Iberia’s blackout put payment resilience back at the shop counter

The week

At 12:33 local time on Monday, April 28, 2025, the electricity grid in mainland Spain and Portugal collapsed.

The failure took seconds. Generating plants in the south of Spain began disconnecting just after 12:32, voltage rose, more plants tripped, and within about half a minute the peninsular system had gone dark. Andorra lost power for a few seconds, and parts of southwestern France for minutes. The Balearic and Canary Islands, Madeira and the Azores, which run their own grids, were unaffected. Investigators later put the load lost at roughly 31 gigawatts across the two countries, essentially all the demand on the peninsular systems at that moment.

Tens of millions of people lost power at once. Trains and metro lines stopped, leaving passengers stranded between stations. Traffic signals failed, and city intersections turned into improvised exercises in courtesy. Mobile phone and internet service did not vanish immediately. It degraded through the afternoon as the backup batteries at network sites, the cell towers and switching stations that carry calls and data, ran down one by one. The internet monitor NetBlocks reported Spain’s national connectivity falling to a small fraction of its normal level.

The timing made the payment problem worse. The grid failed at midday on a working Monday, when shops, cafés and fuel stations were open for lunchtime trade and many people were away from home.

For anyone trying to buy something, the picture was stark. Card terminals in shops went dark. Many cash machines stopped working. Businesses that stayed open often took cash only, which was a problem for the many customers who carried little or none. A family with plenty of money in the bank could find itself unable to buy bread or fill the car. In Portugal, electronic payments were widely reported as largely unusable for the afternoon.

Hospitals ran on generators, the large backup engines that critical facilities keep for exactly this kind of day. Elsewhere, people waited. Portugal’s government declared an energy crisis that afternoon, and Spain’s prime minister convened the country’s National Security Council. Several regional governments in Spain asked the central government to take over emergency management.

Power returned progressively through the evening and night, as grid operators restarted generating plants and reconnected regions step by step. Restoring a grid is a careful process because supply and demand have to be rebuilt in balance, one block at a time. In Portugal, the operator began with “black-start” plants, generators able to start without power from the grid, and had about half the population reconnected by late evening. In Spain, the transmission operator, Red Eléctrica, reported about 99 percent of demand restored by 7:00 the next morning.

Two questions followed immediately: was this an attack, and what caused it? Authorities said early on that there was no evidence of a cyberattack. The Spanish and Portuguese governments and the European grid operators’ association, ENTSO-E, which coordinates the companies that run Europe’s high-voltage transmission networks, opened investigations into the cause. ENTSO-E set up an expert panel on May 12.

The timing gave the event extra weight in Brussels. In March 2025 the European Commission had published a preparedness strategy that urged member states to help households become self-sufficient for at least 72 hours in a crisis. Five weeks later, two member states had a live test of what an afternoon without power and connectivity looked like.

For banks and payment companies, though, the more immediate lesson was already visible on the shop floor. Their own systems had largely kept running. The European rules that govern their technology risk, the Digital Operational Resilience Act, had applied since January 17, 2025, barely three months earlier. Their customers still could not pay.

Banks usually measure payment resilience inside their own walls. They track authorization platform uptime, the percentage of time the systems that approve card transactions are available. They test failover between data centers, the ability to switch from one computer facility to another if the first fails. They set recovery times for core systems. These are sensible measures, and on April 28 most of those systems in Spain and Portugal kept running.

Customers with money in their accounts still could not buy food or fuel.

The gap between the bank’s view and the customer’s view becomes clear if you follow one card payment through the links it needs. There are four: a powered terminal, a network path from that terminal, an authorization decision, and a fallback when all else fails. A bank operates only the third directly. Its choices shape all four.

The sections that follow take the four links in order, after a short account of how a card payment moves. They then replay the afternoon from one customer’s position, set out the decisions a bank can make in advance, weigh the objections, and price the cost of a day of failed payments.

