Business Continuity and Payment Systems

The Bank for International Settlements definition of a payment system states; “A payment system consists of a set of instruments, banking procedures and, typically, interbank funds transfer systems that ensure the circulation of money” (From “A glossary of terms used in payments and settlement systems”, Committee on Payment & Settlement Systems. BIS, Basel. March 2003). 

Despite this we often associate the word “system” with only the technology; the bits and bites, the hardware and the software. We tend to forget that there is a lot more that goes into making up a payment system. 

A further problem is the user’s perspective, and in the case of a bank this is often from that banks own point of view – a view that only concerns the bank itself. The outside world is seen as exogenous to the bank’s “system”. This is often the view taken when considering such critical issues as disaster recovery and business continuity planning. What is often overlooked is the big picture – the users, the clearing system and the settlement agent.  

This total picture is something that was very clearly illustrated in the effect that the events of 9/11 had on the payments system in the United States generally, but more specifically in lower Manhattan. The aftermath of the 9/11 events clearly illustrated this - that disaster recovery and business continuity planning had been too focused on single localized events and assumed that all the other system components would remain intact.  

The major lessons learned were;

• Business continuity planning failed to take into account the possibility of wide-area disasters and for the major loss of or inaccessibility of critical staff
• At many organizations contingency planning had generally concentrated on problems with a single building or system.
• Some firms maintained their backup facilities in nearby buildings, assuming that an “event” might debilitate or destroy a single facility.
• Very few firms planned for an emergency that would disrupt whole business district or city. This led certain firms to loose access to both their main and backup facilities following 9/11 attacks.
• Generally firms had also not considered the possibility that transportation of staff could be significantly disrupted and that their ability to move personnel to an alternative location would become extremely difficult or impossible.  
• The market and geographical focus intensified the effect of operational disruptions
• Those financial institutions that were significantly concentrated within the geographic area in New York City were most affected by the devastation at the World Trade Center. This was made worse by the fact that some had consolidated their staff in one or two locations for efficiency purposes.
• Certain critical market functions, especially in the clearing and settlement of funds, securities, and financial contracts, depend on a small number of specialist organizations each with their own operations in a concentrated area.
• There were major weaknesses in telecommunications capabilities because of these concentrations. Many firms believed they had full redundancy in their communications systems because they had arrangements with multiple telecommunications providers or because they had contracted for diverse routing, only to discover that all of the communication lines traveled through any of several single points of failure. 
• There was a strong interdependence among financial system participants irrespective of where they were located
• While financial institutions situated outside the New York City area were affected to a much lesser degree than were those inside it, many felt the effects of the disaster.
• Most financial factors lost the ability to connect to banks, brokers and other organizations in lower Manhattan. This blocked their ability to conduct business and establish whether transactions had been completed as anticipated.
• Some customers were affected by actions of institutions with which they did not even do business, when funds or securities could not be delivered due to operational problems at other institutions.
• The suspension of all commercial flights had serious implications for the clearing of cheques.
• In the post-9/11 world there is a clear understanding that the financial system has many components, and they all have to work. It is the big picture, not the narrow “own” view that has to be planned for.  

Business continuity planning needs to be made far more robust. Revised plans should include the ability for a rapid resumption of critical operations following the loss or inaccessibility of staff in at least one major operating site; or following a wide-scale, regional disruption. It is vital that all critical internal and external continuity arrangements are effective and compatible.