Payments and Market Infrastructure
The Global Risks Alliance (GRA)
Payment and settlement systems are prime targets for cyber attack: theft through compromised endpoints, ransomware that halts operations and attacks on data integrity that corrupt balances. Because transactions settle quickly and finally, recovery is hard. This page sets out how cyber risk to payment infrastructure develops, how resilience is measured, and who decides.
GRA · In development · service level R0
Payment system cyber security is the protection of payment and settlement infrastructure against attacks that steal funds, halt operations or corrupt records. It covers endpoint controls, threat-led testing, recovery with data integrity and migration to quantum-resistant cryptography. FMI boards, overseers and participants hold the decisions.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
Operational integrity and threat exposure. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Attackers target participant systems connected to payment networks, sending fraudulent instructions that the network treats as valid.
An attack that alters balances or transactions undermines trust in the system's records. Recovery must restore a correct state, not only resume operations.
Standards set a two-hour target to resume critical operations, but recovering safely from a destructive attack may take longer.
Attacks often hit several institutions. Sharing indicators and coordinating response limits spread across the sector.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Endpoint security | Controls on participants' systems that connect to a payment network. |
| Data integrity | The assurance that records such as balances and transactions are accurate, complete and unaltered. |
| Threat-led penetration testing | Controlled testing that mimics real attackers against live systems based on threat intelligence. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Cyber incidents reported by FMIs | count by type | annual | Overseer reports | OFFICIAL |
| Participants attesting to security controls | share of participants | annual | Network security programmes | DECLARED |
| Time to resume critical operations in tests | hours | per test | Test reports | OBSERVED |
| Threat-led penetration tests completed | count | annual | TIBER-EU and DORA records | OFFICIAL |
| Fraudulent payment instructions detected | count and value | annual | Operator and industry reports | REPORTED |
| Post-quantum migration plans in place | share of operators | periodic | Surveys | DECLARED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| CPMI-IOSCO guidance on cyber resilience for FMIs | Cyber resilience expectations | Free, BIS terms |
| CPMI strategy for reducing wholesale payment endpoint fraud | Elements to reduce endpoint fraud | Free, BIS terms |
| ECB TIBER-EU framework documents | Threat intelligence-based ethical red-teaming | Free, ECB terms |
| FS-ISAC public reports | Financial sector threat trends | Free to read, terms to check |
| ENISA threat landscape for the finance sector | Threats to EU financial entities | Free, ENISA terms |
Payments and Market Infrastructure prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| FMI boards and security functions | How to protect, detect, respond and recover | Threat intelligence and test results |
| Overseers | Whether cyber resilience meets expectations | Assessments and incident records |
| Participants | How to secure connections to payment networks | Network security requirements |
| Authorities coordinating sector response | How to share information and coordinate in incidents | Sector exercise findings |
Attacks on payment systems have included fraudulent payment instructions sent through compromised participants, ransomware against providers and disruption of services. The consequences go beyond financial loss: corrupted data can force settlement to halt while positions are reconciled, and loss of confidence can spread. Because infrastructures connect many participants, a weak participant can be the entry point for an attack on the system.
Payment cyber risk spans infrastructures, participants and their providers.
Attackers have used compromised participant systems to send fraudulent payment instructions through legitimate channels.
Corruption of payment or account data can be harder to recover from than an outage, because the correct state must be re-established.
Recovery from a destructive attack may require clean systems and reconciled data, which takes time and coordination.
A distinctive challenge for payments is the tension between rapid recovery and data integrity. Restoring operations quickly from backups risks reintroducing malware or corrupted data, while waiting for full verification prolongs disruption. Industry discussion has focused on clean recovery environments, data vaults and agreed procedures for reconciling positions across participants after an incident.
Sector information sharing on threats and techniques. Shared through dedicated arrangements, not by this platform.
Established frameworks and supervisory expectations for cyber resilience in financial market infrastructures.
Published incident reports, analysed with cybersecurity and cryptography. Many incidents are not disclosed in detail.
Sector-wide exercises simulating cyber attacks on payment systems.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.