Nationwide Operational Resilience: Agile or Fragile?

In the years following the 2007-08 financial crisis, supervision frameworks were enhanced to oversee the global banking system which resulted in structural changes that strengthened banks’ financial resilience. While the availability of higher levels of capital and liquidity have enhanced organizational resilience through an improved ability to absorb financial shocks and market changes, further effort is necessary to enhance operational resilience for the catalysts of the global financial infrastructure: banks.

What is Operational Resilience?
For banks, operational resilience is the ability to deliver critical operations despite disruption. It enables banks to identify and protect their entities from threats and potential failures, respond, adapt, recover, and learn from disruptive events to minimize their impact. These events include pandemics, natural disasters, cyber incidents, or technological failures, and banks need to ensure that they have minimal impact on critical operations and their related services, functions, and systems.

The Global Pandemic
In recent years, banks started accelerating adaptation rates of technology infrastructure and third-party services to provision financial services. This amplified dependency and transformation of business has accounted for heightened operational risks, vulnerability, and availability of services during the global pandemic, which has massively exacerbated operational risks as well as economic and business uncertainty. It affected information systems, personnel, facilities, and relationships with third-party service providers and customers, from a spike in cyber threats to higher operational risks presented as a result of unsuccessful processes and systems in virtual working arrangements.

Absorbing Operational Shocks
FThe ability to absorb operational risk-related events requires banks to have an overall comprehensive risk management framework, including comprehensive risk identification, effective mitigation, and thorough monitoring to minimize operational disruptions. This is in addition to taking into consideration business continuity, infrastructural resilience, and outsourcing of services to third parties and technologies upon which they rely.

According to the Basel Committee for Banking Supervision, the integral operational resilience principles for banks include governance, operational risk management, business continuity planning and testing, mapping interconnections and interdependencies, third-party dependency management, incident management, and ICT including cybersecurity. Banks and financial institutions (collectively firms) have adapted most, if not all, the integral operational resilience principles at different levels. Such adaptation relies on firms’ operational complexity models, change management agility, and technology appetite.

However, from the central bank perspective, operational resilience of financial systems is fully dependent on firms, and central banks cannot rely on the pace or adapted measures of these firms to ensure the required levels of operational resilience on a nationwide scale.

Facilitating Nationwide Operational Resilience
With modern societies now dependent on financial services, pressure has been further mounting on central banks to safeguard national operational resilience that protects end users in the face of force majeure. Accordingly, each central bank needs a resilience strategy that will act as the basis for firms to enhance their crisis response capabilities and mechanisms, and for central banks to ensure industry soundness.

Such a strategy requires the central bank to continuously regulate, supervise, and inspect firms to ensure their compliance and financial resilience. It also requires supervisory interventions and sector-wide exercises in collaboration with supervisory organizations and international stakeholders to drive nationwide collective action. This is in addition to remediating vulnerabilities and developing and sharing industry best practices.

In 2017, the Bank of England highlighted three major elements of an operational resilience strategy that continue to be vital first steps to creating a successful tactic, even as the needs of the sector continue to evolve. These elements include targeting systems that are more critical to financial stability, setting expectations for the level of operational resilience required from firms, and measuring the effectiveness of the implemented procedures.

In addition, for central banks to facilitate an ecosystem that is able to withstand, absorb, and recover from technology-related risks and force majeure, they must not only develop a thorough resilience strategy, but continuously learn from, adapt to, and evolve with new technologies, demands and financial services. More importantly, central banks should also anticipate the rising needs of both firms and end users through assessing traction on new payment technologies, and accordingly, continuously adjusting strategies and risk management procedures.

Total National Payments System

Central banks that have a total national payments system in place leverage a more resilient infrastructure that ensures nationwide payment technologies implemented by firms are in sync, fully compliant, and robust. It provides massive advantages to the central bank including interoperability, full data visibility, and access across all payment channels. This is in addition to:

1. Simplified, robust operational and credit risk management
2. Improved resiliency for banking, payments, and securities infrastructures
3. Enhanced oversight and regulatory regimes for all payment systems in the network
4. Better containment of legal, operational, financial, and systemic risks in payment infrastructures

These advantages cannot be realized through separate payments, clearing, and settlement systems, but instead require one holistic total national payments system that should also accommodate for broadening the range of payment technologies offered in the country and easing the adoption of new market services.

To conclude, the global pandemic did not create a new need for central banks to facilitate nationwide operational resilience but only highlighted the vulnerabilities of existing infrastructures and procedures in absorbing operational shocks without disruption. How central banks choose to respond is what will determine whether nationwide operational resilience will be agile or fragile.