Business Continuity and Payment Systems
The Bank for International Settlements definition of a payment
system states; "A payment system consists of a set of
instruments, banking procedures and, typically, interbank funds
transfer systems that ensure the circulation of money" (From "A
glossary of terms used in payments and settlement systems",
Committee on Payment & Settlement Systems. BIS, Basel. March
2003).
Despite this we often associate the word "system" with only the
technology; the bits and bites, the hardware and the software.
We tend to forget that there is a lot more that goes into making
up a payment system.
A further problem is the user's perspective, and in the case of
a bank this is often from that banks own point of view - a view
that only concerns the bank itself. The outside world is seen as
exogenous to the bank's "system". This is often the view taken
when considering such critical issues as disaster recovery and
business continuity planning. What is often overlooked is the
big picture - the users, the clearing system and the settlement
agent.
This total picture is something that was very clearly
illustrated in the effect that the events of 9/11 had on the
payments system in the United States generally, but more
specifically in lower Manhattan. The aftermath of the 9/11
events clearly illustrated this - that disaster recovery and
business continuity planning had been too focused on single
localized events and assumed that all the other system
components would remain intact.
The major lessons learned were;
* Business continuity planning failed to take into account the
possibility of wide-area disasters and for the major loss of or
inaccessibility of critical staff. At many organizations
contingency planning had generally concentrated on problems with
a single building or system. Some firms maintained their backup
facilities in nearby buildings, assuming that an "event" might
debilitate or destroy a single facility. Very few firms planned
for an emergency that would disrupt whole business district or
city. This led certain firms to loose access to both their main
and backup facilities following 9/11 attacks. Generally firms
had also not considered the possibility that transportation of
staff could be significantly disrupted and that their ability to
move personnel to an alternative location would become extremely
difficult or impossible.
* The market and geographical focus intensified the effect of
operational disruptions. Those financial institutions that were
significantly concentrated within the geographic area in New
York City were most affected by the devastation at the World
Trade Center. This was made worse by the fact that some had
consolidated their staff in one or two locations for efficiency
purposes. Certain critical market functions, especially in the
clearing and settlement of funds, securities, and financial
contracts, depend on a small number of specialist organizations
each with their own operations in a concentrated area. There
were major weaknesses in telecommunications capabilities because
of these concentrations. Many firms believed they had full
redundancy in their communications systems because they had
arrangements with multiple telecommunications providers or
because they had contracted for diverse routing, only to
discover that all of the communication lines traveled through
any of several single points of failure.
* There was a strong interdependence among financial system
participants irrespective of where they were located. While
financial institutions situated outside the New York City area
were affected to a much lesser degree than were those inside it,
many felt the effects of the disaster. Most financial factors
lost the ability to connect to banks, brokers and other
organizations in lower Manhattan. This blocked their ability to
conduct business and establish whether transactions had been
completed as anticipated. Some customers were affected by
actions of institutions with which they did not even do
business, when funds or securities could not be delivered due to
operational problems at other institutions. The suspension of
all commercial flights had serious implications for the clearing
of cheques.
In the post-9/11 world there is a clear understanding that the
financial system has many components, and they all have to work.
It is the big picture, not the narrow "own" view that has to be
planned for.
Business continuity planning needs to be made far more robust.
Revised plans should include the ability for a rapid resumption
of critical operations following the loss or inaccessibility of
staff in at least one major operating site; or following a
wide-scale, regional disruption. It is vital that all critical
internal and external continuity arrangements are effective and
compatible.