners |
|
1.8 |
Account Maintenance & Reporting |
Core Banking Maintenance Module, Reporting/Analytics Tools, Regulatory Reporting System |
4 hrs |
8 hrs |
Data warehouse, BI/reporting servers |
Back-office function; compliance reporting |
The Impact Over Time analysis for CBF-1 Retail & Corporate Banking Services demonstrates that several Sub-CBFs—particularly deposit and withdrawal services, payment processing, card services, and digital banking—reach critical or intolerable impact levels within hours of disruption.
These functions are essential to financial stability, customer confidence, and regulatory compliance, and therefore require aggressive RTOs and highly resilient recovery strategies.
Other Sub-CBFs, such as customer onboarding, account maintenance, and lending administration, exhibit a more gradual impact escalation, allowing for comparatively longer recovery windows; however, prolonged disruption would still result in significant regulatory, reputational, and financial consequences.
This assessment satisfies ISO 22301 BIA requirements by clearly defining impact escalation, RTOs, MTPDs, and vulnerable periods, enabling Bank of Maldives to prioritise resources, design proportionate continuity strategies, and ensure the ongoing delivery of critical banking services during disruptive events.
In line with ISO 22301, the objective of this part is to establish clear visibility of technology dependencies, system recovery priorities, and data recovery requirements (RTO and RPO) for each Sub-CBF.
Understanding these dependencies is essential for effective business continuity planning, IT disaster recovery, and operational resilience, particularly given the bank’s nationwide branch network, reliance on digital channels, and the systemic importance of uninterrupted banking services in the Maldives.
|
Sub-CBF Code |
Sub-CBF |
IT Systems and Applications |
RPO |
System RTO |
Supporting Special Equipment / Resources |
Remarks |
|
1.1 |
Customer Onboarding & Account Opening |
Core Banking System (CBS), Customer Information File (CIF), KYC/AML Screening System, Document Management System |
≤ 15 minutes |
≤ 2 hours |
Branch workstations, document scanners, secure network connectivity |
Regulatory-driven process; data integrity and customer identity data are critical |
|
1.2 |
Deposit & Withdrawal Services |
Core Banking System (CBS), Teller System, Cash Management System |
≤ 15 minutes |
≤ 1 hour |
Cash counters, vaults, branch terminals, secure LAN/WAN |
High customer impact; essential for branch operations and public confidence |
|
1.3 |
Payment Processing & Fund Transfers |
CBS, Payment Switch, SWIFT, RTGS, ACH Interfaces, Reconciliation System |
≤ 5 minutes |
≤ 1 hour |
Secure payment gateways, HSMs, and network firewalls |
Time-sensitive and systemic; strong dependency on external clearing systems |
|
1.4 |
Lending & Credit Management |
Loan Origination System (LOS), CBS, Credit Scoring System, Collateral Management System |
≤ 30 minutes |
≤ 4 hours |
Credit officers’ workstations, document repositories |
Moderate tolerance; backlog is manageable in short-term disruptions |
|
1.5 |
Card Services & Merchant Solutions |
Card Management System, Card Switch, POS/ATM Network, Fraud Monitoring System |
≤ 5 minutes |
≤ 1 hour |
ATMs, POS terminals, card embossing equipment, and network connectivity |
High transaction volume; reputational and financial risk if unavailable |
|
1.6 |
Digital & Online Banking |
Internet Banking Platform, Mobile Banking App, API Gateway, Authentication Server |
≤ 5 minutes |
≤ 1 hour |
Data centre infrastructure, load balancers, mobile app platforms |
Customer-facing and availability-critical; key digital channel for BML |
|
1.7 |
Trade & Corporate Financial Solutions |
Trade Finance System, CBS, SWIFT, Document Management System |
≤ 30 minutes |
≤ 4 hours |
Secure document handling systems, corporate banking portals |
Contractual and regulatory obligations; lower transaction frequency |
|
1.8 |
Account Maintenance & Reporting |
CBS, Data Warehouse, MIS/Reporting Tools, Statement Generation System |
≤ 24 hours |
≤ 24 hours |
Batch processing servers, printers, and archival storage |
Non-real-time; suitable for deferred processing during disruptions |
The identification of supporting IT systems, applications, and special resources for CBF-1 Retail & Corporate Banking Services provides a foundational input to the Bank of Maldives’ Business Continuity Management System (BCMS).
By defining RTO and RPO targets for each Sub-CBF, the bank establishes clear recovery expectations that guide IT disaster recovery strategies, crisis response prioritisation, and investment decisions.
In accordance with ISO 22301, this mapping ensures that critical banking services can be restored within acceptable timeframes following disruptive incidents, while maintaining compliance, customer trust, and financial stability.
The outputs from this section should be reviewed regularly and integrated with IT DR plans, crisis management procedures, and testing programmes to sustain operational resilience across all retail and corporate banking operations.
Note that the icon marked with [x] is under construction
Ensuring Service Continuity and Compliance: ISO 22301 BCMS at Bank of Maldives |
||||||
| eBook 3: Starting Your BCM Implementation |
||||||
| MBCO | P&S [x] | RAR T1 [x] | RAR T2 [x] | RAR T3 [x] | BCS T1 [x] | CBF List |
| CBF-1 Retail & Corporate Banking Services |
||||||
| DP | BIAQ T1 | BIAQ T2 | BIAQ T3 | BCS T2 | BCS T3 | PD |
To learn more about the course and schedule, click the buttons below for the BCM-300 Business Continuity Management Implementer [BCM-3] and the BCM-5000 Business Continuity Management Expert Implementer [BCM-5].
|
Please feel free to send us a note if you have any questions. |
||