Skip to content

GRA · Financial Cyber and Operational Resilience

Spatial financeWhere capital meets hazard, exposure and transition

Financial-system transmission

Operational disruption can travel through the financial system faster than financial stress. A cyber incident or outage at a shared provider can stop services at many firms simultaneously; a failure at one firm can block payments to others; and loss of confidence can turn an operational problem into a liquidity one. This page shows these channels at sector level. It complements the financial discipline overview.

Make an enquiry Back to Financial discipline overview
STEM methods
4
Canonical methods this field applies
Topics
8
Subject pages in the field
Counterparts
10
Platforms in shared fields across the network
Report series
2
Reports series it contributes to
01Real to financial

How technology failures become financial stress.

  1. 01

    Common provider

    An outage or compromise at a cloud, software or data provider affects every firm that relies on it at the same moment, removing the diversity that would normally let some firms keep serving customers while others recover.

  2. 02

    Payment and settlement links

    A firm that cannot send payments leaves others short of expected funds, which can spread liquidity strain.

  3. 03

    Data corruption

    Corrupted or manipulated data can propagate to firms that consume it, undermining trust in balances and positions.

  4. 04

    Confidence

    Customers and counterparties may withdraw funds or reduce exposure to a firm seen as unable to operate.

02Monitor

Field overview.

The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.

Field overview: the screen's structure, terms and states for Operational resilience.Example names and illustrative values; a design, not a record or a live system.
03Paths

How a cyber event becomes a financial one.

  • Service outage: customers cannot pay or trade.
  • Data integrity loss: positions and balances are uncertain, so activity stops.
  • Confidence: depositors and counterparties withdraw.
  • Insured loss: cyber insurance claims correlate across policyholders sharing a provider.
04Governance

Public dimensions.

Financial cyber resilience depends on telecom, power and public cloud governance outside finance. Those questions continue at GRF cyber and public infrastructure; supply chain security at GCRI supply chain security.

05Physical dependencies

Infrastructure beneath finance.

Power

Electricity

Data centres and branches depend on the grid and on backup power with limited fuel.

Networks

Telecommunications

Trading and payments depend on networks and cables that can fail or be damaged.

Hazards

Natural events

Floods, heat and storms can affect data centres and operations sites in the same region.

06Amplifiers

What makes transmission stronger.

Recovery can also be sequential: a firm may restore its own systems only to find that counterparties, providers or market infrastructures are still down. Transmission is stronger when many firms depend on the same few providers, when recovery depends on systems that were themselves affected, when incidents are detected late and when communication fails. Customers feel the effects directly: payments that do not arrive, cards that do not work, accounts that cannot be accessed. Small businesses and people with few alternatives are most exposed.

07Analysis

Sector-level, aggregated, with limits.

Analysis uses public and aggregated information and network science and contagion methods. Analysis is sector-level and educational. It does not assess individual firms, test their controls or certify their resilience. Detailed dependency data is commercially and security sensitive, so published maps describe patterns rather than named relationships. The Universe theme on third-party concentration failure is designed to exercise these channels.

08Sources

Where this page's references lead.

The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.

09Questions

Questions and answers.

Is competitor data shared?
No. Any data from firms is aggregated before use. Competition safeguards are designed into GRA programmes and set out in a written competition policy.
Are named providers identified as risks?
No. Published work describes concentration patterns, not named providers or firms.
Who oversees these risks formally?
Financial supervisors, central banks and, in some jurisdictions, authorities that oversee critical technology providers. GRA is not a supervisor.
Why can operational stress move faster than financial stress?
Because a shared system can fail for everyone at the same moment. Financial contagion usually works through balance sheets over days or weeks; an outage reaches every dependent firm within minutes.
ReportsContribute

Contribute evidence from this page.

Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Global Risks AllianceFinancial Cyber and Operational ResilienceScenario and Stress-TestStrategic Systems

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

Financial Cyber and Operational Resilience

Bring an exposure or capital question to the Alliance.

Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.

Propose a readiness pilot See all contact routes
Legal

Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.