CPMI-IOSCO consults on a cyber-resilience toolkit for payment infrastructure

Sourced news briefing

Bank for International Settlements, CPMI-IOSCO published the development on 8 September 2026. CPMI and IOSCO published a consultative cyber-resilience toolkit for financial market infrastructures. The toolkit is intended to support implementation of cyber-resilience elements in the Principles for Financial Market Infrastructures. It contains voluntary and non-binding practical considerations. The publication accompanies a discussion paper on reliance on third-party service providers. Comments are requested by 1 December 2026.

This briefing reports only the source announcement. The consultation is addressed to financial market infrastructures and does not create a new merchant certification or replace applicable security obligations. The remaining sections are independent FixPays analysis for merchants; they are not claims made by CPMI-IOSCO.

Independent analysis: map merchant dependencies

Merchants may not operate financial market infrastructure, but their payment continuity depends on acquirers, gateways, clouds, fraud tools and bank connections. Identify critical services and concentration. Document recovery assumptions. Test manual and alternate procedures. For implementation, name an accountable owner, the authoritative system, the exception route and the evidence retained after each decision.

A dependency map should name service, data, recovery target, owner and last test result. Review the arrangement by entity, market, currency, payment method and customer journey where those dimensions matter. A provider announcement cannot replace contract review, testing or a documented assessment of the merchant's actual operating model.

Independent analysis: prepare for coordinated incidents

Cyber events can produce uncertain authorization, duplicate retries, delayed settlement and fraudulent account changes simultaneously. Protect payment and payout changes. Freeze unsafe retries. Reconcile before resuming. For implementation, name an accountable owner, the authoritative system, the exception route and the evidence retained after each decision.

Exercises should preserve timelines, decisions, transaction populations, customer messages and financial corrections. Review the arrangement by entity, market, currency, payment method and customer journey where those dimensions matter. A provider announcement cannot replace contract review, testing or a documented assessment of the merchant's actual operating model.

Independent analysis: govern third parties

A supplier assurance report is useful but cannot show whether the merchant configured, monitored and can exit the service safely. Review shared responsibilities. Track subcontractors and incidents. Test export and transition procedures. For implementation, name an accountable owner, the authoritative system, the exception route and the evidence retained after each decision.

Vendor files should connect contractual duties, technical controls, monitoring and remediation. Review the arrangement by entity, market, currency, payment method and customer journey where those dimensions matter. A provider announcement cannot replace contract review, testing or a documented assessment of the merchant's actual operating model.

Independent analysis: merchant implementation checklist

Build a current map of critical payment dependencies. Connect that control to the dependency map and retain the result in a resilience test. Test a successful transaction and a realistic failure, then record what changed, who approved the response, how customers were treated and whether finance could reconcile the final outcome.

Test recovery and reconciliation together. Connect that control to the incident timeline and retain the result in a vendor assessment. Test a successful transaction and a realistic failure, then record what changed, who approved the response, how customers were treated and whether finance could reconcile the final outcome.

Protect bank and wallet destination changes. Connect that control to the settlement ledger and retain the result in an incident decision log. Test a successful transaction and a realistic failure, then record what changed, who approved the response, how customers were treated and whether finance could reconcile the final outcome.

Review third-party concentration. Connect that control to the recovery procedure and retain the result in a remediation tracker. Test a successful transaction and a realistic failure, then record what changed, who approved the response, how customers were treated and whether finance could reconcile the final outcome.

Define customer communication ownership. Connect that control to the dependency map and retain the result in a resilience test. Test a successful transaction and a realistic failure, then record what changed, who approved the response, how customers were treated and whether finance could reconcile the final outcome.

Record lessons and verify remediation. Connect that control to the incident timeline and retain the result in a vendor assessment. Test a successful transaction and a realistic failure, then record what changed, who approved the response, how customers were treated and whether finance could reconcile the final outcome.

Commercial review should cover service levels, settlement timing, data duties, incident handling, customer support, termination rights and migration assistance. Finance should model both normal volume and stressed conditions rather than relying on a headline feature or a successful demonstration.

After launch, monitor authorization, abandonment, unmatched items, reversals, refunds, complaints, fraud, support effort and settlement differences using stable definitions. Segment results sufficiently to expose a corridor, method or product that performs differently from the portfolio average.

A controlled pilot should define scope, duration, success measures, stop conditions and rollback ownership. Preserve transaction traces and customer communications so reviewers can distinguish a product limitation, integration defect, user error, provider incident and deliberate risk decision.

Finance should reconcile the dependency map with the incident timeline on a stated timetable. Unmatched items need aging, ownership and escalation thresholds. A manual journal can correct accounting, but it should never erase the original variance, the investigation evidence or the reason a difference occurred.

Customer support needs status language that reflects the underlying system rather than guessing from a single dashboard. Staff should distinguish authorization, acceptance, processing, settlement, reversal and refund, then use a resilience test to locate the authoritative reference before promising a time or outcome.

Risk teams should compare new behavior with established baselines while allowing for legitimate changes in channel and geography. Monitoring should reveal concentrated failures and unusual sequences without treating every unfamiliar pattern as fraud. Confirmed weaknesses belong in a vendor assessment with an owner and response date.

Data governance matters because a new payment route often adds identifiers, vendors and cross-border transfers. Record which party receives each field, why it is needed, how long it remains available and how an access or correction request reaches the responsible organization.

Provider due diligence should be refreshed when the product, contracting entity, settlement account or subcontractor changes. Review permissions, financial and operational dependencies, security responsibilities, complaint cooperation and termination support. Evidence should describe the current service rather than an earlier sales presentation.

A management review should combine financial, customer, risk and operational measures. Record the decision to expand, constrain, remediate or stop the flow, including dissent and unresolved assumptions. This creates an auditable link between observed performance and the merchant's continuing use of the development.

Review review follow-up resolution communication status beneficiary identity pricing data retention complaint fulfilment relevant merchant payment customer provider settlement refund dispute reconciliation risk compliance operational contractual financial technical security privacy support exception approval testing incident change ownership decision evidence implementation monitoring governance remediation continuity routing authorization conversion treasury wallet network market product corridor transaction accounting access vendor service performance audit control review follow-up resolution communication status beneficiary identity pricing data retention complaint fulfilment relevant merchant records carefully.