Operational resilience has become one of the biggest talking points in financial services. Much of that discussion has been driven by regulation, particularly the arrival of the Digital Operational Resilience Act (DORA). But reducing resilience to a compliance exercise misses the point.
DORA isn’t really about regulation – it’s about resilience. It recognises something the payments industry has known for years: disruption is inevitable. The organisations that succeed won’t be those that avoid failure altogether, but those that have the confidence to withstand it, recover from it and continue serving customers.
For payment providers, that confidence comes from testing.
Payments ecosystems have never been more complex. Real-time payments, ISO 20022 migration, open banking, cloud platforms and growing third-party dependencies have transformed the way money moves. At the same time, transaction volumes continue to climb, customer expectations have become unforgiving and the cost of downtime has never been higher.
The question is no longer whether your payment platform works. It’s whether it will still work when volumes double unexpectedly, a critical service becomes unavailable, a third-party provider fails or an infrastructure component starts behaving unpredictably.
Those are not production questions. They are testing questions.
Too often, payment testing still focuses on validating functionality and confirming that changes haven’t broken existing services. While that’s essential, it only tells part of the story. Modern payment testing needs to answer a much broader question: how resilient is the ecosystem under real operating conditions?
Which means testing happy paths … and then testing everything that can possibly go wrong.
It means simulating real-world conditions, from traffic loads to failures, so you can be confident the product will meet expectations when going live. It means putting your payment flows through their paces so you can prove they won’t fall over when something in the chain isn’t performing as expected.
Ultimately, resilience isn’t something that can be documented. It has to be demonstrated.
This is becoming increasingly important as regulators shift their focus from individual systems to critical business services. DORA raises expectations around operational resilience, but the underlying objective is protecting the wider financial ecosystem. Regulators want firms to understand where weaknesses exist before customers discover them.
The only practical way to achieve that is through robust, intelligent testing.
My teams have spent years helping some of the world’s largest banks, payment processors and financial institutions test exactly these scenarios. Our work has never been about simply proving that a payment message can move from A to B. It’s about giving organisations confidence that their payments infrastructure will continue to perform when conditions are anything but normal.
That requires testing at scale, simulating real-world payment behaviour and exposing vulnerabilities long before they become operational incidents.
Importantly, resilience shouldn’t be seen as something that slows delivery. The opposite is true. When organisations have confidence in their testing, they can introduce change faster, adopt new payment schemes more quickly and innovate without increasing operational risk.
In a market where payment systems are expected to be available around the clock, resilience has become a competitive advantage. Customers don’t remember the successful transactions – they expect those. They remember the payments that fail.
That’s why payment providers need to be designed for resilience from the outset. And the only way to know whether that resilience genuinely exists is to test for it.
Because in payments, resilience isn’t proven by passing an audit. It’s proven every time a customer doesn’t notice that something went wrong.
Anthony Walton, CEO, Iliad Solutions