Why Payment-System Resilience Matters
A payment system must do more than transmit instructions: participants need to be able to make payments accurately, on time, and with confidence that settlement will occur as intended. A technical outage, a shortage of immediately available funds, or a participant’s failure to pay can interrupt this process. Because many participants rely on one another, an initial problem may also delay or disrupt other payments.
Resilience is the capacity to prevent, withstand, respond to, and recover from disruptions while maintaining important payment services. It does not mean that failures are impossible. It means that system design and operating practices limit the likelihood, scale, and duration of a disruption. This topic is aligned with the SOA VEE Economics (Validation by Educational Experience) syllabus.
These categories describe different problems. A network outage is operational; a bank that lacks funds at the required time faces liquidity risk; and a bank that defaults on an obligation creates counterparty risk. A single event can involve all three. For example, a system outage may delay incoming payments, leaving a participant short of funds, and that participant may then fail to pay another institution.
How the Main Risks Affect Payments
Operational risk includes processing errors, unavailable communications, cyber incidents, power failures, staff mistakes, and failures at an outsourced provider. A payment can be delayed, duplicated, sent to an incorrect recipient, or exposed to unauthorized access. Controls such as authentication, transaction limits, reconciliation, tested recovery procedures, and separation of duties can reduce these risks. No single control is sufficient for every failure mode.
Liquidity risk is about timing, not simply whether a participant’s assets exceed its liabilities. A participant may expect to receive enough funds during the day to cover its payments but still face a shortfall if its outgoing payments are due first. A committed credit facility or other usable liquidity resource may help, but it must actually be available when needed and under the relevant rules.
Counterparty risk arises when a payment depends on another party performing an obligation. The exposure can depend on the payment’s legal and operational status. If a payment is still provisional and may be reversed, the receiving party may face a different exposure from one whose settlement is already final. The exact effect depends on the system’s rules and applicable law; a general calculation cannot determine legal finality.
Risks may also spread. If one participant misses a payment, its recipients may lack funds for their own obligations. This can create a chain of delays or failures, sometimes called systemic risk. Settlement arrangements, liquidity resources, and system-wide contingency planning are therefore relevant, not just each institution’s internal controls.
Measuring a Simple Intraday Liquidity Gap
A useful basic calculation compares the timing of cumulative payments with cash and other resources that are reliably available at that time. Treat expected incoming funds as available only once they have actually settled or are otherwise assured under the stated assumptions. Let \(D_t\) be cumulative payments due by time \(t\), \(I_t\) be cumulative incoming funds available by that time, \(C_0\) be opening cash, and \(F\) be a committed facility that can be drawn when required. The additional liquidity needed to cover the modeled schedule is:
This follows from cash accounting. By time \(t\), the participant has opening cash plus available inflows and facility funding, less payments due: \(C_0+I_t+F-D_t\). If this balance is negative, the shortfall is its absolute value; if it is nonnegative, there is no shortfall at that time. Taking the largest positive shortfall across the schedule gives the additional amount needed to meet every modeled payment on time. The calculation assumes the facility is genuinely drawable, that timing and amounts are known, and that the listed payments are the relevant obligations. It does not measure solvency or every possible liquidity risk.
Worked Example: A Delayed Inflow and a Liquidity Facility
A participant begins with $3.00 million in available settlement cash. It must pay $4.30 million at 10:00. It can draw a committed facility, and it draws $1.30 million before making that payment. An incoming payment of $1.00 million settles at 10:20. Assume the facility has no fees for this calculation, the draw is permitted, and repayment is allowed at 10:20. Track cash and facility debt, and determine the position after a possible partial repayment.
Method. Track cash separately from the facility liability. A facility draw increases cash and creates debt; it is not income and does not erase the obligation to repay.
Before the draw, cash is $3.00 million. After drawing $1.30 million, cash is \(3.00+1.30=\$4.30\) million and facility debt is $1.30 million.
The participant pays $4.30 million at 10:00. Its cash becomes \(4.30-4.30=\$0.00\) million. The facility liability remains $1.30 million.
At 10:20, the $1.00 million incoming payment settles. Cash is now \(0.00+1.00=\$1.00\) million, and facility debt is still $1.30 million. Its net position after subtracting that debt is \(1.00-1.30=-\$0.30\) million.
If it repays $0.30 million of the facility, cash becomes \(1.00-0.30=\$0.70\) million and the remaining facility debt becomes \(1.30-0.30=\$1.00\) million. Its net position remains \(0.70-1.00=-\$0.30\) million. This repayment is possible because it has $1.00 million in cash before repayment.
Check. The payment was met at 10:00, and the later repayment reduces both cash and debt by the same amount. A common mistake is to report cash of \(-\$0.30\) million at 10:20. That number is the net position after subtracting the facility liability, not the cash balance: cash is $1.00 million before repayment and $0.70 million after the $0.30 million repayment.
Redundancy, Controls, and Settlement Design
Resilience comes from combining measures that address different failure modes. Redundancy provides an alternative when a component fails: examples include backup communications, secondary processing capacity, and tested recovery sites. But redundancy is effective only if the alternative is available, has enough capacity, and does not share the same vulnerable dependency as the primary channel. Two systems using the same power supply or network provider may fail together.