How a card payment actually works

For most people, paying by card feels like a single action: tap, beep, done. Behind that beep, a message passes through several organizations.

The merchant is the shop. Its terminal is the card reader on the counter, often connected to the till. The acquirer is the bank or payment company that signs up the merchant, supplies or certifies the terminal and receives the money on the merchant’s behalf. The card network, or scheme, is the company whose logo is on the card; it routes messages between banks. The issuer is the customer’s own bank, which decides whether to approve the payment.

Between them sit processors, the companies that run the switching and authorization systems on behalf of banks that do not run their own. In Spain, Redsys processes card payments for a large share of the market. In Portugal, SIBS runs the Multibanco network that links most of the country’s cash machines and terminals. A bank’s resilience therefore depends partly on systems it neither owns nor operates.

When a customer taps a card, the terminal sends a message through the acquirer and the card network to the issuer. The issuer checks the balance or credit line, runs fraud checks and replies “yes” or “no,” usually in well under a couple of seconds. Money moves between the banks later, in batches.

Authorization, clearing and settlement

That last step hides a distinction that matters in an outage. Authorization is the real-time yes or no. Clearing is the later exchange of transaction details between acquirer and issuer. Settlement is the movement of funds. Only authorization has to happen while the customer stands at the counter.

Clearing and settlement can wait hours or days without anyone at the counter noticing. For the same reason, the fallback mechanisms described below all work on one principle. They move the authorization decision closer to the counter, or defer it, so the sale can complete now and the money can follow later.

Every step in that chain needs power and a working connection, unless someone has deliberately arranged in advance for it to work without one. A bank can have the most resilient approval system in Europe, but if the message never leaves the shop, the system never gets the chance to say yes.

Phones add another battery to the chain

Payment habits had also moved toward the phone. A customer paying with a mobile wallet needs a charged phone as well as a working terminal. Account-to-account payments, such as Spain’s Bizum service for transfers between people and to some merchants, need a data connection on the customer’s side too. Each convenience added in the last decade added a dependency that a regional power failure removes.

The terminal: no power, no point of sale

A countertop card terminal needs electricity, and so does the cash register it is wired to. Most small merchants have no backup power at all. Larger stores often back up lighting, refrigeration and security, but not every till. Once the grid failed, the point of sale stopped, however resilient the acquiring bank’s platform was.

Battery-powered portable terminals and phone-based acceptance, where a merchant takes payments on a smartphone, lasted longer, until batteries or mobile connections gave out.

Three kinds of terminal, three outage profiles

The type of terminal largely decides how a merchant fares. An integrated terminal is wired into the till software and usually draws mains power through it. When the till dies, so does the terminal, even if the terminal could run alone. A standalone countertop terminal can be unplugged from the till but often still needs mains power. A portable terminal has its own battery and, increasingly, its own SIM card.

Large retailers favor integrated terminals because they cut keying errors and speed up checkout. Those benefits are real on an ordinary day. On April 28 they meant that the most sophisticated checkouts were often the first to stop.

What acquirers control

Acquirers and payment providers influence this layer more than they admit. They choose which devices to supply, rent and certify, and they write the onboarding checklist that every new merchant completes. Few onboarding processes ask a merchant what happens at the counter when the power fails.

An acquirer could add one question to its merchant risk review: does the business have at least one battery-capable terminal, and does staff know how to use it in an outage? For pharmacies, grocers and fuel stations, that question has public value. These are the businesses people most need on a bad day, and a single charged device behind the counter can be the difference between serving a queue and turning it away.

The acquirer also controls the terminal’s software. Whether a terminal can take an offline payment at all, how many it will store, and what it does when storage fills up are configuration choices pushed from the acquirer’s terminal management system. A merchant usually cannot see them, let alone change them.

