In a timely talk, Bottomline hosted a ‘Meet the Experts’ panel session at Sibos 2026 called Beyond Disaster Recovery: Can AI and Alternative Rails Keep Payments Moving Under Extreme Stress? Joining were representatives of PwC, JP Morgan Chase, Regions Bank, and Chainlink, all to debate the question: what happens to payment operations when the assumptions behind traditional disaster recovery no longer hold? 

The topic is highly relevant now as operational resilience has become a top priority across financial services. Regulators are raising expectations, institutions are investing heavily in cyber resilience and business continuity, and operational failures carry more serious financial, reputational and regulatory consequences than ever. 

Beneath that activity lies an uncomfortable reality. Bottomline's Payments Intelligence Gap research found that 0% (that’s not a typo) of more than 300 surveyed banks and financial institutions described themselves as very confident that they could continue processing critical payments during a major disruption, while 47.5% identified third-party, connectivity and concentration risk as their greatest operational resilience challenge. Only 14% considered themselves advanced in AI integration.

Research and the insights shared on the Meet the Experts panel expose a growing disconnect that I want to explore in this article. Operational resilience has never received more investment, yet confidence remains startlingly low. The question is whether many resilience programmes have been designed for a world that no longer exists. 

On the panel, my colleague Edward Ireland, Product Director for Financial Messaging at Bottomline highlights “It's not simply about disaster recovery anymore. It's about maintaining secure, trusted payment execution when established processes or rails are under extreme stress.”

As payment ecosystems become more interconnected and real-time, many institutions are discovering that traditional resilience assumptions are no longer sufficient.

 

Assumptions Behind Traditional Resilience are Breaking Down

For decades, resilience strategies focused on recovering from failure. A system outage occurred, a recovery plan was activated and operations were restored. That model worked reasonably well when disruptions were isolated to a specific application, data centre, or organisation.

Panellists agreed that today's environment is fundamentally different. Cyber threats are targeting availability rather than data. Economic uncertainty compresses liquidity decisions into minutes. Geopolitical instability introduces new sanctions obligations at unprecedented speed. Third-party providers have become critical components of payment operations, while cloud concentration risk continues to grow.

PwC’s Yulia Baynham, Director, UK Financial Services Consulting, said this environment demands extra rigor. “With documentation being prepared and done, has the stress situation been really tested,” she said. “It needs to go all the way to the technology providers and beyond that perhaps to the cloud providers.”

Many institutions have strong resilience frameworks on paper. Far fewer have tested whether critical payment services can survive disruption across the technology and infrastructure ecosystems on which they depend. Operational resilience is no longer an organisational challenge. It is an ecosystem challenge.

 

From System Recovery to Payment Continuity

The panel also concurred that banks and FIs may need to rethink how they define resilience. The objective is no longer simply to restore systems after disruption. It is to maintain trusted payment execution while disruption is still unfolding.

That may sound like a subtle distinction, but it represents a fundamental shift in thinking. A resilience strategy designed around recovery asks how quickly systems can be restored. A resilience strategy designed around continuity asks how payments can continue moving safely while events are still developing.

It’s an important change in the wind because payment ecosystems are moving towards real-time operation, 24/7 availability and instant customer expectations. Recovery windows are shrinking while expectations continue to rise.

In conversations with banks over the past year, I have noticed a significant change in tone. Institutions are no longer asking whether they can recover from disruption. They are asking how to maintain payment execution when sanctions change overnight, a key supplier fails, fraud attacks intensify, or several operational issues occur simultaneously. That is a very different resilience challenge.

 

Why AI is Emerging as a Resilience Technology

Much of the industry's AI debate focuses on productivity, efficiency and automation, and that fact also came across during the discussion, as a more important question emerged: How effective is AI becoming as a resilience technology?

“Fraud is obviously a prevalent use case, a pioneering use case,” for AI, said Natasha Lapierre, Global Head of Product Strategy and Innovation – Financial Messaging at Bottomline.[WZ1.1] “We can also think about some off-flow operational monitoring use cases that are really happening today.”

Across fraud prevention, anomaly detection, operational monitoring and alert prioritisation, AI is already helping institutions identify risks faster and process large volumes of information more effectively than traditional approaches.

The real value is confidence. During periods of disruption, AI can help teams distinguish genuine threats from operational noise, prioritise actions and continue processing legitimate payments instead of halting activity unnecessarily. Despite the pace of innovation, however, the industry remains some distance from fully autonomous payments. 

