Tech Providers and Payment Networks: New Research on Systemic Risk

Financial stability and service providers

This Federal Reserve study by Chase Englund and Zach Modig develops a framework for assessing operational risk in payment systems by analyzing connections between banks and third-party payment service providers. The research addresses growing concerns about financial stability risks from increasing reliance on technology service providers for critical financial functions. The authors analyzed 227 connections between 215 banks and four payment products used for Fedwire transactions, using a twenty-day sample from August-September 2023. Their three-part approach included:

1. Exposure estimation: Calculated operational risk by summing mean daily Fedwire payment volumes of clients associated with each service provider.
2. Benchmark analysis: Examined correlations between payment activity and publicly available financial data (total assets, FR Y-15 reports) to develop methods for estimating exposures using accessible data.
3. Network analysis: Created bipartite network models connecting banks to service providers, then projected into firm-to-firm networks to analyze interconnectedness and identify critical nodes.

Findings

• Payment volume impact
  Payment service providers facilitate substantial daily transaction volumes ranging from tens of millions to upper billions of dollars. Given that average daily Fedwire transfers totaled approximately $4.3 trillion in 2023, some providers represent significant portions of daily payment activity.
• Benchmark reliability
  Strong correlations emerged between publicly available data and payment activity:
  – 60% correlation between total assets and payment activity across all banks
  – 90% correlation between yearly and daily payment volumes for large banks
  – Bank size significantly affects payment-to-asset ratios (large banks: 0.137, community banks: 0.026)
• Network interconnectedness
  Network analysis revealed that operational disruptions create significant secondary effects: among 23 firms most central to the payment network, only one was a direct client of the analyzed provider, demonstrating how outages can impact non-client institutions through network connections.
• Disruption assessment
  Incorporating realistic “disruption coefficients” (typically 50% payment volume reduction during outages), Englund and Modig found that a two-day outage at the largest provider could cause payment disruptions in the hundreds of billions of dollars. Timing matters critically—26% of daily volume occurs after 5:00 PM, with outages near the 7:00 PM settlement deadline posing the greatest risks.
• Implications
  The study establishes that some payment service providers facilitate volumes large enough to cause significant financial industry disruptions during outages. The authors provide practical tools for measuring operational risk exposures and demonstrate that publicly available benchmarks can effectively estimate payment activity when detailed transaction data is unavailable. This methodology offers valuable insights for policymakers and institutions seeking to understand and mitigate systemic operational risks in interconnected financial systems.

Using Service Provider Connections to Model Operational Payment Networks
Authors: Chase Englund, Zach Modig
From: Federal Reserve Board of Governors

Regulatory perspectives on service provider risks in financial systems

While Englund and Modig (the paper above) develop practical methodologies for measuring operational risk exposures from payment service providers,  this paper by Amromin et al. provides a comprehensive overview of Third-Party Service Providers (TPSP) regulatory frameworks . The authors conduct a systematic review and comparison of existing regulatory frameworks across multiple jurisdictions, examining micro- and macro-prudential approaches in the United States, United Kingdom, and European Union. They evaluate recommendations from major international bodies including the Financial Stability Board (FSB), Bank for International Settlements (BIS), and Group of Seven (G7) regarding TPSP oversight. Finally, Amromin et al. incorporate empirical evidence through a detailed case study examining the impact of a cyberattack on a technology service provider and its effects on the banking system’s liquidity needs.

Findings

Current U.S. regulatory limitations
The paper identifies significant gaps in the current U.S. regulatory framework for TPSPs. The Bank Service Company Act (BSCA) of 1962 provides only limited authority to Federal Banking Agencies, restricting oversight to services performed for depository institutions rather than comprehensive supervision of TPSPs themselves. This 60-year-old legislation was designed for a much simpler technological landscape and fails to address modern interconnectedness and concentration risks.

U.S. banking supervisors have limited direct visibility into TPSP activities despite banks’ reliance on multiple TPSPs and hundreds of their services daily for core banking operations. The Service Provider Program established in 1978 covers only a small subset of the thousands of TPSPs used by financial institutions.

International regulatory development
The study finds that while international bodies have developed comprehensive macroprudential frameworks for TPSP oversight, implementation in major economies remains nascent. Both the U.K. and EU are advancing toward formal designation and oversight of critical TPSPs, with expected designations beginning in 2025.

The U.K. approach focuses on qualitative criteria including materiality of services, concentration, and systemic impact drivers. The EU’s Digital Operational Resilience Act (DORA) establishes both quantitative and qualitative criteria for TPSP designation. In contrast, the U.S. currently lacks a macroprudential framework for TPSP oversight.

Empirical evidence from cyber event
The case study examining a cyberattack on a payments-related TPSP provides concrete evidence of systemic risk materialization. When the attacked TPSP took systems offline to limit damage, affected banks lost ability to send payments through normal Fedwire processes.

The study revealed heterogeneous responses across the banking sector: smaller banks with fewer reserves were more likely to access the Federal Reserve’s discount window for liquidity, while larger banks relied on fed funds markets or drew down existing reserves. The event demonstrated how TPSP operational failures can rapidly create liquidity risks with cascading effects throughout the financial system.

Technology Providers and Financial Stability: Overview of Risks and Regulatory Frameworks
Authors: Gene Amromin, Cindy Hull, Emma Weiss, Rebecca Chmielewski, Patty Cowperthwait, Brett Solimine, Kenechukwu Anadu, Falk Braeuning, Siobhan Sanders, Lorenzo Garza, Sam Schulhofer-Wohl, Amy Chapel, Meeoak Cho
From: Federal Reserve Bank of Chicago