How Banks Stay in Business When Everything Breaks at Once

In payments, disruption used to be something you cleaned up afterward. A system went down, a batch stalled, fraud spiked, and someone pulled a disaster recovery binder off the shelf to get back to normal.

That world is gone.

With real-time payments, tighter liquidity, and more sophisticated threats, the central question is no longer how quickly you can recover. It is whether you can keep operating when several things go wrong at once. Institutions that can keep payments flowing will not just avoid trouble. They will earn trust and win business.

That was the theme of Bottomline’s webinar on operational resilience, moderated by Zhenya Winter, Head of Global Marketing for Financial Messaging. Winter pointed to cyberattacks that isolate core systems, economic shocks that squeeze liquidity, rail outages that expose hidden dependencies, and geopolitical events that affect entire regions. Customers expect payments to clear. Regulators want evidence. Boards want reassurance.

Winter was joined by Manit Mehra, Managing Director at Accenture; Mike Chambers, CEO of Payments Unpacked; and Natasha Lapierre, Global Head of Product Strategy and Innovation, Financial Messaging at Bottomline.

When Fraud Takes Down Systems While Stealing Money

Chambers began with historical insights. “In the old model fraud just sat in a finance department as a risk,” he said. It was priced into products and absorbed through the P&L. Losses appeared as “numbers in an annex,” while “underneath that, the rails just kept running.”

That separation has disappeared.

Real-time infrastructure has, as Chambers put it, “killed the buffer zone.” There is no overnight gap to review anomalies. “With fraud detection, you had a bit of space and a bit of time to deal with it,” he said. “It has to be in line now. It has to be at transactional speed.”

Mehra added that institutions now operate in a world of “real-time payments, 24x7 payments, and customers [who] do not want any disruption.” Same with regulators.

Attack patterns have shifted, unquestionably. Chambers said AI-enabled social engineering “is scaling fraud, and that fraud is attacking the volume of payments, not just the value of payments.” That pressure falls on “operational capacity, call centres, authentication systems” as much as on the balance sheet.

He also warned that “ransomware defense and fraud defense share a common failure mode. The danger is that one incident can take down all systems.”

Regulators increasingly view fraud “not as the set of numbers on a P&L…but as an operational resilience event.” If detection windows collapse, alert volumes outpace capacity and controls are limited to block-or-allow decisions. An institution may have little choice but to pause an entire channel.

The better approach is ‘graduated response.’ Chambers argued that the differentiator is “how you deal with errors and to fraud attacks in a graduated response rather than a binary approach.” Lapierre agreed, saying the goal is to catch risky payments during the transaction through “graduated responses” that avoid “pulling the plug or stopping the payments being made.”

AI can improve hit rates, triage alerts, and orchestrate data more intelligently. But governance has to keep up. Chambers said regulators want to know, “Where are your visible human overrides, and are they transparent and auditable” rather than in a black box.

If fraud is treated purely as a cost, tools will protect margin. If it is treated as a resilience event, tools will protect the institution’s ability to keep operating.

Audience Poll

AI Will Not Save You from Silos

The panel then turned to AI. Lapierre said “the usage of AI for operational resilience is often understated.” The main constraint is not the models, but the environment in which they operate.

She described AI’s strengths as “processing huge amounts of data at record speed,” orchestrating data intelligently, “detecting patterns and trends over time, and “detecting unknowns.” Used well, it can help institutions move “from reactive processing to proactive monitoring of signals early on, including unknown unknowns.”

But she added that “AI cannot thrive on fragmented data.” An anomaly may be visible across several platforms, rails or regions without ever becoming a coherent signal. Winter stressed the need for an “end-to-end view of all the data” so that teams focused on one rail also understand what is happening elsewhere on alternative rails.

Lapierre identified two priorities.

First, platforms must support resilience at real-time speed. That means “24/7 active-active sites,” recovery objectives aligned with instant payments, and remote recovery protocols that allow institutions to switch capacity “in minutes or even quicker.”

Second, continuity should be built through “a single integration and orchestration layer that provides seamless switchover in such a way that adding or losing a rail becomes a configuration change.” In that model, “rail independence would be optionality, not fragmentation,” giving banks agility without adding complexity.

Platforms such as Bottomline’s Global Pay Connect provide that connectivity and data layer, with AI capabilities built on top. When incidents and exceptions are visible in one place, intelligence can surface early warnings instead of downstream alerts.

AI can strengthen resilience, but it cannot repair fragmented architecture. Without unified, observable data across rails and regions, even the best tools will miss critical signals.

Resilience When Whole Regions Go Dark

Mehra widened the discussion to geopolitics and physical risk. Traditional planning focused on “very localised disruption,” such as a data centre outage or an inaccessible on-prem system. Many institutions still rely on disaster recovery playbooks written “ten, fifteen years ago” that were never properly tested.

Today, wars, sanctions, supply chain disruptions and fragmented regulation can make “entire geographies become inaccessible.” Mehra said institutions must shift “from a location-based recovery strategy to capability-based resilience,” giving the ability to continue critical services “regardless of location, provider, or jurisdiction.”

The panel highlighted specific priorities.

One is to design resilience from the start. “Resilience never used to come naturally” in payment system design, Mehra said, and was often “an afterthought.” Today, resilience by design may require multiple cloud environments, providers or regions, multiple payment rails and greater redundancy. This, like most of these steps, is often farmed out to PSPs.

Second is automating failover, not just testing. Many firms “stop at test automation,” Mehra added, but remain reluctant to automate cutover. He described a client where “with the click of a button, a single pipeline” could drive failover. “It is possible, we have customer who have done it, but people are just scared to do it.”

Third, test for tomorrow’s problems, not yesterday’s. Chambers said organisations often “still model yesterday’s crisis and not tomorrow’s.” The relevant questions now are: What if war starts in the region? What if multiple incidents happen at once? What if a third-party facility becomes unavailable?

Supervisors are already moving in this direction. Chambers said regulators are “looking for evidence, not documentation,” and that “a thick self-assessment file does not deliver resilience in itself.” Common weaknesses include poor third-party mapping, narrow scenario testing, and stale assessments. Accountability sits with the board, while instant payments leave little room to fix problems before customers feel them.

Winter closed by asking whether organisations are strengthening resilience because regulators require it or because they genuinely want to serve customers better. Chambers favoured the latter: “I would rather we all work together to serve people better than do stuff because the regulator tells us we must.”

Operational resilience has moved from a side project to a core strategy. Institutions that treat it as a competitive capability will keep moving money, keeping promises and earning trust when the next disruption hits.

Watch the full webinar