Business Continuity Plan (BCP)
Dated: 30/11/2018
Table of Contents
1 Introduction 3
2 Emergency Contact Persons 3
3 Bank Policy 3
4 Mission Critical System 4
5 Alternative Communications Between the bank and Customers, and Regulators 5
6 Conclusion
7 Board of Directors’ Approval 7
8 Appendix A 7
9 Appendix B 8
9 Appendix C 8
10 Appendix D 10
Introduction
This manual documents the business continuity plan for Adeyemi College Staff Microfinance Bank Limited (ACSMB). The purpose of this manual is to document the plans for the recovery of our Critical Business Functions and Systems in the event of a business disruption.
I. Emergency Contact Persons
ACSMB provides in its website and all necessary documents with the contact information for two emergency contact persons to fulfill this requirement for all branch office locations. These two emergency contact persons must be Senior Management Staff of the Bank. ACSMB stays in compliance by updating this information upon any material change and reviewing the information quarterly to ensure it is up to date.
II. Bank Policy
Our Bank’s policy is to respond to a Significant Business Disruption (SBD) by safeguarding employees’ lives and our property, making a financial and operational assessment, quickly recovering and resuming operations, protecting all of our Bank’s books and records, and allowing our customers to transact business. In the event that we determine we are unable to continue our business at the Bank premise, we will direct our customers to the following:
Website: acsmfb.com and our Settlement Bank: Stanbic IBTC Bank .
A. Significant Business Disruptions (SBDs)
Our plan anticipates two kinds of SBDs, internal and external. Internal SBDs affect only our
Bank’s ability to communicate and do business, such as a communications failure or a fire in our building. External SBDs prevent the operation of the Bank such as a terrorist attack or a wide-scale, regional disruption. Our response to an external SBD relies more heavily on other organizations and systems, especially on the capabilities of BankOne Core Banking solution.
B. Approval and Execution Authority
ACSMB Board of Directors is responsible for approving the plan and for reviewing it annually and with employees of the Bank.The Managing Director has the authority to execute this BCP and notify THE BOARD OF DIRECTORS upon execution.
C. Plan Location and Access
ACSMFB will maintain copies of its BCP plan and the annual reviews, and the changes that have been made to it for inspection. An electronic copy of our plan is also located in Google drive as well as our Website.
D. Alternative Physical Location(s) of Employees
In the event of an SBD, we will move our staff to an alternative location to be determined by the Board.
E. Customers’ Access to Funds
Bankone maintains custody of customers’ data on our behalf. In the event of an internal or external SBD, our customer will be able to carry out their transaction through our settlement bank.
F. Data Back-Up and Recovery (Hard Copy and Electronic)
In the event of an internal or external SBD that causes the loss of our paper records, we will physically recover them from our backup or electronic copies. If our primary site is inoperable, we will continue operations from our back-up site or an alternate location. For the loss of electronic records, we will either physically recover the storage media or electronically recover data from our back-up site, or, if our primary site is inoperable, continue operations from our back-up site or an alternate location
G. Financial and Operational Assessments
A. Operational Risk
In the event of an SBD, we will immediately identify what means will permit us to communicate with our customers, employees, critical business constituents, critical banks, critical counter-parties and regulators. In addition, we will retrieve our key activity records as described in the section above, Data Back-Up and Recovery (Hard Copy and Electronic). If needed, we will direct customers directly to the following:
The Bank’s WEBSITE for questions and status is acsmfb.com and for emergency assistance and to access to client funds.
B. Financial and Credit Risk
In the event of an SBD, we will determine the value and liquidity of our investments and other assets to evaluate our ability to continue to fund our operations and remain in capital compliance. We will contact Central Bank of Nigeria, Nigeria Deposit Insurance Corporation and Shareholders to apprise them of our financial status. If we determine that we may be unable to meet our obligations to those counter-parties or otherwise continue to fund our operations, we will request additional financing from our bank or other credit sources to fulfill our obligations to our customers and clients. If we cannot remedy a capital deficiency, we will file appropriate notices with our regulators and immediately take the appropriate steps.
