Ensuring operational resilience in 2025 – why the status quo no longer works
0
This content has been created by the Finextra editorial team with inputs from subject matter experts at the funding sponsor.
Operational resilience is on all UK payments leaders' minds. In 2024, 95% of business leaders stated that they're aware of operational weaknesses which leave them vulnerable, yet 48% said their organisations aren't doing enough to improve resilience.
The European Union (EU)'s Digital Operational Resilience Act (DORA) – having come into effect on 17 January 2025 – is the regulators' push towards improved operational risk incident management across the industry, but how have financial organisations fared when it comes to readiness? What else needs to be done from an infrastructure perspective to achieve greater resilience?
Finextra spoke with Rob Reid, technical evangelist at Cockroach Labs, about the company's research on the state of resilience across financial services; how to effectively achieve operational resilience; and what needs to be done to reap benefits that extend beyond mere compliance.
How outages turned into the new normal
While outages have become common in organisations – Cockroach Labs found organisations experience on average 86 a year – it's major infrastructure blackouts that grabbed the headlines in 2024.
The Bank of England reported seven outages to the UK's RTGS (Real-Time Gross Settlement) and Clearing House Automated Payment System (CHAPS) in 2024. Most notably, in July 2024, CHAPS failed and delayed large, time-sensitive payments, which had a substantial impact. With CHAPS usually enabling 200,000 payments a day – with an average daily value of £345 billion – a system shutdown of this scale (245 minutes in fact) resulted in considerable losses.
That very same month, the CrowdStrike outage caused global chaos, affecting over 8 million Windows devices. The fallout was immense, with GPs unable to treat patients; hundreds of businesses reporting revenue losses; and planes being grounded globally, leaving travellers stranded in airports.
'Once you've hit rock bottom, the only way is up. And I think we're going to need to see changes,' said Reid, when speaking on the state of operational resilience in financial services. 'The technologies and practices used across the industry aren't keeping up with the needs of modern resilience requirements. Fundamentally, if what we had was working, we wouldn't have DORA.'
The state of resilience in light of DORA
The EU's DORA officially took effect on 17 January 2025, providing a universal framework designed to enhance information and communication technology (ICT) risk management.
'I am a software engineer with an almost comically low-risk appetite. So, as you can imagine, I've been bemoaning lacklustre operational resilience for many years,' commented Reid. 'DORA is a much-needed wake up call for the industry. I wish we would have had it years ago, because as a software engineer at the coalface, I would have had something to wield.'
In order to understand the state of resilience going into 2025, Cockroach Labs surveyed 1,000 senior cloud and technology executives. Alarmingly, the data showed that while 94% of technical executives stated that the CrowdStrike outage encouraged their organisations to reassess their risk management, the operational resilience reality still looks bleak:
93% of leaders are concerned about the financial and organisational impacts of outages;
95% are aware of operational weaknesses that leave them vulnerable;
53% of banking and financial services companies report experiencing service disruptions at least weekly;
20% of respondents describe their organisation as fully prepared for outages;
33% have an organised response approach, and less than a third conduct regular failover testing.
Speaking on the results, Reid emphasised: 'Every single person we spoke to reported revenue loss as a result of downtime in the last 12 months. On average, businesses are seeing 86 outages per year, with the average downtime lasting more than three hours. In terms of approaches, this hints at an industry-wide tendency of being reactive to downtime, and I would question whether teams are being given the time, space, and resources required to make meaningful, positive changes in preventing it.'
Considering the research was conducted at the end of last year, it is surprising to see how little progress organisations have made toward operational resilience – especially given the DORA deadline. However, considering how much information geared toward DORA readiness has been available, these results show that it might be an issue of agility rather than an issue of understanding.
'Consider DORA from the perspective of a company with aging technology and infrastructure,' commented Reid. 'This all serves to reduce their ability to innovate. They're having to manage all of this potentially archaic infrastructure, let alone react with agility. And it's not only DORA, there is GDPR [General Data Protection Regulation], there is CCPA [California Consumer Privacy Act], and a host of other regulations. Add to that a disaster recovery mindset, necessitated by the presence of primary/secondary architecture, and you've got a perpetuation.'
So how can organisations go beyond the minimum requirements of DORA to develop holistic operational resilience strategies?
