A few hours without Fedwire, and the bank promises with no fallback

The week

On Wednesday, February 24, 2021, several Federal Reserve financial services, including the Fedwire Funds Service and FedACH, were disrupted for several hours during the business day. The Federal Reserve attributed the problem to an operational error rather than a cyberattack, and services were restored later that day.

According to Reuters, the Fed first reported potential problems at 12:43 p.m. Eastern time. By about 2 p.m., its service status website showed an alert for Fedwire, FedACH and eleven other services, including check processing. The Fed said an operational error at the Federal Reserve had disrupted several business lines, and that it was restoring services and communicating with customers. It gave no further public detail on the cause.

The Federal Reserve Banks operate these services, and the Board of Governors oversees them. Under the Monetary Control Act of 1980, the Fed charges banks fees for the services, set to recover their costs over time. The Fed is therefore both the operator of key payment rails and a supervisor of many of the banks that use them.

Central payment systems had failed during a business day before, elsewhere. In October 2014, the Bank of England’s real-time settlement system, which settles high-value sterling payments, was unavailable for much of a day. That outage delayed house purchases across the United Kingdom.

Most people never think about how money moves between banks. They send a wire to close on a house, or their paycheck lands in their account on Friday morning, and it simply works. For a few hours that day, some of the machinery behind it stopped.

The Federal Reserve sets interest rates, and it also runs some of the country’s core payment “rails.” These are the shared networks that carry money from one bank to another, much as railroad tracks carry freight between cities. Individual banks build their own stations, but they depend on the same tracks.

Fedwire carries large-value, time-critical payments between banks. When a homebuyer’s down payment must reach the seller’s bank before the closing, or a company must pay a supplier a large sum today, the money often travels by Fedwire. Each payment is sent individually and settles immediately, which is why it is used when timing and certainty matter most. Reuters reported that Fedwire Funds had handled more than 835,000 transfers a day on average in December 2020, worth about $3.4 trillion a day.

FedACH processes a large share of the country’s batch payments, including payroll and government benefits. ACH stands for Automated Clearing House. Instead of sending payments one at a time, banks send files containing thousands of payments together, which are sorted and delivered in batches. It is cheaper and slower than a wire, and it is how most paychecks, benefit deposits and recurring bills move. The Fed is one of two ACH operators in the United States. The other is the Electronic Payments Network, run by The Clearing House, a company owned by large banks.

The timing mattered. The outage began in the early afternoon, when banks are working through the day’s wires and preparing files for the afternoon ACH processing windows. At the time, Same Day ACH, which lets some batch payments settle on the day they are sent, had two daily settlement windows. A third, later window was due to start less than a month later, on March 19, 2021.

The Fed was also in the middle of building something new. In 2019 it had announced FedNow, an instant payment service that would run around the clock, with launch planned for 2023. The private-sector RTP network, run by The Clearing House, had offered instant payments since 2017.

The outage drew wide attention because these services are the center of the U.S. payment system. Banks and their customers saw delayed wires and ACH files until the backlog cleared. Nothing catastrophic happened, and the episode faded quickly from the news. But for a few hours, banks across the country had to work out which of their promises to customers were suddenly in doubt.

Payment rails run by a central bank are usually treated as a utility: always on, outside the institution’s control, and therefore outside its planning. In most banks, nobody wakes up worrying whether Fedwire will be there today.

The February 2021 outage was a short reminder that a utility is still a dependency. Nothing catastrophic happened. Many banks still found, during those hours, that they could not quickly say which customer commitments were now at risk. Nor could they say what fallback existed, or how they would reconcile once the rail came back.

The cause of the outage matters too. It was an operational error, a reminder that the most likely disruptions to critical infrastructure are often mundane: a mistaken change, a failed update, a misconfiguration. Planning that focuses only on dramatic threats such as cyberattacks can miss the ordinary failures that happen more often. The good news is that the same preparation, knowing what depends on the rail and what you will do without it, works regardless of the cause.

