Technology and operational risk
Financial services now run on digital infrastructure: payment rails, cloud platforms, data providers and models. This group of The Global Risks Alliance (GRA) sector platforms covers technology and operational risk through two established communities, Fintech Nexus and Financial Regulation Nexus, and several proposed communities for payments, cyber resilience, model risk and financial crime. The platforms publish evidence for institutions and supervisors to use as they see fit. They never endorse a vendor, advocate for a member or operate any service. This page is part of the specialist financial network.
- Institution
- The Global Risks Alliance (GRA)
- Service level
- R0: information and enquiries
Exposure aggregation
Technology and operational risk · Exposure aggregation · Submission 3
Accumulation
circle: aggregated exposure, placeholder
Accumulation by zone
| Coastal zone 1 | 8 | 8 | Cyclone |
| River zone 2 | 14 | 5 | Flood |
| Fault zone 3 | 11 | 5 | Earthquake |
Data quality
GRA · Exposure aggregationExposure aggregation, in outline: domain structure with placeholder names and illustrative values, not a record.
The short answer.
The technology and operational risk group of GRA sector platforms covers the digital infrastructure financial services run on through two established communities, Fintech Nexus and Financial Regulation Nexus, and proposed communities for payments, cyber resilience, model risk and financial crime. They publish evidence and never test, rank or endorse products.
Settlement dependencies, and what fails with a node.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
Two communities, each at its own address.
Fintech Nexus
Payments, digital identity, distributed ledgers and AI in financial services, examined for both capability and new concentrations of risk. Visit Fintech Nexus.
Financial Regulation Nexus
The evidence regulators and supervisors may draw on for systemic risk, disclosure and conduct, offered as research and never as advocacy for any member. Visit Financial Regulation Nexus.
Technology risk now has its own rulebooks.
| Instrument | Status, October 2026 |
|---|---|
| EU DORA | Applies since 17 January 2025, with oversight of critical ICT third-party providers |
| BCBS Principles for Operational Resilience | Published 2021 |
| FSB third-party risk toolkit | Published December 2023 |
| CPMI-IOSCO PFMI and cyber guidance | In force for FMIs |
| EU AI Act | Credit-scoring high-risk obligations from 2 December 2027 after the AI Omnibus |
Digital infrastructure has a physical footprint.
Cloud regions, data centres, cable landing stations and payment processing sites are located assets exposed to heat, flood and power failure. GRA's operational work maps them as the nodes behind important business services. Work continues at Payments and Market Infrastructure and Financial Cyber Resilience.
In development, not yet open.
- Payments and Market InfrastructureFocusClearing, settlement, liquidity and concentration
- Financial Cyber and Operational ResilienceFocusCritical services, third parties and recovery
- AI and Financial Model RiskFocusValidation, explainability and human oversight
- Financial Crime and Fraud RiskFocusFinancial integrity and customer harm
Each proposal becomes a platform only after a review of its field boundary, community, editors, evidence and operating ownership.
Research, never vendor assessment or advocacy.
These platforms do not test, rank or endorse technology products, run any payment or market service, or lobby for any member's position. Evidence offered to supervisors is research they may choose to use; GRA seeks no privileged access to any authority. Forward-looking work appears under financial technology and transformation. The technology science of The Global Centre for Risk and Innovation (GCRI) is described in its technology pages, including payment and financial market technology.
Terms used on this page.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Operational resilience | A firm's ability to prevent, adapt to, respond to, recover from and learn from operational disruption while keeping important business services running. |
| Third-party provider | A licensed firm that accesses account data or initiates payments with the customer's consent. |
| Regtech | Technology firms use to meet regulatory obligations, such as monitoring, screening and reporting. |
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- EU Digital Operational Resilience Act, Regulation 2022/2554 (applies from 17 January 2025)
- BCBS Principles for Operational Resilience (2021)
- FSB toolkit on enhancing third-party risk management and oversight (December 2023)
- CPMI-IOSCO Principles for Financial Market Infrastructures (2012) and cyber resilience guidance (2016)
- EU AI Act (Regulation 2024/1689) as amended by the AI Omnibus, Regulation 2026/1744 (credit-scoring high-risk duties from 2 December 2027)
Questions and answers.
Does Financial Regulation Nexus lobby regulators?
Can a technology firm take part?
Are the proposed communities active?
How do I report a security issue with this site?
Around GRA.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.