Richard Albery, Head of Commercial and Jeremy McDougall, Strategic Solution Consulting Director at ACI Worldwide, explore the EU’s latest stress test and explains what true resilience demands in today’s banking landscape.
The European banking sector has faced its toughest trial yet.
The 2025 EU-wide stress test, conducted by the European Banking Authority (EBA), was the most stringent on record. Designed to simulate a sharp economic downturn triggered by escalating geopolitical tensions, it challenged 64 of Europe’s largest banks to withstand a 6.3% drop in GDP, volatile exchange and shifting interest rates.
Stress tests may be hypothetical exercises, but they reveal very social truths: how institutions behave under pressure, where systems and operating models break and what continuance really looks like. And while the focus often lands on capital liquidity, the real vulnerabilities lie much deeper. Infrastructure, processes and operational readiness – everything that determines whether a bank can act when it matters most.
Because when a crisis hits, it’s not just about having the funds available, it’s about being able to move them effectively, quickly and securely, whilst retaining consumer and business confidence as media reporting increases. And many institutions, still reliant on legacy systems and fragmented operations, are struggling to meet that challenge. But in today’s environment, resilience demands more than just balance sheet strength.
This raises an important question: What is needed then?
Where resilience is falling short
Satisfying the simulations of a stress test may signal financial resilience, but it doesn’t guarantee operational readiness. Treasury and finance teams may be well-drilled, but the systems and channels that underpin domestic and cross border payments, orchestration, fraud prevention and liquidity often tell a different story.
While only a subset of financial institutions were included in the EU’s 2025 stress test, representing those of highest systematic importance, the implications extend far beyond those 64 banks. Many banks are still running on infrastructure that predates the digital, 24/7 era – patched together through years of mergers, acquisitions and short-term fixes. These legacy systems are not cloud-native, not ISO 20022-ready and not built for instant and ecosystem interoperability.
This simply results in rising operational costs, manual workarounds and an over-reliance on a shrinking pool of experienced staff who know how to keep these systems running. These failings have already resulted in nine of the UK’s top banks and building societies experiencing more than a month’s worth of IT failures in just two years, with outdated infrastructure being a root cause.
Additionally, the financial services sector is currently facing a talent shortage. Over the past three years, more than 300,000 accountants and auditors have left the sector, and, as seasoned professionals retire, banks are struggling to replace them with candidates who have the right mix of legal, technical and operational expertise. Current teams are overstretched and facing mounting pressure, while the skills gap continues to widen, with many of the people who have the necessary knowledge of legacy systems, no longer within the organisations that need them most.
Regulatory bodies across Europe and the UK are also no longer treating operational resilience as a secondary concern but instead as a central pillar of financial stability. The recently enforced EU’s Digital Operational Resilience Act (DORA) and the UK’s operational resilience framework both demand that institutions not only withstand disruption but continue to deliver critical services without interruption.
But for many, compliance is proving difficult and remains subject local interpretation. For example, six months after DORA’s enforcement deadline, an estimated 96% of financial services firms across Europe still don’t feel ready to meet its requirements. Third-party risk oversight has emerged as a challenge, underscoring the systemic risk created by concentrated reliance on a small number of critical ICT providers, such as cloud platforms and core infrastructure vendors.
This regulatory shift is exposing a hard truth: resilience is a network of interdependent risks that capital liquidity alone can’t fix. Without the ability to maintain continuity of service, respond in real time and adapt to the evolving market, many institutions will continue to fall short. And when that continuity breaks, no amount of capital can compensate for the loss of trust, access or control.
A shift to structural resilience
Resilience must, therefore, be redefined in the eyes of financial institutions. Meeting the demands of a fast-moving regulatory and economic landscape requires more than short-term fixes. It calls for a shift in mindset and a move toward unified multi-threaded payment systems at both the institution and central infrastructure levels, that are integrated, intelligent and built for continuity.
At the heart of this issue is infrastructure. Legacy systems weren’t designed for real-time 24/7 availability, nor for the interoperability and visibility that modern banking demands. But cloud-native, modular platforms are purposefully built for this environment. They support real-time data flows, automate responses and integrate across fragmented systems, making them well-suited to the pace and complexity of our evolving financial ecosystem.
In fact, a unified cloud-native payments platforms can also coexist in hybrid modes alongside legacy systems, acting as an orchestration layer that connects every payment type and channel, without requiring a full departure from the proven. The best payments platforms can accept, route, process and clear any payment, from any source, in real time across traditional infrastructure, public and private cloud and across multi-cloud infrastructures, limiting the risk and reliance of wholescale change and over-reliance on SaaS only outsource providers. That allows banks to modernise incrementally, adding new capabilities without triggering widespread disruption or introducing new unintended risks. That said, proportionality of controls remain critical.
This kind of infrastructure also supports regulatory resilience. With frameworks like DORA, PSD3 and ISO 20022 reshaping operational expectations, banks need systems that can adapt quickly and consistently. A unified, modular architecture with strategic deployment and Run model optionality allows institutions to respond to regulatory change more efficiently by centralising updates, standardising processes and reducing the complexity of managing compliance across fragmented systems.
More importantly, it also provides something banks have long lacked: true operational visibility. In a crisis, being notified of an incident by a customer or a third party is too late. But with real-time insight into liquidity positions, payment flows and system performance, institutions can respond faster and more confidently to emerging risks. This is key in crisis scenarios, as seen in the EBA’s stress tests, where delays or blind spots can compromise continuity of service. Having those real-time insights is simply a smarter, more responsive way to protect customers and operations.
However, resilience isn’t just about systems, it’s about readiness. As the industry shifts toward a continuous operating model, banks must make sure their teams are also equipped to act in an ‘always-on’ economy. While a cultural shift may be needed long term, intelligent automation and AI-driven tools can help bridge the gap short term, particularly where talent may be scarce. AI-powered solutions can surface anomalies, streamline responses and reduce the burden on overstretched teams, helping banks better anticipate issues before they escalate.
In this way, resilience becomes a capability designed into the infrastructure, embedded in operations and supported by a culture that’s ready for whatever comes next.
Preparing for the future
For the 64 banks involved, the EU’s 2025 stress test was a simulation. But the conditions it modelled – economic shocks, market volatility, operational strain – are anything but hypothetical. They reflect the reality of a financial ecosystem in constant flux, where disruption lurks at every turn.
That’s why resilience can’t remain a static concept or a compliance checkbox. It must become a living capability, designed into infrastructure, embedded in operations and reinforced by culture. The institutions that succeed won’t be those that simply react to stress, but those that are embrace it and structurally prepared for it.
After all, a crisis won’t wait for banks to modernise. And the next regulatory shift won’t accommodate outdated systems. Resilience must be proactive, not reactive. Because in today’s environment, readiness is the real resilience.