The cost of acting on this is modest but not zero. A spare battery terminal for each essential merchant has to be bought or rented, kept charged and occasionally tested. Someone has to own that program, and it competes with every other merchant-services priority. Targeting it by merchant category keeps the cost bounded.

Fuel stations need more than a terminal

Some essential merchants fail for reasons no payment fix can touch. A fuel station without a generator cannot run its pumps, so it cannot sell fuel whatever terminal it has. A pharmacy may be unable to look up prescriptions. Mapping essential merchants is therefore best done with local emergency planners, who usually know which stations, grocers and pharmacies have backup power. Payment resilience effort should go first to the merchants that can trade at all in an outage.

The network path: a dependency nobody owns

A powered terminal still has to reach the payment network. Many connect through the merchant’s broadband router, the small box that provides the shop’s internet connection, which died with the grid. Others use a mobile SIM, the same kind of chip that connects a phone, which worked only while nearby cell sites had battery power. That left an afternoon of patchy service across the peninsula.

The dependency is shared by every bank and merchant in a region, and no single institution can fix it.

How the fiber transition changed the risk

Older copper telephone lines drew their power from the telephone exchange, so a phone could work in a blackout. Many older card terminals dialed out over those lines. Fiber connections need power at the customer’s premises, in the box that converts light to an electrical signal. As merchants moved to fiber broadband, a payment path that once survived a local power cut came to depend on the merchant’s own electricity.

The same shift happened in the mobile network. A cell site needs power for its radios and its link back to the core network. Operators install batteries and, at some sites, generators, but the amount of backup varies by site and by operator. In a region-wide outage lasting most of a day, the mobile network degrades unevenly, as the April 28 afternoon showed.

What a bank can measure

What a bank can do is measure it. Few institutions know what share of their acquiring estate, the full population of terminals they support, connects by fixed line versus mobile. Fewer have asked carriers how long cell sites in their key markets run on backup power. Both facts belong in an operational resilience scenario, because together they set how long customers can transact after a regional power loss begins.

The answers also point to cheap fixes. A terminal with both a broadband connection and a SIM can fail over to mobile when the router dies. A terminal that can roam between mobile operators keeps working when one carrier’s site fails before another’s. Neither guarantees service, but each widens the window in which customers can pay.

Where DORA does and does not reach

European institutions had a direct reason to ask. The Digital Operational Resilience Act, known as DORA, is an EU law that sets rules for how banks, insurers and other financial firms manage technology risk. Applicable since January 2025, it requires financial entities to test severe but plausible disruption scenarios, and a regional grid failure qualifies. After April 28, nobody could argue the scenario was far-fetched.

DORA also has limits worth understanding. Its third-party rules focus on ICT services that financial entities contract for, such as cloud hosting and software. The power grid is not one of those. Much of the telecom path at the counter is contracted by the merchant, not the bank. Electricity and telecom operators fall under separate EU rules on critical entities and network security. A bank’s DORA register can therefore look complete while the most important dependencies on April 28 sat outside it.

The US framework has a similar shape. The federal banking agencies’ 2020 paper on sound practices for operational resilience asks banks to map critical operations and their dependencies, and the FFIEC’s business continuity booklet covers utilities and telecommunications as dependencies. US banks have their own reference points too: the 2003 Northeast blackout, Hurricane Maria in Puerto Rico in 2017, and the Texas winter storm of February 2021.

The authorization decision: rules set years ago

Card schemes and issuers have long supported approval without a live connection to the issuer. There are three main mechanisms, and they are worth understanding because they are set by business decisions, not by physics.

Offline chip approval. A chip card is a tiny computer. It can approve some transactions offline within limits the issuer writes onto the card, for example a cap on the amount or on the number of offline purchases in a row. The terminal and card agree between themselves, and the transaction is sent to the bank later.

Store-and-forward. A merchant system can store transactions and forward them later, at the merchant’s risk. If the customer’s account turns out to be empty, the merchant may not be paid.

