[OR] [BSP] Reporting, Notification, and Supervisory Requirements for BSFIs

Reporting, Notification, and Supervisory Requirements

The Bangko Sentral ng Pilipinas (BSP) has outlined specific reporting, notification, and supervisory expectations to ensure BSP-supervised financial institutions (BSFIs) effectively manage and communicate their operational resilience efforts.

These requirements emphasise transparency, timely reporting, and robust oversight to maintain resilience throughout the financial sector.

Reporting and Notification Requirements

BSFIs are required to disclose their operational resilience approach in their Annual Reports. This disclosure must include:

• An overview of the operational resilience strategy,
• Identification of critical operations and
• Key details about the components of operational resilience.
  

In the event of a disruption where the incident response plan for critical operations is triggered, BSFIs must notify the BSP within 24 hours. The notification should include:

• The nature, duration, and root cause of the disruption,
• The critical operations affected and the impact on their delivery,
• Whether the tolerance for disruption was breached and
• The management actions taken or planned to ensure continuity of essential operations.

The BSP reserves the right to request additional information as needed.

Supervisory Review by the BSP

The BSP will assess the operational resilience framework of each BSFI during the supervisory process. This review will focus on:

• The robustness of the framework,
• The credibility of the BSFI’s ability to deliver critical operations through disruptions and
• Whether the BSFI can operate within its defined tolerance for disruption.
  
  

Transitory Provisions

The implementation of the operational resilience framework will follow a phased approach to allow BSFIs to align with the new requirements:

Phase 1 – One Year Post-Circular Effectivity

All BSFIs must submit a transition plan to the appropriate BSP supervising department.

This plan should include a self-assessment using the Self-Assessment Questionnaire, outlining a gap analysis and action plans for achieving operational resilience.

Phase 2 – Two Years Post-Circular Effectivity

Universal, commercial, and digital banks must implement their operational resilience plan following their established operational resilience framework and integrate this framework into their risk management systems.

These banks will also begin disclosing critical elements of operational resilience in their Annual Reports. The framework must be submitted to the BSP for review.

Phase 3 – Three Years Post-Circular Effectivity

Thrift and rural banks must develop and integrate their operational resilience frameworks with existing risk management systems.

Like universal and commercial banks, they must submit their frameworks to the BSP and start disclosing operational resilience elements in their Annual Reports.

Summing Up...

These guidelines emphasise the importance of timely reporting, supervisory oversight, and phased implementation to ensure that all BSFIs, regardless of size, are prepared to maintain operational resilience.

By adhering to these structured requirements, BSFIs can better safeguard their critical operations and contribute to the overall stability of the financial system.

More Information About Blended Learning OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the OR-3 Blended Learning OR-300 Operational Resilience Implementer course and the OR-5 Blended Learning OR-5000 Operational Resilience Expert Implementer course.