The three gaps divide the problem into mapping, contingency and recovery. A first section explains the mechanics those three depend on. The three gaps then follow in order. The final sections explain why senior management should care, how to use a short outage as a rehearsal, and the questions that test whether the work has been done.

The argument applies differently across the industry. A large bank may have its own Fedwire connection. A community bank may reach the Fed through a correspondent, a credit union through a corporate credit union, and a fintech through a partner bank. All face the same rail, and each has a different set of levers.

A message, an account at the Fed and a queue

When a customer asks a bank to send money, the bank does not usually put cash in a truck. Instead, it sends a message instructing that money be moved from its own account to another bank’s account. For many U.S. banks, those accounts are held at the Federal Reserve. The Fed is, in effect, the bank for banks.

Two of the Fed’s services carry most of that traffic:

• Fedwire Funds Service handles individual, high-value payments that settle immediately and cannot be reversed. It is fast, certain and relatively expensive.
• FedACH handles batches of smaller, routine payments. It is very efficient, but it runs on a schedule, with set times when each batch is processed.

Same Day ACH, a faster variant of ACH, adds several processing windows during the day so that some batch payments can settle on the day they are sent. Each window has a cut-off time. Miss it, and the payment waits for the next one, which may be the following business day.

How a bank reaches the rail

A bank that uses Fed services directly holds a master account at its Reserve Bank and connects through the Fed’s FedLine access services. Larger institutions often use direct computer-to-computer links. Smaller ones may use a secure web connection operated by a handful of staff. Either way, the connection itself is a dependency, separate from the rail behind it.

Many institutions never connect at all. A community bank may send its wires through a larger correspondent bank. Many credit unions reach the payment system through a corporate credit union, a cooperative that provides payment and liquidity services to its members. Broker-dealers and most fintechs do not hold Fed accounts. They rely on a clearing bank or a partner bank. Every one of these layers adds a link to the chain between a customer’s instruction and the Fed’s ledger.

Hours and cut-offs

Fedwire Funds runs most of the day on business days, opening at 9 p.m. Eastern time on the evening before and closing at 7 p.m. Customer payments face an earlier cut-off at 6 p.m. Banks set their own internal cut-offs earlier still, to leave time for checks. A disruption in the early afternoon therefore lands close to the deadlines that matter most.

The queue

Inside a bank, a payments platform connects the customer-facing systems to these rails. It collects payment requests from online banking, branches, corporate clients and the bank’s own treasury department, checks them, formats them correctly and sends them out. It also receives incoming payments and posts them to customer accounts. When the rail stops, the platform keeps accepting requests but cannot send them anywhere, so a queue builds up.

That queue is where the business problem lives. Every payment in it represents a promise: a closing that must fund, a payroll that must land, a benefit someone is counting on.

The queue also hides information. Most platforms show payments by status and value. Few show the business consequence of each one, such as the closing it funds or the payroll it carries. That gap is the subject of the next section.

Mapping: which promises ride on which rail

A bank makes many time-bound promises that depend on Fedwire or FedACH. Real estate closings, securities settlement, correspondent flows, business payroll, consumer benefit deposits and the bank’s own liquidity movements all run on them. Correspondent flows are payments a bank makes on behalf of other, often smaller, banks that rely on it for access. Liquidity movements are the transfers a bank makes to keep enough cash in the right places.

Different business lines manage these promises, each with its own view of the payments platform. The mortgage team knows about closings. The commercial team knows about payroll clients. Treasury knows about the bank’s own flows. Nobody necessarily sees all of them together.

From a list of payments to a ranked list of promises

When a rail stops, the urgent question is a business one: which customers and obligations are affected, in what order of urgency, and who must be told. Banks that had mapped important business services to the underlying rails could triage within minutes. Others depended on experienced operations staff knowing whom to call.

The map needs deadlines attached. A wire that must fund a closing by mid-afternoon is a different problem from an ACH credit due tomorrow. Same Day ACH adds its own settlement windows, so a delay of a few hours can push a credit a client expected today into tomorrow. With cut-off times on each commitment, an outage becomes a ranked list.