Stand-in processing. When an issuer’s host, its central approval computer, is unreachable, the card network can step in and approve within issuer-set parameters.

A ladder of fallbacks

Together they form a ladder of fallbacks. In normal conditions, every payment goes all the way to the issuer. If the issuer cannot be reached but the network can, stand-in catches the payment. If the network cannot be reached at all but the terminal has power, offline chip approval or store-and-forward can catch it. Each rung is narrower than the one above and carries a little more risk for someone, whether the issuer, the network or the merchant. A bank that has never looked at its rungs does not know how far its customers can fall before the ladder runs out.

Each mechanism needs something different. Offline chip approval needs a powered terminal but no connection. Stand-in needs a connection to the network but not to the issuer. In a regional blackout with failing mobile service, that difference decides which customers can still pay.

Who decides what, and where it is stored

The offline decision is split between two parties. The terminal carries a floor limit and risk rules set by the acquirer. The card carries counters and limits set by the issuer: how many offline transactions in a row, and how much in total, before it insists on going online. Some cards are issued as online-only, which means they will never approve offline whatever the terminal allows. Many debit and prepaid cards are set up that way.

Cash machines are a different case. Withdrawals almost always need a live authorization, so an ATM without a connection cannot dispense cash however well it is powered. In an outage, offline card rules help at the shop counter but not at the cash machine.

Contactless payments add a further wrinkle in Europe. Under the EU’s strong customer authentication rules, a card can be tapped without a PIN for payments up to €50, but only until cumulative limits are reached. After that, the cardholder must authenticate, which usually needs an online check or a PIN entry the terminal can process. A terminal running on battery with no connection may not be able to complete those steps.

Why the defaults drifted

These settings are configured once and seldom revisited. Over the past decade many issuers tightened offline limits to curb fraud, and many merchants turned off store-and-forward to avoid chargebacks, the reversals that hit a merchant when a payment later proves invalid. Those were sound decisions under normal conditions.

The risk being managed has also changed. Chip cards authenticate themselves cryptographically, so offline approval is far harder to abuse with a cloned card than the old magnetic stripe was. The main exposure in an offline payment is a customer spending more than the balance, or a lost or stolen card being used several times before it is blocked. Both are credit and fraud risks that can be capped by amount and count.

The blackout is a reason to review them deliberately. A modest offline limit on debit cards for essential merchant categories, such as grocers and pharmacies, raises credit and fraud exposure slightly. It also lets customers buy food during a regional emergency. The trade-off should be a documented decision by the card product owner and the fraud team, not an inherited default.

The limits on cards already in circulation are not easy to change. Some parameters can be updated the next time the card goes online, through issuer scripts. Others are fixed until the card is reissued. A bank that decides to change its offline policy should expect it to take effect over a card replacement cycle, not overnight, and should plan accordingly.

The fallback: cash and the message about it

When cards failed, cash worked for those who had it. Many people did not, and many cash machines were down. Those still running had to be powered and stocked, and once a machine ran out of notes, no one could refill it until normal logistics resumed. Withdrawals jumped once power returned.

Banks shape this layer through their cash network, branch continuity plans and what they tell customers in advance. A branch with backup power and a manual procedure for limited withdrawals is a public service during a regional outage.

The manual withdrawal, step by step

Manual procedures need preparation. Staff need a way to verify identity without the core system, the central computer that holds account balances. They need a per-customer limit, a paper log for later reconciliation, and the authority to apply all of it without waiting for a phone call from head office that cannot get through. That cannot be improvised in the dark.

A workable procedure has a few fixed parts. It names who may open the branch in an outage and who may authorize withdrawals. It sets one flat limit per customer per day, so nobody has to judge balances they cannot see. It requires a government identity document and a signed paper slip. It keeps the cash count and the slips together in a sealed bag for posting when systems return. And it states what happens if a customer has withdrawn more than the account holds.

