The central bank has issued the guidelines on business continuity management (BCM) that requires supervised financial institutions, particularly banks to make it an integral part of their operations so that they can withstand the impact of major disruptions.
In a circular, the Bangko Sentral ng Pilipinas (BSP) said the rationale for the new rules is for supervised financial institutions or BSFIs adversely affected by disruption of critical operations due to internal and external threats, which may be natural, man-made or technical in origin may still continue to operate and service its clients.
It said extreme events may cause major disruptions whose impact are very broad in scope, duration or both and can pose a substantial risk to the continued operation of BSFls.
“Because BSFIs play a crucial role in the financial system and economy as a whole, it is important to ensure that their operations can withstand the effects of major disruptions,” the central bank noted.
With these scenarios, the BSP said BSFIs need to have a comprehensive BCM process as an integral part of their operational risk management system.
In particular, BSFIs should adopt a cyclical, process-oriented BCM framework that includes at least five phases: business impact analysis (BIA) and risk assessment, strategy formulation, plan development, plan testing and personnel training and plan maintenance.
This framework represents a continuous cycle that should evolve over time based on changes in business and operating environment, audit recommendations and test results, the central bank said.
This framework should cover each business function and the technology that supports it. Other related policies, standards and processes should also be integrated with the overall BCM framework, it added.
A well-designed BCM process enables BSFIs to resume critical operations swiftly and minimize operational, financial, legal, reputational and other material risks arising from a disruption, according to the BSP. This also helps mitigate systemic risks as well as maintain public trust and confidence in the financial system.
“The guidelines aim to promote sound management of business continuity risks. These align existing regulations, to the extent possible, with leading standards and recognized principles on BCM, and shall serve as the Bangko Sentral’s baseline requirement for all BSFls,” it said.
The guidelines apply to banks, non-banks with quasi-banking function, non-bank electronic money issuers and other non-bank institutions that are subject to Bangko Sentral supervision and regulation under existing rules, regulations and special laws.
“Moreover, subject guidelines shall also apply to BSFIs with offshore data processing as may be appropriate to their situation,” the central bank said.
BSFIs must comply with the latest standards on BCM within one year after the new guidelines takes effect.
Starting July 2017, upon request of the Bangko Sentral, a BSFI must be able to show its plan of action with specific timelines, as well as the status of initiatives being undertaken.
“This circular shall take effect fifteen days following its publication either in the Official Gazette or in a newspaper of general circulation in the Philippines,” it added.