The map also tells the bank which customers to call first, before they call in. A business client warned early that payroll may land late can tell its own employees. One that hears about it from them cannot. The difference between those two experiences is the difference between a client who feels looked after and one who feels let down.

Public money on the same rails

Government payments ride the same rails. The Reserve Banks act as fiscal agents for the U.S. Treasury, and federal benefit payments and tax refunds reach most recipients by ACH. States and counties pay benefits, payroll and vendors through their own banks, usually by ACH as well. A public agency’s map is therefore a map of its bank’s procedures. It should know its bank’s cut-offs, how it would be told of a delay, and what it would say to residents waiting for a payment.

Building it

Building the map is less work than it sounds. Payment systems already record originator, type, value and requested settlement time. A monthly extract that ranks clients by the value and time-sensitivity of their Fedwire and ACH activity gives most of the picture. Relationship managers add the context, such as a client’s payroll date or a scheduled closing. The map should be refreshed often enough that it reflects this quarter’s clients rather than last year’s, and someone in operations should own it.

Take a community bank with a few hundred business clients. Its monthly extract shows that twenty clients account for most of its time-sensitive ACH volume, and that the mortgage team typically has several closings each afternoon. On an outage day, the operations manager opens one spreadsheet, sees which payrolls are due and which closings are scheduled, and assigns relationship managers to call those clients within the hour. Triage takes a few minutes instead of a few hours of improvisation.

Dependencies that look independent

A good map also shows dependencies that are not obvious. CHIPS, the private large-value system run by The Clearing House for a few dozen of the largest banks, looks like an alternative to Fedwire. Its participants, though, fund their CHIPS positions through Fedwire, and its final positions settle in accounts at the Fed. Many other private clearing arrangements settle their final positions through Fed services too. A map that lists these as separate rails overstates the bank’s options.

The same applies inside the bank. A treasury team that moves collateral, a securities operation that settles trades and a card program that settles with its network may all reach the Fed through the same connection. A failure of that connection affects them all at once.

What the map looks like by institution type

The content of the map differs by institution. For a regional bank, the largest items are usually commercial wires, real estate closings and payroll for business clients. For a credit union, member payroll deposits, government benefits and loan disbursements dominate. Its link to the rail often runs through a corporate credit union, whose own procedures become part of the map.

A broker-dealer cares about funding securities settlement and client withdrawals, which run through its clearing bank. A correspondent bank must map its respondents’ flows as well as its own, because those smaller banks have no other route. A bank that serves fintech programs carries the payments of many end users who have never heard of it. When the rail stops, its partners’ customer service lines will ring first.

The case against bothering

A reasonable objection is that Fed services are extremely reliable, so the effort of mapping is wasted on a rare event. Outages of this length are indeed rare. The map, though, serves more than Fed outages. The same list answers the question when the bank’s own payments platform fails, when a correspondent has problems, or when a cyber incident forces the bank to disconnect. One map covers many failures, and most of those are more likely than a Fed outage.

Contingency: alternatives are narrow, so procedures decide

For most institutions there is no practical alternative rail for Fedwire payments. The largest banks can use private-sector systems for some large-value flows. The Federal Reserve maintains offline procedures for urgent payments when its services are impaired. Neither is a full substitute, and the offline channel is built for a small number of critical payments.

Most executives are used to hearing that the answer to a failed supplier is a second supplier. For the core of the U.S. payment system, for most banks, there is no second supplier, only a narrow emergency channel.

Why the alternatives are narrow

The limits have structural causes. For large-value payments, CHIPS serves only its participants and depends on Fedwire for funding. For ACH, a bank chooses an operator, and the two operators exchange payments with each other. A bank that sends its files to FedACH cannot simply redirect them to the other operator on the day of an outage. Switching requires agreements, testing and set-up that take weeks, not hours.

