Payment resiliency is even more critical in an era of geopolitical uncertainty

The impact of geopolitical tensions is no longer a distant risk for organisations managing payments and global trade. Sanctions, economic ripple effects and heightened risks of cyber threats linked to state actors are placing pressure on systems that move money and goods. 

For financial institutions and their clients, the implications extend well beyond market volatility. Disruption can affect trade corridors, reshape capital flows, and introduce new risks across payment networks and the technology infrastructure that supports them. For businesses with international exposure, even relatively small delays can affect liquidity and create downstream operational risks. 

This has made operational resilience a business-critical capability. Organisations now need to maintain continuity in an environment where issues can emerge quickly, spread across connected systems and affect customers, counterparties and infrastructure simultaneously.

According to the World Economic Forum's 2025 Global Risks Report, state-based armed conflict is now considered the most significant immediate global risk facing organisations worldwide . Cyber threats are also growing in sophistication and speed, fuelled by advances in artificial intelligence and heightened international tensions.

In payments, these factors are changing the standard. It is no longer enough to recover when something goes wrong. Financial institutions need the architecture, operating models, and industry coordination to keep critical services available while conditions around them shift. 

As Barry Parker, General Manager, Payments Technology and Operations at Commonwealth Bank of Australia, explains, payments are “one of the most interconnected capabilities in the global economy. That interconnection is a strength, but it also means resilience has to extend beyond individual systems and institutions.” 

This requirement is reshaping how financial institutions design and operate their payments capability.

Readiness as a strategic differentiator

Historically, operational resilience was often treated as a defensive discipline, centred on risk management, as well as disaster recovery and business continuity planning.

That mindset is evolving. As payments become increasingly digital, real-time and global, customers expect uninterrupted access. Reliability is now closely tied to trust and forms part of how organisations are assessed over the long term. It has also become a source of competitive strength, reflecting a shift in how financial institutions now compete. 

Parker is unequivocal on this point, noting that it is “no longer simply a risk management exercise,” but increasingly a competitive advantage, shaped by customer expectations for systems to remain secure, available and responsive regardless of disruption. 

The regulatory landscape reinforces this shift. In Australia, APRA's CPS 230 Prudential Standard  places greater emphasis on identifying critical operations, strengthening contingency planning, and more effectively managing third-party dependencies.

For Commonwealth Bank, this regulatory focus aligns with the approach already underway. As Parker explains, “this hasn’t been a big shift for us, where we’ve had to say, ‘how are we going to get there?’. It’s actually just reinforced the direction we’re already moving in.”

Sustained investment in payments technology and operational resilience has contributed to fewer incidents and faster recovery times, reinforcing the bank’s ability to deliver consistent service under pressure. 

Building defences across an interconnected ecosystem.

Modern payments systems depend on a wide network of institutions, infrastructure providers, technology platforms, and payment schemes. That network enables efficient movement of funds across markets and jurisdictions, but it also means disruption is rarely contained to a single organisation. 

A cyber incident, infrastructure failure, sanctions change or shift in international operating conditions can create pressure across multiple points in the system at once. In this environment, resilience requires clear contingency planning and active coordination across the broader payments ecosystem. 

Australian financial institutions and industry participants are working collectively to strengthen the continuity of critical payment services. The goal is to ensure customers can continue to transact even when an individual institution, provider, or network faces significant interruptions.

Commonwealth Bank contributes to this work through industry-wide planning and capability development to maintain service continuity for customers. This includes strengthening contingency arrangements and exploring how institutions can support customers of impacted entities in the event of a major outage. 

As geopolitical instability and cyber risk intensify, this coordinated approach is becoming increasingly important. After all, confidence in the financial system depends on both the resilience of individual institutions and the ability of the wider payments system to withstand and recover from adverse issues. 

Technology architecture designed for disruption

Cloud-based environments can provide greater flexibility, scalability, and redundancy than traditional infrastructure, helping organisations maintain services when individual systems, networks or providers come under pressure.

At Commonwealth Bank, ongoing investment in modern technology platforms is strengthening reliability across critical banking and payments infrastructure, while enabling faster delivery of new capabilities.

Parker says these investments are delivering measurable results. Within payments technology, the bank has significantly increased the volume of technology change delivered while reducing delivery times, reflecting the impact of modern engineering practices and innovation.

This increased pace allows new capabilities to be deployed more quickly, while also improving the speed and effectiveness of responses to emerging risks. For customers, this translates into more reliable services, faster issue resolution and fewer disruptions to payment flows, particularly in complex cross-border environments. 

The role of AI in both attack and defence

Nowhere is the impact of technology on resilience strategies more evident than in artificial intelligence. While much of the conversation across financial services has focused on efficiency and cost, Parker points to a broader strategic capability. 

“We don’t see AI as purely an efficiency play,” Parker says. “We see this as the next frontier of technology capability.”

AI is already being deployed across banking to support cybersecurity, fraud detection, operational monitoring, and incident response. These are all areas that are becoming more complex as threat actors adopt the same advanced tools and new techniques.

Within payments, AI is helping identify vulnerabilities earlier, detect unusual activity in real time, and automate responses that previously required manual intervention.

Use cases such as real-time exception handling are helping resolve issues like incorrect payment details, while pre-validation of cross-border payments is reducing the likelihood to scams, failed transactions or errors by identifying issues before payments are sent.

At the same time, the rapid evolution of AI is increasing the sophistication of emerging threats, creating new risks alongside these advancements. 

“The pace of change in AI is creating both opportunity and risk. The organisations that succeed will be those that can use AI to move faster, strengthen defences, and respond to emerging threats in near real time,” Parker says. 

This shift is redefining the response window. Where cyber threats once evolved over months, attack windows are now measured in days, or even hours. 

Preparing for a more fragmented future

International geopolitical volatility is unlikely to ease in the near term. Economic fragmentation heightened cyber activity, and competition between nation-states are creating a more demanding operating environment for payments networks and the businesses they support.

In this context, resilience needs to extend beyond traditional risk frameworks. It must be built into technology architecture, cyber defence, operational processes, third-party management, and industry collaboration.

"Operational resilience is about more than recovery. It's about maintaining confidence, supporting customers, and ensuring critical economic activity can continue even when conditions become very challenging," Parker says