DOWNLOAD SIAA Monthly – May edition PDF
By James Dickson, Managing Director, Oceanic Consulting Group
It’s just a matter of time until something breaks. Is the industry ready?
Pick almost any dimension of the operating environment and the uncertainty is higher than it was three years ago. Trade rules that underpinned global market structure for decades are being rewritten in real time. Geopolitical fractures that were once theoretical are now active. The question worth asking is whether the industry’s resilience posture has kept pace.
The industry has done the work. That is not the problem.
The Australian financial services industry has invested seriously in operational resilience over the past decade. APRA’s CPS 230, ASIC’s market integrity surveillance priorities, and the hard lessons of COVID-era volatility have all driven genuine improvement. Most firms now carry documented DR plans, cloud redundancy, cyber incident playbooks, and escalation frameworks that would have seemed ambitious not long ago. The problem is not that the work has not been done. The problem is that the threat environment has moved, and some of the most material risks now sit outside the perimeter that most of that work was designed to address.
A garden hose on the ocean floor
There are 18 international submarine cables connecting Australia to the rest of the world. Each one is roughly the diameter of a garden hose. The majority of them surface within two small coastal protection zones in Sydney’s northern and southern suburbs. A handful more land in Perth, Sunshine Coast and Darwin. That is the physical infrastructure underpinning every international trade, settlement instruction and price feed that crosses Australia’s border.
Eighteen cables sounds like meaningful redundancy. But the east coast landing points are concentrated within a remarkably small coastal footprint, and the cables themselves traverse some of the world’s most contested waterways.
In 2022, the Tonga volcanic eruption severed that country’s sole submarine cable and cut it off from international communications for five weeks. In 2024, Houthi-linked operations in the Red Sea damaged multiple cables disrupting connectivity across Asia, Europe and Africa. Also in 2024, two cables in the Baltic Sea were severed within weeks of each other, prompting NATO-level conversations about deliberate infrastructure targeting as an instrument of statecraft. The United Nations formed its first-ever Submarine Cable Advisory Group before the year was out.
Taken together, they describe a category of failure no individual firm’s continuity framework was designed to handle.
The gap between firm resilience and system resilience
Most continuity planning assumes your systems fail while the market keeps running. You fail back gracefully to your secondary environment, your clients barely notice, and your regulator sees a clean incident report. It does not model the scenario where the market itself is effectively blind: order routing, price feeds and settlement communications degraded simultaneously, no clear restoration timeline, no resolution estimate by Monday open.
Submarine cable infrastructure is not your infrastructure. It is owned and operated by telecommunications companies and hyperscalers, outside your perimeter and outside the scope of any individual firm’s continuity framework. When it fails, it fails for everyone at once. The risks furthest outside any single firm’s control are the ones most likely to overwhelm the industry’s collective capacity to respond, because nobody has rehearsed for them together.
Live fire drills: the case for doing the uncomfortable thing
Aviation, defence and nuclear operators have run live fire drills for decades. So do Australia’s major banks, through structured crisis simulation forums that have become a standard part of their operational resilience programs. In the US, SIFMA has run Quantum Dawn, a simulated real-time market crisis exercise across regulators, exchanges and financial firms, since 2011. The model exists and it works.
The rest of Australian financial services has been slower to get there. The reasons are familiar: nobody wants to model their own fragility in front of regulators and competitors, and something more pressing is always on the agenda.
The discomfort of a drill is categorically different from the discomfort of the real thing. In a drill, you find out your escalation tree has three people who no longer work at the firm. In the actual event, you find that out at 8am on a Monday with the market opening in two hours.
The scenarios worth rehearsing are not the tidy ones. Decisions that matter most (halt or continue trading, how to communicate with clients when your own channels are degraded, who has authority to act) are being made without a script, by people who have never been in that situation before. What happens to your settlement obligations when your confirmations cannot get through? Who calls whom, in what order? These questions need rehearsed answers, not improvised ones.
So what should the industry actually do?
At the firm level, pressure-test what your continuity plan assumes about the external environment. Most plans assume connectivity is available, price feeds are running and counterparties are reachable. Those are load-bearing assumptions that should be stress-tested explicitly.
At the industry level, cross-participant exercises that include regulators, exchanges and infrastructure providers are where the real gaps surface. Genuine drills where the scenario is specific and the debrief is honest about where coordination broke down. The conversation has to start somewhere.
At SIAA2026 in Melbourne this May, one plenary session takes a step in that direction. “A critical supplier has gone down: what happens next?” is built around a live fire drill format, not a panel discussion. The session brings together Calissa Aldridge from ASIC, Karl Jancar from Shaw and Partners, Andrew Jappy from Iress, and Ben Jackson from the ASX. The topic is a critical supplier failure. The lessons apply well beyond it.
At some point, one of those 18 garden hoses is going to fail. The cause almost doesn’t matter. What matters is whether the industry has a rehearsed response ready, or whether it will be improvising in real time with the market watching.
James Dickson is Managing Director of Oceanic Consulting Group, a financial services consulting firm operating across Australia, the UK, Hong Kong and Singapore. OCG advises financial services firms on risk, compliance and operational resilience. James is facilitating the plenary session at SIAA2026, 19-20 May, Park Hyatt Melbourne.
BACK TO SIAA MONTHLY – MAY 2026