A backup connection is a different thing from a backup rail. Many banks keep a second FedLine connection at a recovery site. It protects against the failure of the bank’s own link or building. It does nothing when the service inside the Fed is impaired. Contingency plans that list “failover to secondary FedLine” as the answer to a Fed outage confuse the two.

What the procedures must settle

That makes contingency mostly a matter of procedure:

• Eligibility. Which payments are urgent enough for an offline channel, decided in advance by value, purpose and deadline.
• Authority. Who may request offline processing, with what credentials and what verification, kept current as staff change.
• Client guidance. What the bank tells clients about adjusting their own deadlines, and who has authority to say it.
• Liquidity. How treasury manages the bank’s own position when incoming payments are also delayed, including end-of-day balances.

The liquidity point is easy to miss. An outage stops money coming in as well as going out. A bank that expected large incoming payments may find its end-of-day balance lower than planned, through no fault of its own. Treasury needs to know in advance how it would respond.

Liquidity in more detail

Treasury has some tools of its own. The Fed extends intraday credit to eligible banks under its payment system risk policy, so a bank can run a temporary negative balance during the day. Overnight overdrafts are another matter and carry penalties. When an outage delays incoming payments late in the day, the gap between those two positions is what treasury must manage.

A bank that knows its normal intraday pattern can see the gap coming. It should know which large incoming payments it depends on each afternoon, which counterparties send them, and whether it has collateral pledged to cover a shortfall. The Fed can also extend operating hours after a disruption, which gives banks time to settle. Treasury should not assume that will happen, but it should know who would hear about it first.

Eligibility deserves discipline for a second reason. An emergency channel built for a small number of payments will slow down if every bank sends everything through it. Strict criteria protect the channel for the payments that cannot wait, including the bank’s own. A bank whose criteria are vague will be slower than one whose list is short and agreed.

Rehearsing the narrow path

These decisions are hard to make for the first time during an outage and easy to make in a tabletop exercise. That is a structured discussion in which the team walks through a scenario step by step. Credentials for offline channels deserve particular care, because they are rarely used and often found expired or held by someone who has left. A procedure that depends on a password nobody can find will fail.

For the community bank, preparing might mean a one-page sheet kept by the payments manager and her deputy. It lists the criteria for an urgent payment, such as a real estate closing due that day or a payment above a set value with a same-day deadline. It names the four people authorized to request offline handling, how their identity will be verified, and when their credentials were last tested. And it gives relationship managers a short, approved script for clients. The sheet is simple; it has to exist before the morning it is needed.

When someone else holds the connection

Banks that reach the rails through a correspondent or a processor have contingency partly in someone else’s hands. Many smaller banks do not connect to Fedwire directly. They send payments through a larger bank or a technology provider. A bank should know how its provider will prioritize its payments relative to other clients when access is constrained, and how it will be told. Those answers belong in the contract and in the provider’s tested procedures.

Credit unions that rely on a corporate credit union, and fintechs that rely on a partner bank, face the same question one layer further out. A fintech program manager has no relationship with the Fed at all. Its options during an outage are whatever its partner bank chooses to do, and its customers will hold it responsible anyway. Its contract should say how the partner bank will communicate during an outage and what the fintech may tell its own users.

Options on the customer side

Some contingency lies outside the payment system altogether. If the buyer and seller in a closing bank at the same institution, an internal book transfer moves money without any rail. A business client facing a late payroll can sometimes delay the effective date and tell its staff. A title company may agree to a later closing time. These options are not plans in themselves, but relationship managers who know them can turn a missed deadline into a managed delay.

Recovery: the backlog is its own incident

When the services returned, banks faced a surge of queued payments, files submitted during the outage, and possible duplicates where operators had retried. Reconciliation, the process of checking that every payment sent matches every payment recorded, exception handling and customer service volumes peaked after the outage ended.

An outage seems to end when the service comes back. For the operations team, that is when the hardest part begins.

Recovery is often the weakest part of payments resilience. It needs:

• Written rules for resubmission, so a payment sent once is not sent twice. A duplicate wire can mean a large sum leaving the bank that then has to be recovered.
• Temporary staffing for exception queues, the lists of payments that failed checks or need a human decision.
• Coordinated customer communication, so that clients hear one consistent story.
• A way to confirm that every critical payment completed before end of day.

