[OR] [MB] [E4] [CBS] [10] [ITo] Establish Impact Tolerances

Establish Impact Tolerances

CBS-10 – Self-service Terminal

Introduction

Self-service terminals (SSTs) form a critical business service (CBS) within Maybank’s retail banking ecosystem.

These terminals — including ATMs, cash deposit machines (CDMs), and multifunction kiosks — are key enablers of customer convenience and accessibility.

They support day-to-day transactions such as withdrawals, deposits, inquiries, and account activations, and thus, are essential to maintaining trust and continuity in financial services delivery.

In line with operational resilience regulations, it is vital to set appropriate impact tolerances for these services. Impact tolerances define the maximum acceptable level of disruption before intolerable harm is caused to customers, financial stability, or regulatory compliance.

The tolerances consider multiple factors: downtime duration, potential data loss, customer reliance, reputational effects, and regulatory requirements.

The table below outlines the impact tolerances for each Sub-CBS of CBS-10: Self-service Terminals at Maybank.

Table: Impact Tolerance Summary for CBS-10

Sub-CBS Code	Sub-CBS	Maximum Tolerable Downtime (MTD)	Maximum Tolerable Data Loss (MTDL)	Customer Impact	Regulatory Impact	Impact Type	Current Resilience Status	Action Required
10-1	Authentication & Access	2 hours	< 15 mins	Customers are unable to authenticate, and there is widespread transaction failure	Potential breach of regulatory requirements for fair access	Service Disruption, Customer Trust	Robust but requires periodic stress testing	Enhance multi-factor fallback and biometric redundancy
10-2	Withdrawal (Card & Contactless)	4 hours	< 30 mins	Loss of cash access, financial hardship during peak hours	Possible scrutiny under customer service obligations	Financial Stability, Customer Confidence	Strong with high redundancy	Expand cash stock monitoring and ATM load balancing
10-3	Deposit & Inquiry	6 hours	< 30 mins	Inability to deposit funds or check balances, leading to inconvenience	Minor unless prolonged disruption	Service Availability	Adequate with some vulnerabilities	Introduce alternative deposit routing through digital channels
10-4	Activation & Setup (Cash-out)	8 hours	< 1 hour	Delayed new card activations or cash-out setup; medium impact	Limited regulatory consequence	Customer Experience	Moderate resilience	Implement automated rerouting to digital/mobile onboarding
10-5	Availability Management	1 hour	< 15 mins	Entire network outage affecting multiple SSTs simultaneously	High regulatory concern if systemic	Operational Continuity, Regulatory Compliance	Good but single points of failure exist	Improve real-time monitoring and rapid failover systems
10-6	Security & Resilience	Immediate (0 downtime tolerance)	0	Fraud risk, data compromise, reputational damage	Severe regulatory sanctions (e.g., BNM, MAS)	Security, Compliance	Strong, monitored 24/7	Continuous patching, AI-based anomaly detection, red-team testing
10-7	Customer Support & Recovery	12 hours	< 1 hour	Delayed issue resolution, reputational dissatisfaction	May breach customer care standards if recurring	Reputation, Service Quality	Adequate but reactive	Strengthen proactive notification and escalation process

[BCM] [Thin Banner] Summing Up

Establishing impact tolerances for CBS-10: Self-service Terminals ensures that Maybank can pre-emptively identify vulnerabilities, set boundaries for acceptable service disruption, and allocate resources toward resilience-building initiatives.

While areas such as security and authentication require near-zero tolerance for failure due to their direct regulatory and trust implications, other functions, such as deposit/inquiry or activation/setup, may withstand slightly more extended outages without systemic consequences.

Nonetheless, all tolerances remain anchored to customer needs, regulatory compliance, and operational resilience principles.

The outcomes of this assessment will inform targeted resilience enhancements, including real-time monitoring, stronger security controls, and diversified fallback mechanisms.

Ultimately, by setting precise impact tolerances, Maybank strengthens its ability to safeguard customer trust, uphold regulatory obligations, and maintain continuity in critical self-service banking functions.

Operational Resilience in Action: Case Studies and Best Practices for MayBank
eBook 4: Starting Your OR Implementation
CBS-10 Self-service Terminal
CBS-10 DP	CBS-10 MD	CBS-10 MPR	CBS-10 ITo	CBS-10 SuPS	CBS-10 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.