III. Mission Critical Systems
We have primary responsibility for establishing and maintaining our business relationships with our customers and have sole responsibility for our mission critical functions of order taking, entry and execution. BankOne Core Banking Software and Stanbic IBTC Bank provides the execution, comparison, allocation, clearance and settlement of banking transactions, maintenance of customer accounts, access to customer accounts and the delivery of funds.
A. Our Brank’s Mission Critical Systems
1. Order Taking
Currently, we receive orders and instructions from customers via telephone or in-person. We also receive client paperwork via e-mail, in person or through a secure website portal. During an SBD, either internal or external, we will continue to take orders through any of these methods that are available and reliable, and in addition, as communications permit, we will inform our customers when communications become available to tell them what alternatives they have to send their orders to us. If customers are unable to reach the branch to place trades they can contact us through our website and our Settlement Bank- Stanbic IBTC.
2. Entry Processes
Currently, we enter customers’ instructions electronically and process it through BankOne Core Banking Software which is web-based Banking Software; therefore, we can expect service restoration within 4 Hours.
In the event of an internal SBD, we will contact Appzone our service provider to resolve the problem. This we will do through the fastest alternative means available, which include telephone or e-mail. In the event of an external SBD, we will maintain the order in electronic or paper format, and process the orders when it resumes operations. In addition, during an internal SBD, we may need to refer our customers to deal directly with our settlement Bank..
3. Mission Critical Systems Provided by Bankone
Our Bank relies on BankOne Core Banking Software to provide order execution, order comparison, order allocation, customer account maintenance and/or access and delivery of funds
The Software backs up certain client records at a remote site using Cloud Technology. Therefore Appzone our corebanking software provider serve as primary locations for mission-critical processing, including: Operations, Execution and Processing, and the Service Center. We have a server and external hard disks for backup of our Data. There are documented and tested plans in place to provide for a fail-over between the two sources.
IV. Alternate Communications Between the Bank and Customers, Employees, and Regulators
A. Customers
We now communicate with our customers using the telephone, SMS, e-mail, our website, and in-person visits at our office or another location. In the event of an SBD, we will assess which means of communication are still available to us, and use the means closest in speed and form (written or oral) to the means that we have used in the past to communicate with the other party. For example, if we have communicated with a party by e-mail but the Internet is unavailable, we will call them on the telephone and follow up where a record is needed with paper copy.
B. Employees (See Appendix A)
We now communicate with our employees using telephone, SMS, WhatSapp Group, e-mail, and in person. In the event of an SBD, we will assess which means of communication are still available to us, and use the means closest in speed and form (written or oral) to the means that we have used in the past to communicate with the other party. We will also employ a call tree so that senior management can reach all employees quickly during an SBD. The call tree includes all staff home and office phone numbers. We have identified persons, noted below, who live near each other and may reach each other in person.
C. Regulators
We communicate with our regulators using telephone, e-mail, and in person.. In the event of an SBD, we will assess which means of communication are still available to us, and use the means closest in speed and form (written or oral) to the means that we have used in the past to communicate with the other party.
V. Critical Business Constituents, Banks, and Counter-Parties (See Appendix B)
A. Business constituents
Critical business constituents are businesses with which we have an ongoing commercial relationship in support of our operating activities such as vendors providing critical services.
Appzone provides most of our critical services. We will quickly establish alternative arrangements if a business constituent can no longer provide the needed goods or services when we need them because of a SBD to them or our firm.
Our other critical business constituents are:
A. Banks
We have contacted our Settlement and Correspondence Banks to determine if they can continue to provide the banking services that we will need in light of the internal or external SBD.
B. Counter-Parties
Appzone and Stanbic IBTC Bank maintain the relationships with our critical counter-parties on our behalf. Where the transactions cannot be completed, we will work with them or contact those counterparties directly to make alternative arrangements to complete those transactions as soon as possible.
D. Regulatory Reporting
We are subject to regulation by the Central Bank of Nigeria, Nigeria Deposit Insurance Corporation and Corporate Affairs Commission. We now file reports with our regulators electronically using, e-mail and the Internet. In the event of an SBD, we will check with the CBN, NDIC and other regulators to determine which means of filing are still available to us, and use the means closest in speed and form (written or oral) to our previous filing method. In the event that we cannot contact our regulators, we will continue to file required reports using the communication means available to us.