How duplicates happen

Back at the community bank, the rail comes back mid-afternoon. Within minutes, the payments platform starts releasing hundreds of queued wires and several ACH files. Meanwhile, an operator who had grown anxious during the outage had manually re-entered three urgent wires through another screen. Without a rule, those three payments now go out twice. One of them is a large commercial payment, and recovering the duplicate takes days of calls with the receiving bank.

Run the same afternoon with a written rule: during an outage, no payment is re-entered. Urgent ones are flagged in the queue and released first when service returns. Any manual action is logged on a shared sheet that the recovery team checks before release. The same three wires go out once, in the right order, and the team spends its afternoon clearing exceptions rather than chasing money.

Why wires and ACH recover differently

The two rails behave differently when something goes wrong twice. A Fedwire payment is final once it settles. Getting a duplicate back depends on the receiving bank’s cooperation and, often, on the recipient agreeing to return the money. ACH rules, by contrast, allow an originator to reverse a duplicate entry within a short window after settlement. That makes an ACH duplicate a nuisance and a wire duplicate a potential loss.

Each rail also carries identifiers that make duplicates easier to catch. Every Fedwire message carries a unique accountability reference, and ACH files carry identifiers that distinguish one file from another created the same day. A recovery procedure that checks those references against the bank’s own records before release catches most duplicates. A procedure that relies on staff memory catches few.

Files sent during the outage need the same care. A bank may not know whether a file it transmitted as the service failed was received, partly processed or lost. The safe course is to confirm its status with the operator before sending it again.

Reconciling by rail

Reconciliation after an outage is easiest when it runs rail by rail. For Fedwire, the bank compares its own record of sent and received payments with the Fed’s statement of its account activity. For ACH, it compares the files and batches it sent with the operator’s acknowledgments and settlement totals. Any payment that appears on one side and not the other goes to a named person, not a shared inbox. The work is tedious, and it is the only way to know the incident is truly over.

The incoming side

Recovery has an incoming side too. When the rail returns, the payments other banks queued arrive in a rush. Each must be posted to the right account, screened for sanctions and fraud, and made available to the customer on time. Staff who spent the outage calling clients now face a posting surge. Exceptions from incoming payments, such as a name that does not match an account, pile up alongside the outgoing ones.

Fraud controls deserve attention in the rush. A backlog is an attractive moment for a fraudster to slip a payment instruction past tired staff, especially one that claims to be an urgent retry. Callback verification and dual approval for large manual payments should stay in place even when the queue is long.

Instructions from the operator and a finish line

Some recovery steps depend on the operator’s own instructions, such as extended operating hours or guidance on resubmitting files. The bank’s runbook, its step-by-step operating guide, should leave room for those and name who watches for them.

Recovery also needs a clear finish line. Someone should be responsible for declaring that the backlog is cleared, every critical payment has been confirmed and every client who was told about a delay has been told it is resolved. Until that happens, the incident is still open, whatever the status page says.

A bank that handles the outage well but the recovery poorly still lets customers down. Measuring recovery, such as the time until the exception queue is back to normal and the number of duplicate payments that had to be reversed, gives the next exercise a baseline.

More than an operations footnote

A few hours without a central payment rail might seem like an operations footnote. For a bank’s senior management, it touches almost everything they are accountable for:

• Customers. Payments are among the most emotionally charged services a bank provides. A late paycheck or a delayed home purchase is personal, and customers remember who told them and who did not.
• Money. Duplicate payments, missed deadlines and overtime in operations all have direct costs. Liquidity surprises can be expensive to cover at short notice.
• Risk. An outage creates the conditions for errors: rushed manual steps, unfamiliar procedures, tired staff working through a backlog.
• Regulators. Supervisors expect banks to understand their dependencies on critical services and to show how they would cope with disruption.
• Reputation. Business clients choose banks partly on how they behave on bad days. A proactive call about a delayed payroll can win loyalty that years of good service did not.

