[OR] [MB] [E4] [CBS] [4] [ITo] Establish Impact Tolerances

Establish Impact Tolerances

CBS-4 – Payment and Settlement Systems

Introduction

The Payment and Settlement Systems form the backbone of Maybank’s financial infrastructure, facilitating seamless retail, corporate, interbank, and international transactions.

As part of our commitment to operational resilience and regulatory compliance, it is essential to define and regularly review the impact tolerances for this Critical Business Service (CBS-4).

This chapter outlines the maximum tolerable downtime (MTD), maximum tolerable data loss (MTDL), and the associated customer and regulatory impacts for each key process within the Payment and Settlement Systems.

These tolerances are vital for identifying service vulnerabilities, guiding investment in resilience capabilities, and ensuring that the Bank can continue to deliver critical services during severe but plausible disruptions.

The impact tolerances presented have been determined in alignment with regulatory expectations, industry best practices, and internal risk assessments.

Each process is evaluated concerning its criticality, impact type, current resilience status, and the corresponding actions required to strengthen operational readiness.

Here is a summary table for setting appropriate impact tolerances for CBS-4: Payment and Settlement Systems for Maybank.

This summary is structured to help business units communicate effectively with their Heads and the Operational Resilience Team.

Impact Tolerance Summary

No.	Process Description	MTD	MTDL	Customer Impact	Regulatory Impact	Impact Type	Current Resilience Status	Action Required
1	Retail Funds Transfer Processing	2 hrs	<15 mins	High–Retail customer disruption	High – Regulatory reporting	Operational / Reputational	Partially Resilient	Enhance failover mechanisms
2	Corporate & Bulk Payments	4 hrs	<30 mins	High Business client delay	High–compliance timelines	Financial / Operational	Resilient	Periodic stress testing
3	Real-Time Gross Settlement (RENTAS)	1 hr	<5 mins	Critical – Interbank settlement	Critical – BNM regulatory breach	Systemic / Financial	Partially Resilient	Improve RTGS redundancy
4	Cross-Border Payments (SWIFT)	2 hrs	<15 mins	High – International transaction	Medium – SWIFT compliance	Financial / Legal	Resilient	Continuous monitoring
5	Cheque Clearing	6 hrs	<1 hr	Medium – Delayed crediting	Low–batch processing buffer	Financial	Resilient	Maintain current controls
6	E-Wallet and Mobile Payment Integration	3 hrs	<30 mins	High – Consumer transaction halt	Medium – Third-party SLA impact	Operational / Reputational	Partially Resilient	Strengthen API interface resilience
7	JomPAY & Bill Payments	4 hrs	<30 mins	Medium – Payment delays	Medium – Billers' compliance risk	Customer Trust / Operational	Resilient	Review third-party dependencies
8	Merchant & Acquiring Payments	2 hrs	<15 mins	High–Merchant settlement issues	Medium – Acquirer obligations	Financial / Reputational	Partially Resilient	Expand acquiring network fallback
9	ATM & CDM Transactions Settlement	6 hrs	<1 hr	Medium – Cash flow disruption	Low – Offline transaction buffer	Operational	Resilient	Monitor hardware uptime
10	Fraud & Risk Monitoring in Payment Systems	1 hr	<5 mins	Critical – Undetected fraud	Critical – Compliance failure	Security / Regulatory	Needs Improvement	Implement real-time backup systems
11	Reconciliation & Daily Settlement	8 hrs	<1 hr	Low – Back-office impact	Medium – Reporting delay	Operational / Regulatory	Resilient	Maintain regular audits
12	Chargeback & Dispute Resolution	24 hrs	<4 hrs	Low–case resolution delay	Low – SLA buffer	Legal / Customer Service	Resilient	Improve case workflow automation
13	Payment System Resilience & Uptime	0 tolerance	0 tolerance	Critical – All systems are dependent	Critical – BNM/industry standards	Systemic / Regulatory	Partially Resilient	Achieve Tier IV data center standards

Key Notes:

MTD (Maximum Tolerable Downtime): Maximum duration before severe impact occurs.
MTDL (Maximum Tolerable Data Loss): Data loss limit before impact becomes unacceptable.
Impact Type reflects the nature of the consequence (e.g., Financial, Regulatory, Operational).
Current Resilience Status is based on internal assessments.
Action Required outlines priority steps to meet impact tolerance levels.

Summing Up ...

Establishing well-defined impact tolerances for the Payment and Settlement Systems enables Maybank to uphold service integrity, customer trust, and regulatory obligations during operational disruptions.

The analysis demonstrates a proactive approach to resilience planning, identifying areas that meet, exceed, or fall short of resilience expectations.

Several core processes, particularly those with systemic and regulatory significance, such as RENTAS and fraud monitoring, demand immediate attention and resource allocation to achieve target resilience levels.

Other components, while resilient under current conditions, require ongoing monitoring and stress testing to ensure continued alignment with evolving threats and regulatory standards.

Moving forward, the recommended actions and improvement areas will be prioritised and incorporated into the broader Operational Resilience Framework.

Close collaboration between business units, IT, compliance, and risk management teams will be essential to enhance the Bank's overall resilience posture and readiness to withstand future shocks.

Operational Resilience in Action: Case Studies and Best Practices for MayBank
eBook 4: Starting Your OR Implementation
CBS-4 Payment and Settlement Systems
CBS-4 DP	CBS-4 MD	CBS-4 MPR	CBS-4 ITo	CBS-4 SuPS	CBS-4 ST

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.

More Information About OR-5000 [OR-5] or OR-300 [OR-3]

To learn more about the course and schedule, click the buttons below for the [OR-3] OR-300 Operational Resilience Implementer course and the [OR-5] OR-5000 Operational Resilience Expert Implementer course.