Resilience in Market Infrastructure

Resilience in market infrastructure is about trading, clearing, and settlement continuing, or recovering in an orderly way, when a central service is disrupted. The services are those that markets share: an exchange that matches orders, a clearing house that stands between buyers and sellers, a central securities depository that records ownership and settles trades, and a payment system that moves funds between participants. When one of those services stops, the harm is not confined to one firm. Participants cannot trade, cannot clear, or cannot settle, and the backlog that builds during the halt has to be cleared in an orderly sequence when the service returns. Recovery here is a collective act, not a single firm's restart.

Trading is the most visible service. An exchange matches buy and sell orders and publishes prices that the whole market uses. A halt in matching stops price discovery, and participants cannot execute, hedge, or exit positions. The service description has to cover not only matching, but market data publication, because participants trading elsewhere, or valuing portfolios, depend on those prices. A trading halt that is communicated poorly can cause more harm than the halt itself, because participants may continue to act on stale prices or assume trades have executed when they have not.

Participant firms are harmed first. A broker that cannot trade cannot serve clients. A bank that cannot clear cannot manage its exposures. An investment firm that cannot settle faces failed trades and potential costs. The harm is amplified by market movement during the halt: positions that could not be adjusted may have moved against the holder, and the longer the halt, the larger that exposure can become. Participants also face operational harm after reopening, when a backlog of orders and trades has to be processed in a compressed period, with a higher risk of error.

Market infrastructure depends on its participants as much as participants depend on it. Matching, clearing, and settlement all require participant systems to be ready, funded, and connected. A participant failure can therefore disrupt the infrastructure, just as an infrastructure failure disrupts participants. The infrastructure also depends on technology providers, on data centres, and on payment and settlement links to central banks and other systems. A disruption at any of those points can halt a service that many firms share, which is why concentration and shared dependencies are central to this sector's planning, not peripheral.

A useful market infrastructure test is a coordinated exercise, not a solo drill. One example is an exchange outage during active trading: can trading be halted cleanly, can orders in doubt be resolved, can participants be told the reopening procedure, and can trading resume in an orderly sequence without a flood of stale orders? Another is a clearing disruption: can margin and positions be reconstructed, can participants be told their exposures, and can clearing resume without unmeasured risk? A third is a settlement backlog: can the backlog be cleared in priority order, can failed settlements be identified, and can participants reconcile their books afterwards?

Check whether the plan covers halting and reopening as decisions with named decision makers, participant communication, and backlog sequencing, not only system recovery. Check whether orders and trades in doubt have a defined resolution, and whether data verification is a reopening condition. Check whether participants are included in testing, and whether their readiness is treated as part of recovery. And check which regime is being applied: DORA, which applies from 17 January 2025, and the UK regime under FCA PS21/3 and PRA PS6/21 are labelled separately in this guide.

A final check is participant readiness after reopening. A market that reopens while some participants are still reconciling trades will generate fresh mismatches, so the plan should confirm readiness across participant types before trading resumes in full, rather than assuming that a system restart means the market is ready.