Operational Resilience for the Backbone of Financial Markets

By Mark Vösgen, Board Member, TRICEPT AG

How Financial Market Infrastructures are responding to DORA and increasing ICT complexity

Financial Market Infrastructures (FMIs) form the backbone of the global financial system. Payment systems, clearing houses and securities settlement platforms ensure that financial transactions are processed securely and efficiently. Their smooth operation is essential not only for individual institutions, but also for the stability of financial markets as a whole.

As these infrastructures become increasingly digital and interconnected, operational resilience has become a central focus of regulation. Cyber incidents, IT failures or disruptions at critical service providers can propagate quickly across financial markets.

With the introduction of the Digital Operational Resilience Act (DORA), the European Union has significantly strengthened the framework for managing ICT risks in the financial sector. For Financial Market Infrastructures, the regulation emphasises a key principle: institutions must maintain a comprehensive understanding of their digital operational environment.

Increasing complexity in digital financial infrastructures

Modern Financial Market Infrastructures operate within complex technology ecosystems. Core platforms interact with multiple internal systems, data platforms, network infrastructure and external service providers.

This interconnected structure improves efficiency and scalability while also introducing new dependencies. Disruptions in one component can potentially affect a much larger part of the operational landscape.

Understanding these interdependencies has therefore become a central element of operational resilience.

A payment system, for example, may depend on several layers of technology:

DORA and the demand for operational transparency

One of the key objectives of DORA is to ensure that financial institutions can identify and manage ICT risks more effectively. This includes maintaining detailed records of ICT assets and documenting relationships between systems, services and third-party providers.

For Financial Market Infrastructures, this requirement goes beyond regulatory reporting. It creates the foundation for understanding how critical services are supported by technology and where operational vulnerabilities may arise.

Institutions are expected to be able to answer questions such as:

• Which ICT assets support critical financial services?

• How do systems depend on each other across the infrastructure?

• Which third-party providers are involved in delivering these services?

Where could disruptions propagate across the operational environment?

“Maintaining this level of transparency becomes challenging when information is distributed across multiple tools, departments or documentation systems.”

Moving from fragmented oversight to integrated governance

Traditionally, many institutions have managed ICT assets, risk assessments, control frameworks and supplier documentation in separate systems or spreadsheets.

While this approach may work for isolated tasks, it becomes increasingly difficult to maintain a coherent overview of operational dependencies as digital ecosystems grow.

As a result, many organisations are exploring more integrated approaches to governance, risk and compliance (GRC).

These platforms aim to bring together information about assets, risks, controls and third-party relationships within a single structured environment.

By linking these elements, institutions can better understand how operational risks relate to critical services and technology dependencies.

“It becomes increasingly difficult to maintain a coherent overview of operational dependencies as digital ecosystems grow.”

Supporting operational resilience through structured systems

Integrated GRC platforms are increasingly used to support the operational governance of complex ICT environments. They allow institutions to structure and maintain information such as:

This type of structured approach helps institutions maintain transparency across their digital landscape and respond more effectively to regulatory or operational challenges.

For example, solutions such as RIMAGO, developed by Tricept AG, illustrate how GRC platforms can support financial institutions in structuring their ICT asset registers and linking them with risk and governance processes.

While technologies and platforms may differ, the underlying objective remains the same: creating a reliable overview of operational dependencies.

Operational resilience as an ongoing capability

Operational resilience is not a one-time compliance exercise. As financial markets continue to digitalise, infrastructures will become even more interconnected and technologically complex.

For Financial Market Infrastructures, resilience therefore requires continuous governance of ICT risks, technology dependencies and third-party relationships.

Regulatory frameworks such as DORA provide important guidance, but their effectiveness ultimately depends on how institutions translate these principles into operational processes and governance structures.

Organisations that succeed in building transparency across their ICT landscape will be better positioned to identify risks early, respond to disruptions and maintain trust in the stability of financial markets.