Developing modern resilience strategies
For organisations running primary/secondary architecture, failovers and failbacks are key concepts of resilience and disaster recovery. A failover is the process of switching to a backup, secondary system or site when the primary architecture fails – ensuring business continuity – while failback refers to the process of returning to the primary system once the issue is resolved.
Reid explained that many organisations are running primary/secondary architectures 'with the hope that things don't go wrong. Because if something goes wrong, they need to fail over, and that is risky. Some businesses never fail back because of the risk associated in failing back to the primary architecture. However, hope is not a strategy. Modern and capable technology must be considered if we are to move beyond the traditional primary/secondary failover mindset, and businesses should be considering technologies that minimise RTO and RPO.'
RTO (recovery time objective) is the amount of time that an organisation will be down following an outage, which, according to Reid, should be measured in seconds, not minutes or hours. RPO (recovery point objective) is the amount of data that an organisation loses in an outage.
'And that should be zero,' he argued. 'Let's assume you have a traditional database that you are backing up every hour. That's up to one hour of data that you're going to permanently lose in the event of an outage, simply because you didn't back up more regularly within that time window.'
Thinking beyond the primary/secondary architecture approach, self-healing technology is the more modern approach in achieving effective operational resilience. Referring to applications that are capable of detecting, diagnosing, and repairing their own issues without human intervention, self-healing technology – made even more powerful through machine learning and artificial intelligence (AI) – enables organisations to better manage their systems' availability.
Crucially, self-healing technology can work both reactively as well as preventatively which, according to Reid, is not just important for systems, but for employees as well. In order to achieve reliable availability, the mindset within organisation needs to start rewarding prevention more than finding solutions to existing issues:
'Do employees get more recognition for putting out fires, or do they get more recognition for preventing fires in the first place? Preventing fires will inevitably be a lot less visible if the reward culture celebrates firefighting,' emphasised Reid. 'Businesses can and should be adopting self-healing and distributed technologies. This places the burden of operational resilience on software instead of people, and that frees people up to innovate.'
Operational resilience in 2025 and beyond
In 2025, downtime is no longer tenable. Resilience, in its many forms, must be made a priority. A failure to comprehensively overhaul and modernise systems and processes will inevitably incur disruptions.
'DORA is the recognition that the status quo isn't doing enough to keep businesses online, and it should be seen as an opportunity,' finalised Reid. 'DORA will shore up trust in the industry as a whole, and each of those businesses that work within it are going to contribute to that. I have watched organisations reap the benefits of self-healing applications. Modern technology has the potential to completely revolutionise the way we approach operational resilience.'
It is now imperative for financial institutions – both banks and regulated, non-bank financial institutions – to ensure business continuity meets organisational needs in an increasingly volatile global environment.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Reuters
31 minutes ago
- Reuters
Britain ready to implement US tariff deal, trade minister says
LONDON, June 12 (Reuters) - Britain is ready to implement its side of a tariff deal with the United States and is hopeful for a proclamation from U.S. President Donald Trump to put the agreement into effect in the coming days, trade minister Jonathan Reynolds said on Thursday. British Prime Minister Keir Starmer and Trump on May 8 agreed to reduce tariffs on UK imports of cars and steel to the U.S., with Britain agreeing to lower tariffs on beef and ethanol, but implementation of the deal has been delayed. Reynolds met U.S. Commerce Secretary Howard Lutnick on Tuesday and discussed the implementation of the deal. Asked on Thursday if there would be an update by the end of the week, Reynolds said he was "very hopeful". "We're ready to go, and as soon as the president and the White House are ready to go on their side, we'll implement (our) part of the deal," Reynolds told reporters. Reynolds said he would issue a government order known as a statutory instrument to implement the changes to reciprocal tariffs. Officials said that the update on implementation was likely to come early next week. One of the details to be ironed out before the deal can be implemented is steel quotas. Reynolds added that he wanted to make sure the tariff reductions applied to every bit of the UK steel industry, as the U.S. finalises quotas that will place supply chain requirements on British steel exports to the United States. The bioethanol industry has warned its future is under threat, with Associated British Foods (ABF.L), opens new tab deciding on the fate of a plant later this month. Reynolds acknowledged the deal could increase competition but said the industry was already struggling. "We are very sensitive to the ethanol issue... (but) they're losing a lot of money already," Reynolds said, adding regulatory tweaks could help, but that for financial support: "any intervention I make has to be a clear route to profitability." "So there are much wider issues for these partners than just the U.S. trade deal."
