The next financial crisis could start with a technology outage
Australia's banks can hold ample capital and liquidity and still face serious stress if the infrastructure connecting them stops working. The RBA says operational risk is becoming a financial-stability risk.
Financial crises are usually associated with bad loans, collapsing asset prices or banks running out of capital. The Reserve Bank says another type of risk is becoming increasingly important: the financial system's technology simply stops working.
Operational risk includes cyber attacks, software failures, telecommunications outages and disruptions at the external technology providers used by financial institutions.
The concern is rising rapidly. APRA's 2025 survey found 91% of banks, insurers and super funds regarded cyber security as a high or critical risk. Geopolitical risk was nominated by 70% and broader operational risks by 48%.
How does an outage become a financial crisis?
Banks constantly receive and make payments. If a common service provider fails, several institutions could suddenly become unable to send money.
Their counterparties then do not receive the cash they expected and can develop liquidity problems of their own. In sufficiently severe circumstances, institutions could be forced to sell assets quickly, spreading stress into financial markets.
The danger is heightened by concentration. Financial institutions increasingly depend on a relatively small number of cloud, data and technology providers. In the euro area, 29% of major ICT incidents affecting significant financial institutions in 2025 originated at third-party providers.
Australia has its own critical nodes.
The RBA specifically highlights Austraclear, ASX's settlement system for Australian Government Securities, state government debt and other wholesale securities. Austraclear is also used for RBA market operations and liquidity facilities.
A prolonged Austraclear outage could therefore prevent banks from converting some of their safest assets into cash precisely when liquidity is most needed. The RBA says ASX has not yet established adequate contingency arrangements to maintain Austraclear's critical services through a prolonged outage.
APRA's recent system-wide stress test demonstrated the mechanism. Banks facing a severe liquidity shock could normally sell government bonds or pledge them to the RBA for cash. When the exercise simultaneously assumed a settlement-system outage, banks could not monetise a large share of those liquid assets and had to run down cash balances faster.
AI potentially intensifies the problem by making sophisticated cyber attacks cheaper, faster and more scalable.
The regulatory response is consequently changing. APRA's CPS 230 strengthens requirements for business continuity and oversight of critical service providers, while the RBA and APRA are developing arrangements to keep payment services operating during major outages.
The lesson is counter-intuitive: a bank can have ample capital and liquid assets and still face serious difficulty if the infrastructure needed to use them is unavailable.
Financial resilience increasingly depends not only on what institutions own, but on whether the system connecting them continues to operate.
|
|||||||||||||||||||||||||||