What supervisors had already asked for

The supervisory expectation was already written down. In late 2020 the Federal Reserve, the OCC and the FDIC published sound practices for operational resilience aimed at the largest banks. They asked firms to map the interconnections and dependencies behind their critical operations, including on third parties and financial market utilities. The interagency handbook on business continuity, used by examiners of banks and credit unions, also asks institutions to understand their dependencies and test their plans.

For smaller institutions, the expectation is scaled but similar. An examiner reviewing a community bank or a credit union will ask how it would handle the loss of a critical service, and will look for evidence of testing. A map and a one-page procedure, with records of a tabletop exercise, answer the question directly.

Who pays for an outage at the Fed

Some argue that an outage at the Fed is the Fed’s problem, and that banks cannot be blamed for a failure they did not cause. In a narrow sense that is fair. The Fed’s operating circulars set out the terms of its services, and a bank has little recourse for a short disruption. Customers, though, see only their own bank. A homebuyer whose closing slips does not distinguish between the bank’s platform and the Fed’s. Responsibility for the customer’s experience stays with the bank, whoever caused the outage.

Where the cost lands

The costs of a poor response fall unevenly. A consumer whose paycheck is late may face an overdraft fee or a missed bill. A homebuyer may lose a closing slot. A business may pay its own staff late. The bank absorbs some of these costs through fee refunds and goodwill, and the rest fall on customers who had no part in the failure. A bank that has prepared can limit both.

Using a short outage as a rehearsal

Short, contained events are the cheapest time to test assumptions. Banks that wrote down what the February 2021 outage taught them were better prepared for the always-on payment systems that followed.

A bank in good shape has a current map of its time-sensitive payment commitments, refreshed monthly and owned by someone in operations. It has decided in advance which payments qualify for offline handling and who may request it, and it checks those credentials regularly. It knows how its correspondent or processor would treat its payments in a crunch. It has written resubmission rules and a plan for staffing the backlog. And it records what happened after every outage, however brief.

A short after-action review

A useful review after a real outage takes an hour and answers a handful of factual points. It records when the bank learned of the outage and from whom, and when it told its first client. It lists which payments missed their deadlines and why. It notes whether anyone re-entered a payment, how long the backlog took to clear, and which procedures nobody could find. The answers become the baseline for the next exercise and a record for examiners.

Real outages are better tests than scripted ones, because nobody chose the timing. A bank that reviews even a thirty-minute disruption at its processor learns more than one that waits for a major event. The review should go to the same senior committee that oversees operational risk, so that gaps reach people who can fund fixes.

A scripted exercise

Between real events, a scripted exercise fills the gap. A two-hour session can cover the whole cycle. The facilitator announces at 1 p.m. that Fedwire and FedACH are unavailable, with no estimate for return. The team pulls up its map, names the first five clients to call and drafts the message. At 2 p.m., treasury reports that two large incoming payments have not arrived. At 4 p.m., the facilitator announces that service is back. The recovery team then walks through the queue, the duplicate check and the incoming surge.

Institutions can scale the exercise to their size. A credit union can run it with its corporate credit union on the phone. A fintech can run it with its partner bank. A large bank can run it across several business lines at once. The output is the same in each case: a list of gaps, owners and dates.

The habits of weaker banks

The weaker banks share a few habits:

• Treating central payment rails as too reliable to plan for.
• Leaving the knowledge of which clients matter most in the heads of a few experienced staff.
• Discovering during an outage that offline credentials have expired or belong to someone who has left.
• Declaring the incident over when the service returns, before the backlog has cleared.
• Retrying payments without a clear rule, and creating duplicates.
• Assuming a correspondent or processor will put your payments first.

Each habit has a cheap remedy, and each remedy is a document or a test rather than a system. That is what makes the February 2021 outage useful: it pointed to work a bank of any size could do within a quarter.

