[OR] [OCBC] [E3] [Report] [P2] [S4] [C12] Conducting Scenario Testing

Executive Summary

As part of OCBC Bank’s ongoing commitment to enhancing operational resilience, the current focus lies within the “Implement” phase of our Operational Resilience Planning Methodology.

Scenario Testing, which assesses the bank’s ability to deliver critical business services during severe but plausible disruptions, is a critical component of this phase.

This report outlines the objectives, implementation steps, examples, and outcomes of scenario testing, aligned with regulatory expectations and industry best practices.

Objectives of Scenario Testing

• Validate Resilience Capabilities: Ensure that identified resilience strategies can withstand stress scenarios.

• Demonstrate Impact Tolerance: Test whether critical business services remain within defined impact tolerances.

• Identify Gaps: Uncover vulnerabilities in existing processes, systems, and interdependencies.

• Enhance Crisis Preparedness: Improve team coordination and decision-making under pressure.

Implementation Steps

Step 1: Define Testing Objectives and Scope

• Select Critical Business Services (CBS) to be tested.

• Define testing goals, such as validating the ability to recover digital banking services within the defined tolerance of 2 hours.

Example:
OCBC selected “Real-Time Payment Services” and “Digital Banking Platform” for testing, focusing on a severe cyber-attack and cloud service outage, respectively.

Step 2: Design Severe but Plausible Scenarios

• Collaborate across business units, risk, IT, and crisis management teams to develop realistic disruption scenarios.

• Scenarios must challenge existing assumptions without being so extreme that they are impossible to manage.

Example Scenarios:

• Cyberattack Simulation: Malware infiltrates a core banking system, rendering Real-Time Payment Services inoperable for 4 hours.

• Cloud Disruption: The third-party cloud provider hosting the mobile banking platform suffered a regional outage, which affected customer logins and fund transfers.

Step 3: Prepare for the Test

• Identify key participants (service owners, IT, compliance, third-party vendors).

• Review business continuity and crisis management plans for readiness.

• Ensure the test environment, tools, and communication protocols are set.

Example:
Service owners for Digital Banking coordinated with the crisis communication team to draft public statements and prepare alternate access methods.

Step 4: Execute the Scenario Test

• Conduct tabletop or live simulation exercises based on the chosen scenarios.

• Monitor real-time responses, decision-making, and escalation paths.

• Capture detailed observations of resilience capabilities in action.

Example:
During the cyberattack simulation, OCBC’s real-time payment operations team initiated the fallback to the alternate site within 45 minutes, triggering customer notifications and activating fraud monitoring protocols.

Step 5: Document Outcomes and Evaluate Impact Tolerance

• Compare the observed recovery times against the defined impact tolerances.

• Document the performance of systems, teams, and third-party dependencies.

• Highlight areas where tolerances were breached or narrowly met.

Example:
The Digital Banking Platform scenario exceeded the defined tolerance by 30 minutes due to the delayed restoration of cloud access, indicating a need to enhance backup connectivity and vendor escalation processes.

Step 6: Conduct Post-Test Review and Recommend Improvements

• Facilitate a structured debriefing session.

• Identify lessons learned and corrective actions.

• Update Business Continuity Plans (BCP), resilience strategies, and playbooks.

Example Recommendations:

• Establish direct escalation channels with Tier-1 cloud providers.

• Enhance fraud risk management during system failovers.

• Introduce cross-training for critical staff in Digital Operations.

Reporting and Governance

• Findings and recommendations are submitted to the Operational Resilience Steering Committee and Senior Management.

• Material gaps are logged into the enterprise risk register.

• Progress of remediation activities is tracked via the Operational Resilience Program Dashboard.

Next Steps

• Schedule additional scenario tests covering Corporate Cash Management, Treasury, and Capital Markets in Q3.

• Perform cross-jurisdictional testing for Singapore, Malaysia, and China operations.

• Align outcomes with regulatory expectations from MAS and relevant global bodies (e.g., Basel Committee).

Summing Up ...

Scenario Testing is an integral component of OCBC’s operational resilience strategy. The recent testing cycle has demonstrated strong preparedness in core banking services, while also highlighting improvement opportunities in third-party dependency management and cross-functional coordination. Continued investments in scenario-based resilience testing will ensure OCBC remains robust, responsive, and aligned with its regulatory obligations and customer commitments.

Here is a professional Scenario Testing Table tailored for submission to MAS as part of OCBC Bank’s compliance with the Operational Resilience regulatory requirements. This format aligns with the MAS expectations under the ORM/OR framework for identifying severe but plausible scenarios and assessing whether firms remain within impact tolerances.

OCBC Bank – Scenario Testing Table (Regulatory Submission to Monetary Authority of Singapore )

Key Notes for Regulator 

• All scenarios were developed in alignment with MAS’s definition of “severe but plausible”.

• Each scenario tests the end-to-end delivery of a Critical Business Service, including people, processes, technology, data, and third parties.

• Impact tolerances were pre-defined and approved by the Operational Resilience Steering Committee.

• Outcomes and learnings are being integrated into OCBC’s resilience improvement program.

• Follow-up testing and remediation plans are tracked under the Operational Resilience Program Office with Board oversight.