🏦 Banking & Financial Services
Banking and financial services operate under the strictest SLA, compliance, and availability requirements of any sector. A 15-minute trading system outage can cost millions. DORA (Digital Operational Resilience Act) mandates documented ICT incident classification and reporting to regulators within 4 hours for major incidents.
Service Architecture
ITIL Implementation Journey
Banking ITIL 4 Implementation Roadmap
Click any step to expand · 6 steps
Key Use Cases
1. Incident & Impact Calculation
When a Core Banking system degrades, the blast radius must be calculated instantly across all dependent business services.
Impact model:
Core Banking (T24) outage
→ Retail Banking Portal (BLOCKED — 2.3M customers)
→ Mobile Banking App (BLOCKED — 4.1M users)
→ SWIFT Payments (DEGRADED — delay risk)
→ Regulatory Reporting (AT RISK — end-of-day batch)
Estimated revenue impact: €45,000/hour
DORA classification: Major Operational Incident
Regulatory notification required: within 4 hoursCMDB relationship query (ServiceNow example):
// Auto-calculate blast radius from failed CI
var grCMDB = new GlideRecord('cmdb_rel_ci')
grCMDB.addQuery('child', ciBankingSystemSysId)
grCMDB.query()
// Returns all upstream Business Services → notify owners2. BCP & DR Activation
| Trigger | Action | RTO Target |
|---|---|---|
| Primary DC power failure | Activate warm DR site | < 1 hour |
| Ransomware on core systems | Isolate + failover | < 2 hours |
| SWIFT network outage | Activate backup messaging | < 30 min |
| Trading platform failure | Switch to read-only mode | < 15 min |
3. DORA Compliance Reporting
DORA (EU) requires banks to:
- Classify all ICT assets by criticality
- Report major ICT incidents within 4 hours of classification
- Submit root cause analysis within 1 month
- Conduct annual ICT resilience testing
Workflow:
Incident detected → ITSM auto-classifies (DORA template)
→ If Major: auto-notify Compliance team (email + ticket)
→ 4h timer starts → Compliance drafts ECB notification
→ PIR completed → RCA report generated from ITSM data
→ Annual submission: extract from ITSM + CMDB + DR test logs4. ITAM — Software Licence Audit
Banks typically overspend 20–35% on software licences due to:
- Oracle Database licences on virtualised environments (processor-based)
- Bloomberg terminal proliferation
- Unused ERP seats
Process:
- Discovery scan → normalise against vendor catalogue
- Reconcile: licences owned vs deployed vs actual usage
- True-up planning: reclaim unused, true-up before audit
- CMDB software record updated with licence status
5. Onboarding / Offboarding
| Step | System | SLA |
|---|---|---|
| New joiner HR trigger | HR System → ITSM auto-request | T+0 |
| AD account creation | IAM tool | < 1 hour |
| Core Banking access grant | Manual + approval | < 4 hours |
| Bloomberg terminal provision | Vendor portal + ITAM | < 24 hours |
| Leaver: access revoke all | Automated deprovisioning | < 2 hours |
| Leaver: equipment return | ITAM asset recovery | < 5 days |
CapEx vs OpEx Analysis
| Category | CapEx | OpEx |
|---|---|---|
| On-prem DR site build | ✅ High | — |
| Cloud DR (AWS/Azure) | — | ✅ Monthly subscription |
| ITSM platform licence | ✅ Perpetual option | ✅ SaaS preferred |
| CMDB discovery tools | ✅ Appliance | ✅ Agent/cloud |
| Security tooling (EDR, SIEM) | — | ✅ Managed service |
| Staff training (ITIL, DORA) | — | ✅ Annual |
Recommendation for banks: Hybrid model — on-prem core ITSM for data sovereignty, cloud-burst DR, managed SOC for security monitoring.
Tool Selection Guide
| Criterion | Recommended Platform | Reason |
|---|---|---|
| Tier 1 global bank | ServiceNow | DORA-ready, CMDB depth, AI/AIOps, audit trail |
| Regional bank (MENA/Europe) | BMC Helix | Strong CMDB, multi-tenancy, cost-effective for mid-size |
| Digital-native / challenger bank | Jira SM + Atlassian | Fast setup, DevOps native, cost-efficient |
| SAP-heavy environment | SMAX | SAP integration, low code, rapid deployment |
Key evaluation criteria for banking:
- Native DORA/ICT incident classification templates
- CMDB relationship depth for blast radius analysis
- Audit trail immutability (regulatory requirement)
- Role-based access control for PII and trading data
- Data residency options (EU/MENA sovereignty)
← Back to Industries Overview · Template Library