Joseph Massie, VP, Treasury Management Product Development was clear - “Regions Bank is on the path to creating fully autonomous payments, but we are at the very early stages. We're not in a position currently where we can just avoid that human oversight.” [OM2.1][WZ2.2]

Human judgement remains essential. The institutions seeing the greatest benefits today are combining AI-driven insight with strong governance, explainability and human oversight. Rather than replacing decision-makers, AI can help them make better decisions under pressure.

 

The Next Risk May be AI Itself

If AI becomes critical to operational resilience, what happens when AI fails?

As PwC’s Yulia Baynham observed, “AI is just another system. The principles of operational resilience need to be applied to that too.”

As AI becomes embedded in critical decision-making, institutions need to think beyond how it strengthens resilience and consider what happens when those systems fail. The governance, testing and contingency planning applied to other critical systems must increasingly extend to AI-driven decisioning.

 

Concentration Risk is Becoming a Strategic Threat

Global payment operations have become deeply dependent on interconnected providers, infrastructures, cloud environments and networks. Those ecosystems have delivered efficiency and scale, but they have also created new forms of systemic vulnerability.

What I hear most often from payments leaders is not concern about a single point of failure. It is concern about an expanding web of interconnected dependencies that sit beyond their direct control. 

As JPMorgan Chase Managing Director Savio Saldanha put it, “Every time you think you know or you've seen all the scenarios, a new one pops up.”

Success will depend less on predicting every possible disruption and more on building operational models that can adapt when the unexpected occurs. “The thing with blockchain is everyone runs the server. So, when you think about disaster recovery, the system is always reconciled and running,” said panelist Ryan Lovell, Director of Capital Markets at Chainlink Labs.

Whether institutions adopt blockchain-based settlement models or not, the broader lesson is that resilience is increasingly being engineered into infrastructure itself rather than relying solely on recovery processes. The reflex to concentration risk is often to add more providers, more infrastructure and more contingency layers. But complexity and resilience are not the same thing.

“The instinct is to meet concentration with fragmentation, but what banks actually want to achieve with fragmentation is optionality,” according to Bottomline’s Lapierre.

The institutions best positioned to succeed will be those that create genuine optionality: the ability to switch payment routes without compromising visibility, control or customer experience.

 

What We're Hearing from Banks

Resilience discussions are moving beyond operations and technology teams. They are becoming strategic conversations involving executive leadership, risk functions and boards, because the consequences of failure now extend far beyond technology.

Bottomline's perspective is shaped by decades of experience supporting payment operations and financial messaging across the global banking ecosystem. That vantage point gives us a clear view of how these pressures are evolving as payment infrastructures become more interconnected.

Payment leaders are dealing with a combination of pressures that rarely existed together in the past: real-time payment expectations, rapidly changing sanctions regimes, AI-enabled fraud, growing cloud concentration risk, and greater dependency on third-party providers.

Given these facts, the future resilience strategies should be built around four capabilities:

  • End-to-end operational visibility
  • AI-assisted decision intelligence
  • Interoperability across payment ecosystems
  • Payment rail optionality

Institutions that develop these capabilities will be better positioned to maintain trust, control and continuity as the external environment changes. Operational resilience is becoming a strategic differentiator, not simply a regulatory obligation.

 

The Question Every Financial Institution Should Ask

Perhaps the most important question facing financial institutions today is also the simplest: What assumption in your resilience strategy is most likely to fail under real stress?

For many financial institutions, the answer may be uncomfortable. It may involve assumptions about third-party availability, recovery windows, AI or the stability of the wider ecosystem itself.

Payments are becoming more interconnected, more real time, and more dependent on organisations, infrastructures and technologies that no individual one FI fully controls. That changes the resilience equation.

For years, operational resilience focused on recovering from disruption. The next generation of resilience strategies will focus on operating through it.

Panelists agreed organisations that succeed will not necessarily be those with the largest budgets or the most sophisticated recovery environments. They will be the institutions that can maintain visibility across their ecosystems, make confident decisions under pressure and adapt quickly when conditions change.

Customers don’t care if an outage originated with a cloud provider, a payment rail, an AI model, or a third-party supplier. They care whether the payment arrives. That is why resilience is no longer simply an operational, technological or regulatory issue. It is a business issue.

Ultimately, the institutions that thrive will be those that recognise a simple reality: The next crisis is unlikely to look like the last one. The real risk is discovering that your resilience strategy was built for yesterday's crisis, not tomorrow's.