BBC News
31 minutes ago
- BBC News
Unclear when Northern's reduced Sunday rail service will end
A rail service says it is unclear when it will stop a reduced Sunday service it has been running since late last year. Northern has been running fewer services in north-west England every Sunday since 22 December 2024, because it has not been able to find enough conductors to work those firm's managing director Tricia Williams told a Transport for the North Meeting on Tuesday the reduced service was "not what we all want" but did offer customers "predictability".Northern said it was still negotiating with National Union of Rail, Maritime and Transport Workers (RMT) over Sunday working. RMT confirmed discussions were ongoing. The firm has previously said the problem it faced on Sundays was it was contractually outside the working week for North West services include routes from Barrow and Windermere to Manchester Airport, and from Barrow to Williams said the reduced service currently relied on volunteers. "The success criteria for us is about achieving a truly seven-day railway," she said. She said the aim for the company was to ensure no more than 2% of services were being cancelled by the end of 2027 and that 90% of trains arrived within three minutes of said it was conducting "detailed discussions with Northern Trains to bring together working practices for conductors from three legacy companies into a single, modern agreement"."The talks aim to ensure consistency, reflect advances in technology, and support reliable services throughout the week", a spokesperson proposals would be subject to government approval, they follows Northern being issued a breach notice by the Department for Transport (DfT) in July 2024 for cancelling too many trains.
The Guardian
39 minutes ago
- The Guardian
Dollar slides to three-year low after Trump repeats tariff threats
The dollar sank to its lowest in more than three years on Thursday as Donald Trump's latest trade threats and the weakening economy appeared to bring forward interest rate cuts by the Federal Reserve. Foreign exchange traders sold the dollar in favour of the yen and the euro, which both climbed by about 1% against the US currency to leave it almost 10% down on its value against a basket of currencies since the beginning of the year. Analysts said there was little appetite to buy dollars at a time when recent data showed the jobs market weakening and while erratic White House policies clouded the outlook for the US economy. The slide came after the US president revived last month's threat to unilaterally impose country-specific tariff rates within the next two weeks. 'We're going to be sending letters out in about a week and a half, two weeks, to countries, telling them what the deal is,' Trump told an event in Washington on Wednesday. Markets were also unsettled by growing speculation that the Federal Reserve would begin to cut the cost of borrowing more quickly than expected after consumer inflation came in lower than expected and producer inflation dropped. Weaker job hiring was another factor after the four-week average number of initial applications for unemployment support rose by 5,000 to 240,250 in May, the highest since August 2023. 'There's clearly solid dollar selling,' said Kit Juckes, the chief foreign exchange strategist at Société Générale. Talks between India and the US over tariffs on steel and aluminium imports imposed by Washington – and the threat of import duties on Indian pharmaceuticals – were also reported to be at loggerheads, leading to speculation that if talks break down, New Delhi may retaliate with tariffs on US imports. Bloomberg reported that India's negotiators had objected to a long list of US demands that included allowing genetically modified crops to be imported and the easing of price controls on medical devices. However, the UK is expected to get a trade boost after Trump indicated that he would put into force the bilateral trade deal signed with Keir Starmer last month, allowing the UK to avoid the extra import duties on cars in return for more relaxed quotas on US beef and ethanol exports to the UK. However, the pound's rise against the dollar to almost $1.36 was choked off by concerns that the UK economy was also suffering more than expected, and that an earlier intervention by the Bank of England to cut interest rates would reduce the demand for sterling. Sign up to First Thing Our US morning briefing breaks down the key stories of the day, telling you what's happening and why it matters after newsletter promotion The UK economy slumped by 0.3% in April, potentially bringing forward the date when the Bank of England cuts interest rates again. Policymakers meet next week, but are not expected to reduce the cost of borrowing from its 4.25% level until August at the earliest. Vasileios Gkionakis, a senior economist at Aviva Investors, said the consistent depreciation of the dollar since Trump's inauguration was probably due to a lack of faith in the US economy under Trump to grow at an exceptional pace, as it had in recent years. He said higher US government debts, which Trump has signalled will escalate once his tax bill passes both houses of Congress, was another deterrent to buying dollars. 'All this is agitating markets, who in order to lend to the US would require a combination of higher [interest rates] and a weaker exchange rate,' he said.
