ECB's Target2 down for 11 hours. Now what?

On Friday 23^rd of October, the European Central Bank Target2 system collapsed for eleven hours, leaving commercial banks critically exposed and unable to serve their customers through institutional rails. While another page in payments’ history has been written, we have looked beyond the headlines and analysed two takeaways that banks should keep in mind for their future strategies and plans. In this article you will also find some tips on how to implement these lessons learnt.

What has happened?

On Friday 23^rd October at 14:40 CET, the worst nightmare for commercial banks became reality: Target 2 (TG2) went down for about eleven hours. No electronic Euro payment whatsoever was settled for 11 hours, and that included Target2, True Instant Payment Settlement (TIPS), Single European Payment Area (SEPA) and EURO1/STEP1 payments. Liquidity movements were also put on hold.

Commercial banks could not serve their customers through the institutional rails and were unaware of their liquidity positions. This left them seriously exposed, with some banks accumulating transactions in double-digit Billions.

Every cloud has a silver lining and, at least, the “major incident”, as the ECB called it, happened on a Friday afternoon when payments traffic is meant to be slower and when there is actually more time to recover from the situation as Target2 system is closed over the weekend (with the exception of TIPS)!

While the cause of the incident remains unknown and currently under investigation (the ECB have so far confirmed that the root cause has been found in a software defect of a third party network device), there are already two lessons that we should learn:

• Operational resilience must be at the centre of your Payment strategy and be treated as a business outcome;
• Banks must avoid the single point of failure and follow the evolution of alternative rails

Let’s delve in each of them.

Target2 Failure: why Operational Resilience must be at the centre of your Payment strategy

If the pandemic or a global scandal like Wirecard’s had not been enough, the ECB went the extra mile to teach us the importance of preparedness. The most reliable system on earth stopped working. But that is not all. Target2 back-up systems also failed to respond! 

So lesson number one is: operational resilience must be at the centre of your strategy and must not be treated as a compliance requirement only. Banks need to look at their entire operating model and understand how they can effectively manage their Operational Resilience strategy and third party risks. In a nutshell, to carry on serving their customers in every single circumstance, even in a middle of an external “black swan” event, they should:

• Identify critical business services 
• Set impact tolerances – what level of disruption can that bank's critical processes take before it impacts customers, threatens firm viability, causes financial system instability or all the above?
• Identify the plausible but severe scenarios, including extremely rare events that may have severe consequences
• Define plans to rigorously test these scenarios and address gaps
• Rehearse these responses through war game simulations
  
  

ECB’S major incident teaches banks to look at alternative rails

Let’s travel in time to 2025. The European Payment Initiative (EPI) is live and leverages the SEPA Instant Payments and TIPS infrastructure. The EPI has also replaced national schemes such as the iDEAL in the Netherlands and competes with private card processors such as Visa and Mastercard. The European retail payment strategy has been executed and now "instant payments are the new normal".

Now, let’s imagine that the Target2 failure incident happens. The consequences would be distressing! Banks’ customers’ lives would be dramatically impacted. People would be left with no other payment means than cash – and who has cash in in their pockets in 2025? No one!

The impact of the incident on the EPI direction of travel is yet to unfold. However, this imagination exercise takes us to lessons number two: banks need to think about out of the box solutions. In practice, banks should start to:

1. Monitor the market
2. Understand available alternative rails, in other words solutions that don't rely on institutional rails at all, like RTGS global
3. Be prepared to integrate them in their infrastructure
   

This can be very challenging in the current environment where operational costs must be reduced, and where banks often lack an open, strong, and modular architecture. Today, there are limited alternative solutions and, except for a very few truly global banks, most of the private clearers still rely on Target2. However, the market is changing rapidly. Even Mastercard and Visa are now taking serious interest in electronic payments, due to the development of overlay services. Maybe, it is also time for the European Central Bank to step in and catalyse even more private alternatives in this space to avoid a single point of failure.

With more than 18 years in financial services, RedCompass Labs can help you to define, implement and test your payments and operational resilience strategy so that situations like the Target2 incident are anticipated, and your customers and reputation are no longer impacted. To engage with us and discuss your situation, please feel free to reach out to us.