If the rail stopped this afternoon

Five questions test whether the map, the procedures and the recovery plan exist outside a few people’s heads:

1. If Fedwire or FedACH stopped for four hours this afternoon, which of our customers would we call first, and how would we know?
2. Which payments would qualify for offline processing, and who is authorized to request it today?
3. If we connect through a correspondent or processor, what does our contract say about how they prioritize our payments in an outage?
4. What are our rules for resubmitting payments after an outage, and how do we prevent duplicates?
5. How would treasury manage our end-of-day position if incoming payments were also delayed?

Behind each sits a record someone should own. The first is a current list of time-sensitive commitments by rail, with deadlines. The second is a check that offline credentials belong to people who still work at the bank. The third is a written note of how long the exception queue took to clear after the last disruption.

The questions work for institutions of every size, with different answers. A large bank will answer them for several rails and several business lines. A credit union may answer them in a page, with most of the weight on its corporate credit union’s procedures. A fintech will answer them largely by reference to its partner bank’s commitments. In each case, the test is whether the answers are written down and owned before the rail stops.

With hindsight

The outage did not change the structure of U.S. payments, but the years since raised the stakes of payments resilience. Same Day ACH added its third, later settlement window in March 2021, a few weeks after the outage, and the per-payment limit rose to $1 million the following year. More of the day’s money now moved in windows where a few hours’ delay changes the settlement date.

The Federal Reserve launched its FedNow instant payment service in July 2023, alongside the private-sector RTP network that had operated since 2017. Instant payment rails let money move between banks in seconds, at any hour. FedNow runs every day of the year, including weekends and holidays, and participation has grown steadily since launch as banks and credit unions joined through their processors.

That convenience has a hidden cost for operations teams. Instant rails run around the clock, removing the overnight buffer that batch processing once gave operations teams. In the old world, a problem discovered at night could often be fixed before the next morning’s batches. In an always-on world, there is no slack period in which to catch up, and a backlog builds in real time.

Fedwire moved to the ISO 20022 message format in July 2025, a large migration every participant had to test. ISO 20022 is an international standard for the structure of payment messages, a richer common language that carries more information about each payment. Changing the format of every message a bank sends and receives touches the payments platform, the systems around it and the procedures that depend on it. The Fed chose a single-day cutover rather than a phased one, so every Fedwire participant had to be ready on the same date. Banks that had mapped their payment flows and the systems behind them found that work directly useful in planning the change.

The federal banking agencies’ incident notification rule took effect in 2022, with compliance required from May 1 of that year. Banks must tell their primary federal regulator about significant computer-security incidents within 36 hours. Bank service providers must tell their bank customers as soon as possible about incidents likely to disrupt services for four hours or more. In 2023 the agencies issued joint guidance on managing third-party relationships. Supervisory attention to operational resilience grew, and mapping important services to their dependencies became an expectation rather than an aspiration.

Later disruptions came mostly from outside the central rails. In 2024, the bankruptcy of Synapse, a fintech middleware firm, left many end users of fintech apps unable to reach their money for months. Records of who owned what were split across intermediaries and did not reconcile. A faulty CrowdStrike software update in July 2024 disrupted computers at banks and many other organizations worldwide. Each was a dependency many institutions had not mapped.

A map like the one described above, built after a short outage in 2021, would have been a head start for all of these.

The article’s argument held up, with one qualification. The central rails stayed highly reliable, and the most disruptive payment events of the following years came from intermediaries, software vendors and banks’ own systems rather than from the Fed. That strengthens the case for mapping and recovery planning, because the same map and the same resubmission rules serve every one of those failures. It also suggests that the map should start with the intermediaries closest to the customer, where failures proved more common, and work back toward the central rails.

Central payment infrastructure remains very reliable but not infallible. A bank’s exposure lies in its own commitments, procedures and recovery capacity, which only the bank can map and rehearse. That is also why a short, harmless outage deserves a proper review: it is a free rehearsal. The rail is outside a bank’s control, but almost everything that determines how its customers experience the failure is within it.