[OR] [P1-S5] [R] Regulatory Reporting Requirements Expected by Central Banks

Key Governance Requirements and Expectations

Introduction

As operational resilience becomes a strategic priority for financial institutions, central banks and regulators have formalised expectations through regulatory frameworks and reporting mandates.

In alignment with the Basel Committee on Banking Supervision’s (BCBS) Principles for Operational Resilience (2021), banks are now required to demonstrate their ability to deliver critical business services (CBS) consistently, even during severe disruptions.

To achieve this, banks must adopt a structured approach to resilience, involving identification of critical services, setting of impact tolerances, conducting scenario-based stress testing, and implementing robust governance and risk mitigation mechanisms.

Regulators are not only seeking assurance of compliance but also evidence of ongoing readiness, oversight, and adaptation to evolving threats.

Purpose of Chapter

This chapter outlines the specific regulatory reporting requirements expected by central banks under the Basel Operational Resilience Framework.

It explains the meaning and scope of key submissions, including the operational resilience report, scenario testing outcomes, risk mitigation plans, the resilience framework, and the CBS list, providing clarity on what regulators expect and how banks should prepare.

When the central bank requires a bank to report on its operational resilience, the regulatory expectations typically draw from the guidance of the Basel Committee on Banking Supervision (BCBS), as well as jurisdiction-specific supervisory guidelines (e.g., from the Monetary Authority of Singapore, Bank Negara Malaysia, Prudential Regulation Authority, or Australian Prudential Regulation Authority).

1. Regulatory Reporting Requirement for BASEL Operational Resilience

Under the BASEL Principles for Operational Resilience (2021), banks are expected to:

• Identify and map their critical operations.

• Assess resilience through severe but plausible scenarios.

• Implement mitigation measures.

• Monitor, test, and adapt resilience strategies.

• Ensure board and senior management oversight.

The regulatory reporting requirement typically entails submitting formal documentation and evidence demonstrating how the above has been implemented, especially about:

• Governance (roles, responsibilities, oversight).

• Impact tolerance thresholds.

• Scenario testing results.

• Third-party dependencies.

• Response and recovery capabilities.

Central banks use this information to assess whether the bank can continue delivering critical business services (CBS) during disruption.

2. Understanding Regulatory Report Requirement

This typically requires the bank to submit three key types of documents:

a. Operational Resilience Report

This is a consolidated document demonstrating the bank's current state of resilience, including:

• Critical business services identified.

• Mapping of supporting processes, people, technology, and third parties.

• Set impact tolerances for each CBS.

• Overview of risk assessment and controls in place.

• Governance and ownership of resilience.

b. Resilience Framework

This is the bank’s internal framework or policy document,  which outlines:

• Definition and scope of operational resilience in the bank.

• Alignment with BASEL principles and local regulations.

• Governance structure, escalation protocols, and board oversight.

• Processes for identifying CBS, setting impact tolerances, testing scenarios, and executing response and recovery.

c. Critical Business Services List

This is a formally defined list of services considered critical to customers, markets, or the economy. It should include:

• Name and description of each CBS.

• Justification of why it’s critical (based on impact analysis).

• Supporting systems, processes, teams, and third parties.

• Associated impact tolerance thresholds (e.g., time, capacity).

d. Scenario Results

This includes:

• Description of severe but plausible scenarios used in testing.

• Outcome of the test: whether CBSs remained within impact tolerances.

• Lessons learned and vulnerabilities exposed during the scenario testing.

e. Risk Mitigation Plans

• Action plans to address gaps identified from scenario testing or resilience assessments.

• Timeline, responsible parties, and budget for each mitigation activity.

• Integration with risk management and internal audit follow-up.

Summary Table

Summing Up ...

Operational resilience reporting is more than a compliance exercise—it is a reflection of an institution’s preparedness to withstand disruption while continuing to serve its customers and support financial stability.

By clearly articulating and documenting their resilience posture through structured reports and tested scenarios, banks demonstrate accountability, transparency, and commitment to continuous improvement.

The requirement to submit operational resilience reports, scenario results, risk mitigation plans, and the resilience framework—including the list of critical business services—serves as a critical touchpoint between banks and regulators.

It enables supervisors to assess institutional vulnerabilities and readiness, ensuring that the financial sector remains robust in the face of emerging threats.

As such, banks must embed these reporting processes into their operational resilience lifecycle, underpinned by strong governance, executive oversight, and a culture of proactive risk management.

More Information About Blended Learning OR-5000 [BL-OR-5] or OR-300 [BL-OR-3]