[OR] [OCBC] [E3] [Report] [P2] [S3] [C11] Setting Impact Tolerance

Executive Summary

This report outlines the progress and approach adopted for establishing impact tolerance for OCBC Bank’s critical business services, a key step within the “Implement” phase of our Operational Resilience Planning Methodology.

Establishing clear and measurable impact tolerance thresholds enables us to understand and manage our risk exposure during severe disruptions. It reinforces our commitment to regulatory expectations under the MAS Guidelines on Operational Resilience and global best practices such as those by the Basel Committee and the UK’s PRA.

Purpose of Impact Tolerance

Impact tolerance refers to the maximum acceptable level of disruption to a critical business service before intolerable harm occurs to:

• Customers

• Market integrity

• The financial system

• The Bank’s safety and soundness

It forms the foundation for designing effective resilience strategies and ensures alignment with OCBC Bank's risk appetite and strategic priorities.

Implementation Steps and Examples

Step 1: Identify Critical Business Services

OCBC has already completed the identification of its critical business services (CBS), including but not limited to:

• Real-Time Payment Services (FAST, PayNow)

• Digital and Mobile Banking Platforms

• Corporate Cash Management Services

• ATM and Branch Cash Services

• Credit Card and Merchant Acquiring Services

• Treasury and Capital Markets Operations

Step 2: Determine Dimensions of Harm

For each CBS, we evaluated potential harms along multiple dimensions:

• Customer Harm (e.g., inability to access funds)

• Market Harm (e.g., delayed market settlements)

• Financial Harm (e.g., revenue or capital impact)

• Regulatory and Reputational Harm (e.g., breaches of regulatory obligations)

Example:
For Real-Time Payment Services (PayNow/FAST), a disruption beyond 2 hours could prevent SMEs from making critical supplier payments, leading to customer attrition and potential regulatory intervention.

Step 3: Define Metrics for Impact Tolerance

We defined clear metrics to quantify tolerances, such as:

• Maximum Acceptable Downtime (MAD)

• Transaction Volume Thresholds

• Monetary Exposure Limits

• Customer Impact Thresholds

Example:
Digital Banking Platform

• MAD: 3 hours

• Max Unsuccessful Transactions: 50,000

• Max Customer Calls to Contact Centre: 20,000

These thresholds were developed with business unit heads, technology risk managers, compliance, and customer experience teams.

Step 4: Scenario Testing and Justification

We conducted desktop scenario analysis and workshops to simulate disruptions (e.g., cyberattack on core banking systems, telco outage). These exercises validated the proposed thresholds and helped us understand plausible, severe, but plausible scenarios.

Example:
Scenario: DDoS attack on Internet Banking during the salary disbursement week.
Impact: Estimated 80,000 customers affected if the disruption exceeds 2 hours.
Result: Justified the setting of a 2-hour impact tolerance for Digital Banking.

Step 5: Documentation and Governance Approval

Each impact tolerance was documented with:

• The rationale behind the threshold

• Assumptions made

• Data sources used

• Responsible stakeholders

These documents were submitted to the Operational Resilience Steering Committee for review and subsequently approved by the Board's Risk Management Committee.

Key Deliverables

Next Steps

• Integrate impact tolerances into resilience testing scenarios

• Design response and recovery strategies based on these thresholds

• Embed thresholds into monitoring tools and dashboards

• Conduct Board-level scenario testing and review annually

Summing Up ...

By establishing and formalising impact tolerances, OCBC Bank is taking a proactive and structured approach toward enhancing its operational resilience. This enables better prioritisation of resilience investments, supports regulatory compliance, and ultimately protects our customers and the wider financial ecosystem.

Table: Summary of Impact Tolerance Establishment – Implement Phase (Operational Resilience)

Table: Example of Impact Tolerance Thresholds for OCBC Critical Business Services