Why is operational resilience now a macro concern?

The short answer

Until recently, “operational risk” lived in a footnote of bank annual reports next to legal expenses and IT outages. The supervisory framework treated it as something firms manage internally, with capital buffers calculated under Basel formulas designed for failure-mode losses, not cascading network disruptions.

That framing has not survived contact with reality. The 2017 NotPetya cyber attack cost Maersk an estimated $300 million; the 2021 SolarWinds and Colonial Pipeline events showed how third-party software supply chains create attack surfaces; the November 2023 ICBC Financial Services ransomware revealed that even a relatively small subsidiary, when positioned at the right point in the Treasury settlement chain, could disrupt one of the deepest markets in the world.

Regulators—the Fed, the Bank of England, the ECB through DORA—have responded with new operational resilience frameworks that explicitly recognize this network dimension. The macroprudential question is whether these frameworks are sufficient given the actual topology of modern financial infrastructure.

→ New to systemic risk frameworks? Systemic risk framework

What the data shows

The November 2023 ICBC Financial Services event provides the clearest empirical case of operational risk turning macro.

The empirical picture (Treasury Department, BNY Mellon disclosures, SEC settlement December 2024):

• Attack vector: LockBit ransomware affiliate exploited a recently disclosed Citrix vulnerability (CitrixBleed) to encrypt ICBC Financial Services systems on November 8, 2023
• ICBC FS scale: only $24.5 billion in assets—not a top-20 broker-dealer—but positioned as a key intermediary in US Treasury repo and clearing
• Emergency response: $9 billion capital injection from ICBC headquarters in Beijing to cover unsettled Treasury trades at BNY Mellon, the clearing bank
• Market impact: Treasury repo fail volume rose to $62.2 billion in the week of the event—a multi-year high—and Treasury cash market liquidity briefly tightened
• Treasury market scale: roughly $26 trillion in outstanding US debt; daily Treasury volume averages over $700 billion. ICBC FS represented a tiny direct share but a critical processing node
• SEC settlement (December 2024): ICBC Financial Services agreed to settle without civil penalties, citing cooperation; the SEC noted the firm had failed to maintain adequate cyber and operational controls

The exception is the broader pattern: most cyber incidents at financial firms remain contained to the firm itself; the ICBC case is meaningful precisely because it crossed the threshold from firm-level to system-level disruption.

→ Dataset: Financial Conditions Index

Why it happens — the macro mechanism

The transmission of an operational disruption from a single firm to a market segment runs through three structural channels.

Critical-node positioning. Modern financial markets depend on a small set of clearing banks (BNY Mellon and JPMorgan in US Treasury and tri-party repo), central counterparties (DTCC, CME, ICE), payment systems (Fedwire, CHIPS, TARGET2) and messaging utilities (SWIFT). Even small firms that interact directly with these nodes can disrupt their throughput. ICBC Financial Services was small in balance sheet but critical in Treasury settlement—and the disruption propagated immediately.

Time-criticality and irreversibility. Financial transactions have hard settlement deadlines (T+0, T+1, T+2) and irreversible consequences once executed. A ransomware attack that prevents ICBC from confirming Treasury trades for 48 hours forces counterparties into fail-to-deliver status, triggers margin calls at clearinghouses, and can cascade into liquidity stress at firms that depended on the failed settlements. The angle most coverage misses: in operational risk, network position trumps balance sheet size as a measure of systemic relevance—a $24.5 billion broker-dealer disrupted a $26 trillion market because of where it sat in the settlement plumbing.

The cyber-physical convergence of cloud computing, third-party software dependencies and shared infrastructure (Microsoft Azure outages, Crowdstrike kernel update July 2024) compounds this exposure.

Recovery cost and coordination. The cost of recovering from a disruption is not paid only by the affected firm. Counterparties bear timing and funding costs; central banks may need to provide liquidity bridges; regulators face compressed decision windows. As discussed for shadow banking, the regulatory framework was designed for a different topology of risk.