That last point is the real trade-off. A manual withdrawal against an unseen balance is a small unsecured loan. Most customers will be good for it. Some will not, and some may try to use several branches. A low flat limit keeps the loss small and is still enough to buy a day of food.

The cash logistics behind the branch

Cash in a branch or machine has to arrive by armored vehicle, which depends on traffic, fuel and the carrier’s own operations. In a day-long outage with failed traffic lights, replenishment slows or stops. A branch with a generator but an empty vault helps nobody. The continuity plan should say how much cash selected branches hold for an outage and how it is replenished afterward.

Telling people before it happens

Communication is part of the fallback, and it must happen before the outage. Once the mobile network degrades, the bank’s app and text alerts cannot reach anyone. A customer who already knows that small chip payments may still work, which branches have generators, and that keeping some cash at home is sensible, can act without guidance. Pre-written outage messages can go out through local radio and branch signage when digital channels are down.

A metric that matches the customer’s view

What gets measured shapes what gets fixed. Alongside platform uptime, a bank can track a second number in its exercises. It is the share of essential merchants in a test region that could still take a card payment at set points into a regional outage, such as one, four and eight hours. The figure will be rough and partly estimated. It still shows the board whether the customer’s ability to pay is improving year to year, which uptime alone cannot.

The message is delicate. A bank telling customers to keep cash at home may seem to undercut its own digital strategy, and it raises questions about theft and safekeeping. The alternative is worse. Public authorities in several European countries were already giving households similar advice, and a bank whose message matches theirs reinforces it rather than competing with it.

One bank, one bad afternoon

Take a hypothetical mid-sized bank in a region hit by a day-long blackout. Its resilience report for the day reads well: core banking available throughout, card authorization up throughout, no data lost. By its own measures, it had a perfect day.

Now look at the same afternoon from a customer’s position. She walks to her local grocer. The till is dark, and the shop has no battery terminal. She tries a supermarket with generators; its terminals have power but connect through a broadband router that is down. A pharmacy has a portable terminal on a mobile connection, which works for an hour and then drops as the nearest cell site’s battery fades. Her debit card’s offline limit is zero, set years ago to reduce fraud. The nearest cash machine is out of service. The branch is closed because it has no backup power and no manual procedure.

Every one of those outcomes traces back to a choice that the bank either made or influenced. The choices covered which terminals it certified and whether it knew how they connected. They also covered what offline limit it wrote onto the card, how it equipped the branch and what it told customers in advance. The resilience report missed all of it because it measured the bank’s systems, not the customer’s ability to pay.

The morning after

The bank’s problems do not end when the lights come back. Stored transactions from terminals that did work arrive in a burst. Some push accounts into overdraft, and the bank has to decide whether to charge the usual fees for a day nobody chose. Merchants who accepted store-and-forward payments find that some are declined and ask who bears the loss. Call centers that were unreachable all afternoon face a surge of queries.

Each of those is a decision that is easier to make in advance. A board that has already agreed to waive overdraft fees caused by a declared regional emergency can announce it the next morning. One that has not will spend the day debating it while customers wait.

The four links show why the bank’s own uptime figures said little about April 28. A useful test for any bank or payment provider is to run its resilience scenario from the customer’s position. The scenario is a full-day regional power failure with weak mobile service, and the test is whether a customer can buy groceries.

Six decisions to make before the lights go out

A bank that has taken the blackout seriously does not need exotic technology. It needs a handful of deliberate decisions, written down and revisited. In practice, that means:

• A customer-side scenario. The resilience test begins with a person trying to buy groceries during a full-day regional power failure, and works backward through every link, rather than beginning with the data center and working outward.
• A map of the merchant estate. The acquiring team can say roughly how many terminals connect by broadband and how many by mobile, which essential merchants have battery-capable devices, and where the gaps are concentrated.
• A conversation with carriers. The bank has asked its telecom providers how long cell sites in its key markets run on backup power. It has written the answer into its scenario rather than assuming the network will simply be there.
• Owned offline settings. Offline chip limits, stand-in parameters and store-and-forward rules each have a named owner, a documented rationale and a review date. Someone can explain why the number is what it is.
• A small set of resilient branches. Selected branches, spread across the region, have backup power, cash on hand and a rehearsed manual procedure. Staff have practiced it rather than merely read it.
• Messages written in advance. Plain outage guidance is ready to go to local radio and onto branch doors, and customers have heard the basics before any emergency arrives.

