Cloud services and external technology partners may improve delivery, but bank resilience depends on governance, contingency plans and a clear view of critical operations.
From technology availability to continuity of service
A bank can have sophisticated technology and still be exposed to interruptions that affect customers or markets. The Basel Committee’s principles for operational resilience define a framework for maintaining critical operations through disruption. The scope is broader than cybersecurity alone: it includes governance, risk management, business continuity, third-party dependencies, incident response and information technology.
Operational resilience is therefore not simply a measure of system uptime. It is the ability to understand which services are critical, the processes and providers needed to deliver them, and the practical arrangements available when normal operations cannot continue.
Mapping the parts behind a critical service
According to the Basel guidance on interconnections and interdependencies, banks should identify people, technology, information, facilities and external relationships needed to deliver critical operations. A payment service, for example, can depend on customer authentication, ledger processing, connectivity to external networks, reconciliation controls and staff with authority to manage incidents.
The exercise is valuable because vulnerabilities may exist between systems rather than inside one system. An application may be operational while a supporting connection, credential service or external processing provider is unavailable. A complete operational map makes these dependencies visible and supports more credible testing.
Third-party risk is part of bank risk
External providers can help institutions scale systems and access specialised capabilities, but outsourcing an activity does not eliminate the need for bank oversight. The Basel Committee’s consolidated operational-risk and resilience materials distinguish resilience and third-party risk as connected supervisory subjects. Banks still need due diligence, appropriate contracts, monitoring and workable contingency measures.
Planning may include alternatives for critical providers, controlled restoration procedures and clear decision rights when services are interrupted. Some services are difficult to substitute quickly. In those cases, resilience planning needs to recognise genuine constraints rather than assume every provider can be replaced immediately.
Testing and incident learning
The Basel Core Principles for effective banking supervision emphasise operational-risk frameworks that can identify, assess, mitigate and respond to disruption. Testing should cover severe but plausible scenarios and should clarify what happens when several components fail together.
Incident management also requires more than restoring a system. Banks must understand the scope of any interruption, communicate with relevant parties, record remediation and consider whether lessons require changes to controls or operating procedures. A technology recovery target is meaningful only when it supports the restoration of the actual customer or market service.
The governance conclusion
Cloud adoption, new payment interfaces and shared infrastructure can all fit within a sound banking operating model. What matters is whether management can explain its material dependencies, demonstrate controls and test recovery arrangements. Resilience becomes credible when these activities are part of routine governance rather than documents produced only for supervisory review.
References
1. Basel Committee — Principles for Operational Resilience
2. Basel Committee — Operational Risk and Resilience Guidelines
3. Basel Committee — Core Principles for Effective Banking Supervision