Banks today are not just financial institutions; they are pillars of societal stability. In recognition of this, regulators are raising the bar. The EU’s Digital Operational Resilience Act (DORA) represents a shift from simply having plans on paper, to demonstrating their effectiveness in practice. Financial institutions must demonstrate, with tangible evidence, that they can withstand and recover from severe disruptions to protect customers, markets, and society at large.

But what if a regional power outage disabled your data centre for 24 hours? What if a ransomware attack encrypted your customer data, leaving your team locked out of essential systems? What if a critical third-party provider suffered an outage, impacting your ability to process payments? These are the kinds of scenarios that are happening every day and which customers, and boards are demanding answers for.

Resilience is more than a checklist or a compliance exercise. While robust cybersecurity and availability remain essential, true resilience means being able to continue delivering critical services, such as payments and customer access, even when core systems are compromised. Successful risk management is a holistic approach which requires the integration of technology, processes, people, and culture and one that can be measured through specific metrics and KPIs that assess readiness and recovery capabilities.

One approach which is gaining traction is the concept of a ‘backup bank.’ This is the creation of a fully functional, parallel system that can take over critical operations in the event of a major disruption. It’s an approach Monzo has taken with Monzo Stand-in, a separate banking infrastructure to take over from their primary platform in the event of an outage.

While this might appear to be a significant investment at a time where cost efficiency is front of mind, banks don't have to tackle this challenge alone. Partnerships with technology providers and industry experts, such as Mambu and Deloitte, can provide valuable insights and solutions.

Financial institutions working with legacy systems and siloed processes undoubtedly face real challenges in building resilience, but driving meaningful change is still possible. By embracing modern, multi-core, composable platforms, banks can overcome complexity and gain the agility needed to adapt, recover, and innovate. In turn, creating more adaptable, resilient systems that are better equipped to manage unforeseen challenges.

Meanwhile, banks that have already adopted modern, composable architectures are better positioned to innovate, respond to disruption, and meet evolving cybersecurity demands. Regardless of where they begin, all banks must and can take steps toward greater resilience and agility.

Wherever you are on the journey, one thing is certain: the next disruption won’t be the last. Now is the time to assess your readiness, question old assumptions, and invest in solutions that keep your services running, even when challenges arise. What can you do to move from asking yourself ‘what if’, to ‘we’re ready’? Here are some pointers to get you started.

At Deloitte, we believe resilience is a collective responsibility and a source of strategic advantage. Regulatory compliance is a starting point, not the finish line, and financial institutions that invest in operational resilience not only reduce risk and regulatory exposure, they also build trust with customers, strengthen their reputations, and gain a competitive edge in a world where disruption is the new normal.

Author: Lourens Bordewijk - Partner, Deloitte Netherlands