Central bank and market-infrastructure resilience technology

Central-bank and market-infrastructure resilience technology supports continuity and recovery of payments, clearing, settlement, custody and related financial operations. The relevant institutions, standards, testing frameworks and user controls have different scopes and should not be compressed into one resilience guarantee.

Institutional scope

Financial-market infrastructures include payment systems, central securities depositories, securities settlement systems, central counterparties and trade repositories. Central banks can operate or oversee some infrastructures. Commercial banks, messaging providers and participants retain separate systems and duties.

Real-time gross settlement (RTGS) systems settle high-value obligations in central-bank money. A CSD records and settles securities, while a CCP manages counterparty exposure. Recovery objectives should be tied to the critical operation and governing framework.

Cyber guidance and recovery

CPMI-IOSCO cyber guidance supplements the Principles for Financial Market Infrastructures. Its two-hour recovery-time objective concerns an FMI's critical operations after disruptive cyber events. It is not a universal guarantee for every bank, incident or dependent service.

Resilience requires governance, asset and dependency mapping, protection, detection, response, recovery, communication and learning. Data replication and alternate sites can fail together if they share credentials, software or external utilities. A completed test is evidence of testing, not proof of recovery under every scenario.

Testing frameworks and operator controls

TIBER-EU provides a threat-intelligence-led testing framework aligned with the European regulatory setting, including DORA. CBEST is a UK supervisory framework for threat-intelligence-led assessments. Their scope, participants, test governance and remediation should be dated by version.

SWIFT's Customer Security Controls Framework governs specified user-environment controls. SWIFT does not operate every participant's internal security, and compliance attestation does not guarantee that credentials or local systems cannot be compromised.

The Bangladesh Bank heist (2016) illustrates compromise of participant systems and fraudulent messaging rather than failure of every settlement layer. Ukraine's wartime monetary and financial defence (2022-2023) illustrates continuity under physical, cyber and liquidity stress, with outcomes dependent on several institutions.

Strategic assessment

Within the Economic Kill Chain (EKC), resilient infrastructure can preserve payment access and reduce coercive vulnerability. It may also create concentration in common vendors, telecoms, power and identity services.

Editors should identify operator, critical service, recovery objective, dependency, test, incident, actual recovery and residual risk. Metrics should distinguish availability, recovery time, data loss and settlement backlog. Publication-day review must refresh guidance and framework versions.

Scenario and dependency testing

Scenario design should combine cyber, physical and financial stress rather than assume each arrives alone. Loss of a data centre may coincide with telecoms disruption, unavailable staff, a liquidity surge or corrupted credentials. Tests should define which payments receive priority, how participants reconnect and how queued instructions are reconciled after recovery.

Dependency mapping must extend beyond direct vendors to cloud regions, identity services, time sources, electricity, telecommunications and critical software libraries. Two sites do not provide independence if they share one control plane or network route. Manual workarounds should be tested for volume, authorisation and fraud risk, not merely documented.

Results need measurable evidence. Recovery time begins at a defined event and ends when a stated critical service is restored, while settlement backlog and data loss require separate measures. A red-team finding, supervisory exercise and live incident have different evidentiary weight. Editors should record remediation ownership and retest status. Strategic resilience is demonstrated by sustained critical operations under the relevant threat, not by the purchase of a recovery product or completion of an attestation.

Sources

1. CPMI-IOSCO, guidance on cyber resilience for financial-market infrastructures.
2. European Central Bank, TIBER-EU framework (accessed 30 July 2026).
3. Bank of England, CBEST implementation guide (accessed 30 July 2026).
4. SWIFT, Customer Security Programme controls (accessed 30 July 2026).