BSP issues guidelines for operational resilience

MANILA, Philippines — The Bangko Sentral ng Pilipinas (BSP) has issued new guidelines for banks and financial institutions to further enhance their operational resilience against shocks or disruptions.

The BSP, in Circular 1203 signed by BSP Deputy Governor Bernadette Romulo-Puyat, said the guidelines on operational resilience aim to foster continuous delivery of financial services, which supports sustainable economic growth.

“The guidelines aim to promote and strengthen the BSP-supervised financial institutions (BSFls)’ ability to manage and mitigate the impact of disruptions, particularly on their critical operations,” it said.

Based on the circular, BSFIs should prepare their operational resilience framework on a solo and group-wide basis as applicable.

The group-wide framework should include the parent bank and all its material entities such as subsidiaries.

The BSP defines operational resilience as an outcome wherein a financial institution demonstrates that it can continue to perform its critical operations through significant disruption, reducing the impact on its customers and the financial system.

“Critical to achieving this is the recognition that disruptions will occur, necessitating forward-looking assessments, including emerging risks, as well as careful planning and preparation to respond accordingly, as part of the BSFI’s overall risk management,” it said.

The BSP said that BSFIs should utilize existing governance structures to establish and implement an effective operational resilience approach. The board of directors should be primarily responsible for the oversight and approval of the operational resilience framework.

Meanwhile, the senior management should ensure the implementation of the framework, assess the BSFI’s operational resilience capability and communicate the necessary remedial actions to the board of directors.

BSFIs should determine critical operations, tolerance for disruption and severe but plausible scenarios.

This approach helps prioritize key functions and establish capabilities to manage disruptions within acceptable limits, taking into account various adverse conditions.

Financial institutions must also set their tolerance for disruption and map out and test their plans to ensure that it can deliver critical operations through disruptions. BSFIs should plan and manage risks to operations, test its ability to deliver services under severe scenarios.

“Understanding the operations, interconnections and interdependencies allows BSFIs to identify and resolve vulnerabilities that exist in the delivery of critical operations,” it said.

In case a disruption occurs, BSFIs should respond and recover in line with its integrated operational resilience framework. It should maintain a catalogue that includes an inventory of incident response and recovery actions, roles and responsibilities of personnel.

The incident response plan should include the life cycle of the incident, classification of events or disruptions based on severity, recovery procedures and communication plan. It should also be reviewed and updated periodically.