How the decisions differ by institution

Not every institution holds every lever. A large universal bank that both issues cards and acquires merchants controls offline limits, terminal configuration and branch policy, and can coordinate them. A bank that only issues cards controls the offline limits and stand-in parameters but must work through its acquiring partners on terminals.

A small bank or credit union that relies on a processor for card authorization controls even less directly. Its stand-in parameters may be set in the processor’s system, and its offline limits in the card profile the processor or card manufacturer maintains. For such an institution, the most useful step is a contract review: what the processor does in a regional outage, what parameters the institution has chosen, and how to change them.

Public programs have faced the same problem and solved part of it. US food assistance benefits delivered by EBT card, for example, have long had a manual voucher procedure that authorized retailers can use when the system is down, within program limits. That is a designed fallback, with rules set before the outage rather than during it.

Where banks usually go wrong

The ways banks get this wrong are equally recognizable. The first is treating payment resilience as purely a data-center topic, so that a day when the bank’s systems stayed up is recorded as a success even though customers could not pay. The second is leaving offline limits at defaults nobody remembers choosing, set years ago for good fraud reasons and never weighed against an emergency. The third is assuming the app will reach customers in a crisis, when the very event that stops card payments also weakens the mobile network the app depends on. The fourth is writing manual branch procedures that have never been rehearsed, so that on the day itself staff do not know who can authorize a withdrawal or how to record it. Each of these is cheap to fix in advance and impossible to fix during the outage.

The case against, and why it falls short

There are serious objections to this agenda. The first is that grid failures of this scale are rare in Europe, and spending on them diverts money from more likely threats such as fraud and cyberattacks. The answer is that most of the measures cost little, and several, such as dual-path terminals and owned offline limits, also help in the far more common local outages and network failures.

The second objection is that raising offline limits invites losses. The objection has force, and it is why the limits should be modest and targeted by merchant category. The loss from a capped offline limit is bounded in advance. The cost of customers unable to buy food is harder to bound and lands on the bank’s reputation.

The third objection is that keeping the lights on is the job of governments and grid operators, not banks. Banks cannot prevent a blackout, and nobody suggests they should. But payments are a service banks sell, and the customer judges the service at the counter, not at the data center.

What a day of failed payments costs

The business case is broader than it first appears.

Customers. People judge a bank by whether their card works, not by its data-center statistics. A day of failed payments is remembered long after the grid is restored.

Regulators. DORA and similar resilience rules are about continuity of service to customers and markets. Supervisors are likely to ask whether the bank’s services stayed usable, as well as whether its systems stayed up.

Public role. In a regional emergency, the ability to buy food, medicine and fuel is a public concern. Banks that can show they thought about it earn trust with governments and communities.

Cost and risk. The measures involved are modest: a question on a checklist, a reviewed offline limit, generators for selected branches, pre-written messages. The fraud and credit exposure of slightly higher offline limits is real but small and can be bounded by merchant category and amount.

Incident reporting adds a clock

Under DORA, a major ICT-related incident must be reported to the competent authority on a fixed timetable. An initial notification is due within hours of classifying the incident as major, an intermediate report within days, and a final report within a month. Whether a regional blackout counts as a major ICT incident for a given bank depends on how its services were affected, and that classification is a judgment the bank has to make quickly.

