THE BANGKO SENTRAL ng Pilipinas (BSP) has issued operational resilience guidelines for its supervised financial institutions (BSFIs) to strengthen their ability to manage and mitigate the impact of potential disruptions to ensure the continuous delivery of services.
BSP Circular No. 1204 Series of 2024 dated Oct. 28 will amend sections of the Manuals of Regulations for Banks and Non-Bank Financial Institutions to include the new rules alongside existing guidelines on operational risk management.
“This aims to strengthen BSFIs’ ability to manage and mitigate the impact of disruptions on their critical operations, given frequent natural disasters and fast-paced advancements in technology,” the central bank said in a statement on Wednesday.
“The new guidelines are crucial given the increasing threats to business operations. They complement our previous efforts to strengthen the financial resilience of supervised institutions,” BSP Governor Eli M. Remolona, Jr. said. “Operational resilience ensures the overall safety and soundness of both individual institutions and the entire financial system.”
The guidelines will help ensure that financial services will remain accessible “despite prolonged business interruptions, such as those experienced during the COVID-19 pandemic,” the BSP said.
This will support the smooth functioning of the real economy, the BSP said in the circular.
The BSP said operational disruptions include man-made causes like cyberattacks or fraud, as well as natural causes like weather disturbances.
Under the guidelines, BSFIs are required to integrate operational resilience in their governance structures and risk management processes.
“In establishing an operational resilience framework, BSFIs must identify critical operations, which, if disrupted, would cause material harm to their customers, their business, and/or the financial system,” the BSP said.
“They must also set tolerance levels for disruption or how much disruption they can handle while still delivering critical operations. BSFIs must ensure that they remain within their established limits.”
The BSP said BSFIs must determine the range of severe but plausible scenarios of varying nature, seriousness, and duration relevant to their business and risk profile.
“These are essential in prioritizing critical operations and determining capabilities to withstand and absorb disruption within the tolerance level acceptable to the BSFI, considering the range of adverse scenarios identified,” it said.
Financial institutions should also map out interconnections and interdependencies within their operations to identify and resolve potential vulnerabilities in the delivery of services, especially those involving service providers.
“This will enable the BSFIs to holistically assess the sources of vulnerabilities and invest in appropriate resilience measures before disruption occurs so that BSFIs can remain within their tolerance for disruption,” the central bank said.
BSFIs should also plan and manage risks to critical operations and test their ability to deliver these services and to respond and recover from disruption, it added.
“This should include, among others, clear delineation of the roles and responsibilities and succession of authority in the event of disruption; and an incident response plan that contains key steps to handle the disruption and assess how it will affect the BSFI’s risk appetite and tolerance for disruption,” it said.
“As part of its incident response plan and to strengthen its response capabilities, the BSFI should maintain a catalogue that includes an inventory of incident response and recovery actions, roles and responsibilities of key officers/personnel as well as internal and external resources,” it added.
The new guidelines will be implemented in phases, the BSP said, to “ensure smooth transition and implementation.”
BSFIs must submit an accomplished self-assessment questionnaire within one year from the circular’s effectivity to help them identify areas for improvement and prepare action plans for their operational resilience frameworks, it added.
“Operational resilience is an end state or outcome wherein the BSFI demonstrates that it can continue to render its critical operations through significant disruption. reducing the impact on its customers and the financial system. This contributes to reinforcing the BSFI’s viability amidst significant disruptions. promoting the financial system’s resilience and stability and servicing the real economy,” the BSP said.
“Critical to achieving this is the recognition that disruptions will occur, necessitating forward looking assessments, including emerging risks, as well as careful planning and preparation to respond accordingly, as part of the BSFI’s overall risk management.” — L.M.J.C. Jocson