Tolerances and Financial Stability Harm

Financial stability harm looks beyond the customers of one firm to the wider system in which that firm operates. A disruption to an important service can delay obligations to other firms, distort information on which markets rely, or undermine confidence in a shared process, and those effects can spread even when the original firm recovers. An impact tolerance that only considers direct customers will miss that wider harm, and it may therefore judge a disruption tolerable when its systemic consequences are not. The tolerance for a service with systemic connections must ask not only what its own customers lose, but what the system loses when the service fails.

The illustration here is a wholesale settlement service that moves obligations between firms. If that service stops, counterparties cannot settle, liquidity planning becomes uncertain, and firms that expected to receive funds must adjust their own positions. The harm is not confined to a single relationship. It propagates through chains of obligations, and its seriousness depends on timing, on the number of connected firms, and on whether alternative settlement routes exist. A tolerance for such a service must therefore be set with those connections in view.

Wider harm differs in its path and in its scale. Customer harm is suffered directly by users of the service. Wider harm is suffered indirectly, by firms and markets that depend on the service functioning as part of a chain. A customer who cannot pay experiences a direct problem. A counterparty that cannot settle experiences a problem caused by the first firm's disruption, and that counterparty's own customers may then experience a further problem. The chain lengthens the harm and makes it harder to trace, which is why a tolerance set only from direct customer impact will understate it.

Connections matter because a relatively contained service can have outsized systemic importance if it sits at a junction. A settlement service, a shared data feed, or a clearing link may serve a limited number of direct users while supporting a much larger volume of downstream activity. Size measured by direct users therefore understates importance. What matters is position: does other activity depend on this service, can that activity proceed without it, and for how long can it wait before its own obligations are affected?

A tolerance captures wider harm by describing, for the service in question, which external obligations and which connected firms are affected by disruption, and what state of affairs would be judged intolerable from the perspective of the system. That description does not need to quantify systemic risk in a single figure. It needs to name the connections, explain the timing sensitivity, and state the point at which delayed or distorted activity would damage confidence or the functioning of a shared process. The wording should be specific enough that, during an incident, the firm can identify which counterparties to inform and which obligations to prioritise.

Wider harm is most often missed when a tolerance is set service by service without considering links between services. A firm may set a defensible tolerance for each service in isolation, while missing the fact that several services share a provider, a platform, or a settlement window, so that one underlying failure disrupts them together. The combined effect can be systemically significant even when each individual effect looks contained. Reviewing tolerances together, with shared dependencies in view, helps to catch that combined effect before an incident reveals it.

A reader can test a wider harm tolerance by asking which other firms and shared processes depend on the service, what happens to their obligations when the service stops, and how long they can wait before their own positions are affected. Further questions concern simultaneity: do other services share the same dependency, and would a single failure therefore affect several services at once? If those questions have no answer, the wider dimension is incomplete, even if the customer dimension is well described.