Synthesis by regime. In stable regimes (most of the post-2010 period through 2022), operational events at individual firms occurred regularly but did not propagate to markets; supervisory attention focused on firm-level resilience. In stress regimes (NotPetya 2017, ICBC 2023, Crowdstrike July 2024), the same operational events propagated through interconnected infrastructure, requiring central bank or large bank emergency response. The pivot is typically a coincidence of firm-level disruption with critical-node positioning, not a macro shock; the lesson is that operational risk is now correlated with market structure, not independent of it.

A $24.5 billion firm disrupted a $26 trillion market because position in the network—not assets on the balance sheet—is what now defines systemic relevance.

→ Framework: Financial innovation, market infrastructure & systemic risk

What it means for different economic actors

Banks and broker-dealers. The Bank of England’s Operational Resilience policy (effective March 2025), the Fed’s Heightened Standards (2014, updated 2022) and the EU’s Digital Operational Resilience Act (DORA, applicable January 2025) require firms to identify “important business services,” set “impact tolerances,” and stress-test capacity to maintain those services through disruption. Compliance costs have risen substantially.

Critical infrastructure providers. DTCC, CCPs, payment systems and messaging utilities have always been recognized as systemically important, but the layer of cyber and operational risk has gained new attention. The UK’s Financial Market Infrastructure Act 2023 explicitly extends Bank of England oversight to critical third-party providers (cloud and software vendors).

Insurers and pension funds. Cyber insurance markets have hardened materially since 2020 as ransomware claims rose. Coverage exclusions have expanded; some pension funds have stopped including cyber insurance in their risk-transfer strategies. The systemic-risk question is whether the residual risk is being held in the right places.

A common error is to treat cyber and operational risk as primarily a firm-level compliance topic. The ICBC episode displayed how it can become market-level rapidly when a node sits in critical infrastructure.

Practical observation

Go deeper

Related questions

• What is shadow banking?
• Risks of algorithmic trading dominance?
• What are prime brokerage arrangements?
• Why do repo markets matter for financial stability?

Frequently asked questions

How did a $24.5 billion firm disrupt a $26 trillion market?

ICBC Financial Services was small in balance sheet but operated as a major intermediary in US Treasury repo and clearing, particularly for trades involving Asian counterparts. Its connection to BNY Mellon (the dominant US Treasury clearing bank) and to Treasury cash and futures markets meant that a 48-hour operational outage prevented confirmation of trades that other firms had counted on settling. Repo fail volume rose to $62.2 billion in the affected week, and ICBC’s parent had to wire $9 billion from Beijing to Bank of New York Mellon to cover positions. The episode was contained because the disruption ended within days; a longer outage at the same node would have produced more visible market stress.

Why was operational risk previously treated as firm-level rather than macro?

The Basel framework’s operational risk capital charge (under Basel II’s Advanced Measurement Approach, then Basel III’s Standardized Approach) was designed to absorb expected and unexpected losses at a single firm—legal expenses, IT outages, fraud. Network propagation was implicitly assumed to be either limited or addressed through firm-level resilience. The post-2017 wave of cyber events (NotPetya, WannaCry, SolarWinds, Colonial Pipeline, Crowdstrike, ICBC) revealed that this assumption holds in many cases but breaks down when a firm sits at a critical infrastructure node. Regulatory frameworks (UK Operational Resilience policy 2022-2025, EU DORA 2025, Fed/OCC heightened standards) have evolved to address this.

Are cloud providers and third-party software now systemically important?

Increasingly so. The July 2024 Crowdstrike kernel update incident grounded thousands of flights, took down hospital systems, and affected financial firms globally; the ICBC LockBit attack used a Citrix vulnerability. The UK’s Financial Services and Markets Act 2023 (Part 9) gives the Bank of England powers to designate “critical third parties” for direct supervision, and the EU’s DORA includes parallel mechanisms. The macroprudential question is whether oversight of cloud providers (AWS, Microsoft Azure, Google Cloud) and software vendors (Microsoft, Oracle, Salesforce, Crowdstrike) has caught up with their actual systemic role—the answer remains contested.

Last updated — 23 July 2026