Print-optimized — use the browser’s print-to-PDF for the distributable pack.
Operational Resilience Board Pack
Meridian Commercial Bank · prepared Jul 1, 2026 · 2026 cycle in progress
1 · Program summary
8
Tier 1 services
86%
Deep-dive completeness
4
Material points of failure
5
Open vulnerabilities
4
Simulation runs on file
The resilience programme covers 21 active services, of which 8 are Tier 1 (critical) and in scope for the full deep dive: impact tolerances, end-to-end dependency mapping, material-point-of-failure analysis, and stochastic scenario testing. Every authoritative record has passed first-line authorship, independent second-line challenge, and executive approval.
2 · Service tiers
| Service | Owning team | Tier | Last assessed |
|---|---|---|---|
| Merchant Referral Services | Treasury Services Operations | Unassessed | — |
| ACH Origination & Receipt | ACH Operations | Tier 1 | 2026 |
| Branch & ATM Cash Access | Branch Operations Support | Tier 1 | 2026 |
| Commercial Cash Management Portal | Treasury Services Operations | Tier 1 | 2026 |
| Debit Card Authorization | Card Services Operations | Tier 1 | 2026 |
| Domestic Wire Payments | Wire Operations | Tier 1 | 2026 |
| End-of-Day Core Processing | Application Support | Tier 1 | 2026 |
| Mortgage Servicing Payments Processing | Loan Servicing Operations | Tier 1 | 2026 |
| Online & Mobile Banking | Digital Channels | Tier 1 | 2026 |
| Commercial Loan Drawdowns | Loan Servicing Operations | Tier 2 | 2026 |
| Consumer Loan Origination | Loan Servicing Operations | Tier 2 | 2026 |
| Contact Center Servicing | Contact Center | Tier 2 | 2026 |
| Customer Onboarding & KYC | Branch Operations Support | Tier 2 | 2026 |
| Fraud Detection & Interdiction | Fraud Operations | Tier 2 | 2026 |
| Real-Time Payments (RTP) Receipt | ACH Operations | Tier 2 | 2025 |
| Statement Generation & Delivery | Application Support | Tier 2 | 2026 |
| Treasury & Liquidity Management | Treasury Services Operations | Tier 2 | 2026 |
| Wealth Advisory & Trust Services | Contact Center | Tier 2 | 2025 |
| Cheque Clearing & Return Processing | Reconciliation & Control | Tier 3 | 2026 |
| Safe Deposit Box Access | Branch Operations Support | Tier 3 | 2026 |
| Trade Finance Issuance | Treasury Services Operations | Tier 3 | 2026 |
3 · Tolerance breach probability — latest simulation results
| Service | Critical payment processor | Multi-vector: cyber attack | Primary data center | Ransomware attack on |
|---|---|---|---|---|
| ACH Origination & Receipt | 54% | 0% | 83% | 87% |
| Branch & ATM Cash Access | — | 0% | 0% | 41% |
| Commercial Cash Management Portal | 0% | 0% | 0% | 38% |
| Debit Card Authorization | — | 100% | 100% | 100% |
| Domestic Wire Payments | 97% | 0% | 99% | 99% |
| End-of-Day Core Processing | — | 0% | 0% | 74% |
| Mortgage Servicing Payments Processing | — | 0% | 95% | 0% |
| Online & Mobile Banking | — | 81% | 99% | 97% |
Latest Monte Carlo run per scenario (standard day). Red >40% breach probability · amber >15% · green within tolerance. “—” = service outside the scenario’s scope.
4 · Material points of failure
PayHub Wire Gateway — critical to “Payment Routing” (Domestic Wire Payments); no workaround, no substitute.
SwiftLine Payment Networks — critical to “Payment Routing” (Domestic Wire Payments); no workaround, no substitute.
Cardinal Card Network — critical to “Authorization Switching” (Debit Card Authorization); no workaround, no substitute.
End-of-Day Batch Orchestrator — critical to “Batch Scheduling & Orchestration” (End-of-Day Core Processing); no workaround, no substitute.
5 · Remediation status
| Vulnerability | Service | Severity | Status | Target |
|---|---|---|---|---|
| Contact-center overflow capacity untested at digital-outage scale | Online & Mobile Banking | MEDIUM | in progress | Sep 30, 2026 |
| Single wire gateway with no substitute path | Domestic Wire Payments | CRITICAL | open | Dec 31, 2026 |
| Batch orchestrator not replicated to the secondary site | End-of-Day Core Processing | CRITICAL | open | Dec 31, 2026 |
| Sole network provider for domestic wire connectivity | Domestic Wire Payments | HIGH | open | Dec 31, 2026 |
| Single card network with capped stand-in processing | Debit Card Authorization | HIGH | open | Dec 31, 2026 |
| Armored-carrier concentration in a single regional vendor | Branch & ATM Cash Access | LOW | risk accepted | — |
0% of all recorded vulnerabilities closed; risk acceptances carry second-line concurrence.