Controls lower the probability or impact of errors and unauthorized activity. These can include independent approval for sensitive instructions, access restrictions, authentication, limits, monitoring for unusual activity, and reconciliation of records. A recovery plan specifies how to restore service and communicate with participants. Regular testing matters because an untested backup or outdated contact list may not work when needed.
Settlement arrangements affect when obligations are discharged and what resources participants need. In broad terms, immediate settlement can reduce the period during which a participant waits on an unsettled obligation, but may require funds to be available sooner. Settlement at a later scheduled time may allow obligations to be combined or managed together, but participants must understand what remains provisional and have resources to meet obligations when due. The appropriate design balances timely, dependable settlement with liquidity demands; no arrangement removes every risk.
Worked Example: What Redundancy Can Protect Against
A hypothetical payment operator uses a primary processing channel with a 0.98 probability of being available on a particular day and a backup channel with a 0.95 probability of being available. Assume, for this calculation only, that the two channels’ availability failures are independent, that either available channel can process the day’s required volume, and that switching works without delay. Find the probability that at least one channel is available and the expected number of days with neither channel available in a 10,000-day model.
Method. Calculate the probability of the joint failure, then use its complement. The independence assumption is essential to multiplying the two failure probabilities.
The primary channel’s failure probability is \(1-0.98=0.02\). The backup channel’s failure probability is \(1-0.95=0.05\). Under independence, the probability that both fail is \(0.02\times0.05=0.001\).
Therefore, the probability that at least one channel is available is \(1-0.001=0.999\), or 99.9%. In 10,000 modeled days, the expected number of days with both unavailable is \(10{,}000\times0.001=10\).
Check. The individual failure probabilities are larger than the joint failure probability under the stated independence assumption, so adding an independent backup improves availability. This calculation does not establish real-world reliability: a shared power failure, common software defect, inadequate backup capacity, or failed switching process can make failures dependent or render the backup ineffective.
Worked Example: Exposure Before a Payment Becomes Final
Suppose a hypothetical institution sends $2.40 million of payments to a counterparty under a process in which those payments remain provisional until a later settlement step. Assume the counterparty defaults before that step, the payments cannot be recovered, and the institution ultimately recovers 40% of the amount at risk. Find the loss given default. If the probability of this default event over the stated period is 2%, calculate the expected loss for that period, assuming no other losses.
Method. First calculate the unrecovered amount conditional on default; then multiply by the probability of that event to obtain expected loss under the stated two-outcome model.
The amount at risk is $2.40 million. Recovery is \(0.40\times2.40=\$0.96\) million. The loss given default is therefore \(2.40-0.96=\$1.44\) million.
The default probability is \(2\%=0.02\). Expected loss is \(0.02\times\$1.44\) million \(=\$0.0288\) million, or $28,800.
Check. The conditional loss of $1.44 million is less than the $2.40 million exposure because recovery is positive. Expected loss is smaller still because default is assumed to occur with probability only 0.02. This model assumes the exposure, recovery rate, and event probability are fixed and does not account for other costs or dependencies.
Common Mistakes and Practical Judgments
- Confusing liquidity with solvency. A participant may have assets sufficient to cover its obligations overall but lack immediately usable funds at a payment deadline.
- Counting expected receipts too early. An incoming payment that has not settled may not be available to fund an outgoing obligation. Treat it as available only if the problem’s assumptions support doing so.
- Subtracting a liability from cash and calling the result cash. Keep cash and facility debt in separate accounts, then calculate a net position only when asked.
- Assuming backups are independent. Shared providers, infrastructure, software, or staff can create common points of failure.
- Treating every payment as final immediately. Whether a payment can be reversed or remains provisional depends on the system’s rules and applicable law.
- Assuming one control eliminates risk. Authentication, collateral, backup systems, and settlement rules address different vulnerabilities; each also has limits.
Check Your Understanding
For each problem, distinguish what is available at the stated time from what is merely expected. Amounts are hypothetical.
- A payment processor has a primary link available with probability 0.97 and an independent backup link available with probability 0.90. Either link can carry the full required volume. What is the probability both links are unavailable? (Answer: 0.003, or 0.3%)
- A bank has $2.60 million in available cash and must pay $3.10 million now. It draws $0.50 million from a committed facility and then makes the payment. What are its cash balance and facility liability immediately afterward? (Answer: $0.00 cash and $0.50 million facility liability)
- A participant begins with $1.80 million cash, owes $2.50 million at 09:00, and can draw a $0.40 million facility. An expected $0.50 million receipt does not settle until 10:00. How much additional liquidity is needed to make the 09:00 payment, assuming no other resources? (Answer: $0.30 million)
- A provisional payment exposure is $1.50 million. If the counterparty defaults, the recovery rate is 60%. The probability of default over the period is 4%, with no other losses. What are the loss given default and expected loss? (Answer: $0.60 million loss given default; $24,000 expected loss)
- A firm’s primary payment network and its backup use the same power supply. Explain why a calculation that treats their failures as independent may overstate resilience, and name one useful response. (Answer: A shared power failure can disable both channels, making failures dependent; a separately powered backup or tested alternative site can reduce this common dependency.)