On 8 September 2026, CPMI and IOSCO published a voluntary, non-binding cyber resilience toolkit for financial market infrastructures and a discussion paper on third-party providers. Comments are invited by 1 December 2026. These publications should not be treated as a new universal compliance obligation for fintech companies.
Event / source publication date: 8 September 2026The following is Human Fintech’s analysis
Define recovery in business terms.
The following is Human Fintech’s operational analysis. For an international payment business, a supplier uptime figure answers only part of the investment question. Recovery also requires a reliable account of which instructions were accepted, which transfers settled and which customer balances need adjustment. Restoring connectivity without restoring that account can leave operations exposed to duplicate processing.
Consider a hypothetical interruption to a provider’s status feed. The payment engine can still submit instructions, but the team cannot distinguish completed transfers from pending ones. A sensible response needs an owner, a rule for pausing or retrying transactions and an agreed record against which to reconcile. Those decisions belong in the operating model before an incident.
Challenge the economics of a second provider.
A backup contract is not the same as a usable alternative. Establish what must be available to move a transaction: funding, credentials, customer data, reconciliation identifiers and support coverage. Two providers may also share an upstream dependency. Treat independence as something to demonstrate in a specific scenario, rather than infer from different brands.
For a lender, assess disbursement and repayment separately. An interruption to collections can affect the information used by servicing teams even where the borrower has initiated payment. Determine how disputed timing reaches account records and how servicing decisions are reviewed. The appropriate customer treatment and contractual interpretation need local legal and risk input; a global operating template cannot settle them.
Give a recovery exercise a decision owner.
Before expanding a corridor or increasing transaction volume, bring product, operations, engineering and the provider into one exercise. Which event triggers a pause? Who approves resubmission? What evidence proves that reconciliation is complete? Which customer communication can be sent while the final status remains uncertain?
Record the unresolved dependencies alongside the steps that worked. This gives management a concrete choice between accepting a documented exposure, funding a workaround or changing the launch scope. It also makes supplier discussions more useful: evidence about a critical transaction flow is more informative than another presentation about platform availability.
White Fintech.
Part VII of White Fintech covers payment businesses, including company structure, risks, compliance and economics. Explore the contents and the free sample.
Complete English edition, PDF + EPUB. Read the first 30 pages free, with no sign-up.