E. Disclosure of Business Continuity Plan
The Bank has a BCP disclosure statement that is provided to our customers at account opening and attached to this document as “Appendix C”. The BCP Disclosure statements is also posted to www.acsmfb.com and mailed to customers upon request.
F. Updates and Annual Review (See Appendix D)
We will update this plan whenever we have a material change to our operations, structure, business. In addition, our firm will review this BCP annually to modify it for any changes in our operations, structure, business or location.
V1. Conclusion
Please be aware that, while we have detailed plans in place, we cannot guarantee that we will be successful in achieving recovery in the times noted above. For example, we may not be able to implement a plan during a disaster as quickly as we expect, or there may be disasters that we have been unable to anticipate and for which we have no plan. Additionally, if parts of our plan are dependent upon third parties, we will have no control over the success or failure of the third party to respond appropriately to the challenges posed at the time of the disaster. Our continuity plans will be periodically updated and modified. Updated plan summaries will be made available on our website (www.acsmfb.com) and can be obtained by submitting a written request.
V11. Board of Directors’ Approval
I have approved this Business Continuity Plan as reasonably designed to enable our Bank meet its obligations to customers in the event of an SBD.
Signed: _______________________________
Title: _______________________________
Date: _______________________________
Appendix A
Employee Roster
S/N ADDRESS CELL PHONE 1 CELL PHONE 2
PERSONAL EMAIL
Appendix B
Critical Business Constituents
S/N ITEM VENDOR ADDRESS OFFICE PHONE PERSONAL CELL PHONE EMAIL
1 Core Banking Software Appzone Ltd
2 Internet GLO and DG Links
3 Electrical
4 Office Equipment
5 Stationery Printer
6 Plumber
7 Settlement Bank
Appendix C
Business Continuation Plan Summary
Adeyem College Staff Microfinance Bank (ACSMB) is a unit Microfinace bank committed to providing timely service to our clients. We recognize the importance of preparing for various disaster scenarios that could hamper our ability to provide service. We have taken aggressive steps to provide for business contingency and continuity planning under a variety of potential scenarios. We continue to evaluate our continuity plans and take the necessary actions to ensure the proper resources are available to provide for the recovery and timely resumption of critical business operations to internal business units, third-party business partners, and customers
ACSMB Financial Business Continuation Strategy
Mission-Critical Departments
Appzone – the provider of our core banking software serve as our primary locations for our mission-critical outfit being the custodian of our Server Center. Our server and external Disk serves the backup for the Bank. There are documented and tested plans in place to provide for a fail-over between the two sites.
ACSMB Data Center is located outside Nigeria through Cloud technology. The alternate Data Center is the daily Backup in the custody of the bank.
Business Scenario Preparedness
Single Building Disruption
If ACSMB loses the ability to perform business in our buildings, recovery staff associated with mission-critical functions will begin processing at our alternate processing site (to be determined depending on the impacted department). We have plans in place for this relocation, and these plans are tested periodically. Recovery time objectives vary based on the criticality of the function that is disrupted.
Campus Disruption
If ACSMB loses the ability to perform business staff associated with non-mission-critical functions will be relocated to an alternative site (e.g., hotel, home) in an unaffected area. We have plans in place for this relocation and they are tested periodically. Recovery time objectives vary based on the criticality of each function.
Remote Data Center Disruption
If ACSMB loses the ability to perform business downtime from our Data Center-Appzone we will continue skeletal operations using manual process and the backup data pending when the mission-critical systems will be recovered. We have plans in place for this recovery and they will be tested periodically. Mission-critical systems recovery is expected within four hours.
Pandemic Event
ACSMB has plans in place to continue business during a pandemic event. Our plan will be multi-tiered action plan based on the Federal Ministry of Health alert phases with triggering events for each phase. As the threat of a pandemic becomes greater and a new phase is triggered, we will assess our plans and determine the appropriate course of action.
Access to Your Funds
A site outage should not impact our customers’ ability access to their available funds, as ACSMB business contingency plans are designed to ensure sustained service through our settlement bank (Stanbic IBTC Bank)
Appendix D
Annual Notice of Review
Date Name of Reviewer Signature
__________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________
__________________________________________________________________________