A bank that measured only its own systems may conclude that nothing was reportable. A supervisor who saw customers unable to pay may take a different view. Deciding in advance how the bank would classify such an event, and documenting the reasoning, avoids having that argument afterward.

Where the next blackout test should start

1. If our region lost power for a full day and mobile service weakened, could our customers buy groceries? Walk me through how.
2. What share of the terminals we support connect by fixed line, and what share by mobile? How long do local cell sites run on backup power?
3. What offline limits and stand-in parameters apply to our cards today, who chose them, and when were they last reviewed?
4. Which branches have backup power, and do staff there have a rehearsed manual procedure for limited withdrawals?
5. Does our DORA scenario testing include a regional grid failure, measured from the customer’s side of the counter?

A good exercise uses these questions as its script. The team walks through the afternoon hour by hour, from the first minutes of the outage through the morning after. At each step it records what the customer could do and who in the bank owned the answer. The gaps that emerge are the work plan.

With hindsight

The cause took almost a year to settle. A Spanish government report presented on June 17, 2025, found a multifactorial origin centered on insufficient voltage control, and no evidence of a cyberattack. Red Eléctrica published its own report the following day. Voltage is, loosely, the pressure that pushes electricity through the wires; a grid has to keep it within a narrow band, and when control slips, protective systems start disconnecting equipment.

ENTSO-E’s expert panel worked in stages. It published a factual report on October 3, 2025, reconstructing the sequence of events and the restoration. Its final report followed on March 20, 2026. It described interacting factors, including oscillations, gaps in voltage and reactive power control, differing voltage regulation practices and generator disconnections, that ended in rapid voltage rises and a cascade. In a cascade, one disconnection pushes stress onto the next part of the system, which then disconnects too. ENTSO-E called it the most severe blackout on the European system in more than 20 years and the first of its kind.

The political response was uneven. Spain’s government approved an emergency decree-law on June 24, 2025, with measures on storage, grid operation and demand flexibility. Spain’s Congress declined to validate it in July, so it lapsed. Portugal kept its interconnection with Spain closed to imports until May 8 and limited until May 12. It then announced its own program of grid investments that summer, including more black-start capacity and battery storage.

For payments, the cause mattered less than the cascade. Whatever starts a regional power loss, the effect at the shop counter is the same: dark terminals, failing links and scarce cash. That is why the payment lessons do not depend on the engineering findings.

The same holds in reverse. Better voltage control in Spain lowers the odds of a repeat of this particular failure. It does nothing for a payment chain exposed to the next storm, heat wave, fire or attack on the grid elsewhere in Europe. Grid fixes and payment fixes run on separate tracks, owned by different people.

The blackout gave new weight to the European debate over keeping cash usable as a backup when electronic payments fail. A day when card payments stopped across two countries made that debate concrete for many people who had long since stopped carrying notes. It also gave a practical example to those arguing for offline features in new payment systems. One was the offline mode the European Central Bank had already included in its design work on a digital euro.

The European Commission’s preparedness agenda, published a month before the blackout, had urged member states to encourage households to plan for 72 hours of self-sufficiency. The Iberian afternoon showed what that means for money. A household that can feed itself for three days without power also needs a way to pay for anything it lacks.

What held up is the basic finding. Core banking systems survived, and customers felt the failure at the terminal, the network link and the missing cash fallback. The finding has a lasting implication for how resilience is measured. A bank’s uptime statistics describe its own machinery. Customers experience the whole chain, much of which belongs to merchants, telecom carriers and power companies. A bank cannot own that chain, but it can map it, make deliberate choices about the parts it influences and prepare customers for the parts it cannot.

One question remains open in the public record. The blackout arrived early in DORA’s life, and it handed supervisors and firms a concrete scenario for the resilience testing the law requires. We have not seen a public account of how individual banks classified the day under DORA’s incident rules, or of what supervisors asked afterward, and we do not assume one. Banks outside Iberia can still run the exercise without waiting for that account.