Cedar on Banking

Staying Operational: A BankTech Playbook for Uncertain Times

Cedar Management Consulting International

Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.

0:00 | 21:49

In the face of rising geopolitical risks, banking technology is experiencing unprecedented pressure. In this CedarView Podcast episode, we unlock how banks must adjust their technology strategies to maintain operations and mitigate new risks, including cyber threats & supply chain disruptions.

We cover practical strategies for resilience, such as strengthening business continuity plans and securing payment infrastructure. The conversation also explores the growing importance of stress-testing systems for simultaneous disruptions and adapting fraud detection to new challenges. 

Banks that take action now to safeguard their operations will be in the best position to thrive in uncertain times. Tune in for insights on turning technology challenges into long-term strengths during times of disruption.

SPEAKER_01

Imagine waking up tomorrow, you walk down to your local cafe, and you just try to buy a simple cup of coffee, you tap your phone, and the payment declines. Right. And it's not because, you know, your account is empty, or because your bank is insolvent, or facing some classic run where thousands of people are lined up around the block trying to withdraw physical cash.

SPEAKER_00

No, there's no 1929 style panic in the streets.

SPEAKER_01

Exactly. Your payment declines because a tiny, completely obscure software vendor halfway across the world.

SPEAKER_00

Some company you've literally never heard of?

SPEAKER_01

Right. A company that routes like a fraction of a data packet for a cloud server you've never heard of. Well, they just went offline due to a geopolitical conflict. Wow. The money is there, but the invisible pipes that move it are suddenly shattered.

SPEAKER_00

Aaron Powell, which is an incredibly disorienting reality. I mean, we are culturally conditioned to think of banking crises in terms of liquidity, right?

SPEAKER_01

Aaron Ross Powell Oh, totally. Crashing stock prices, plummeting assets.

SPEAKER_00

Yeah, red numbers flashing on a trading floor. But the battlefield has um it's fundamentally shifted into the digital shadows. Trevor Burrus, Jr. Exactly. The real threat to the global financial system right now is entirely operational.

SPEAKER_01

Aaron Powell And that operational threat is exactly what we are tearing into for today's deep dive.

SPEAKER_00

Aaron Powell It's a big one today.

SPEAKER_01

It really is. We are unpacking a highly detailed March 2026 report published by Cedar Management Consulting. It's titled Staying Operational, a Banking Technology Playbook for Uncertain Times.

SPEAKER_00

Aaron Powell And this report, I mean, it drops a massive reality check on the industry.

SPEAKER_01

Aaron Powell A huge one. It reveals how recent geopolitical developments, specifically the shock waves radiating out of the Middle East right now, are putting unprecedented strain on the world's financial plumbing.

SPEAKER_00

Aaron Powell And the terrifying part is that this strain doesn't trigger the traditional warning lights on standard financial dashboards.

SPEAKER_01

Trevor Burrus Because the standard dashboards are looking for the wrong kind of stress.

SPEAKER_00

Aaron Ross Powell Exactly. They are measuring market volatility and capital reserves. Yeah. But the real friction is happening deep within the underlying digital infrastructure.

SPEAKER_01

Trevor Burrus We are talking about that vast complex web of third-party dependencies. Trevor Burrus Right.

SPEAKER_00

API integrations. And honestly, just the raw technological willpower required to keep cross-border financial flows moving. Trevor Burrus, Jr.

SPEAKER_01

Especially when the geopolitical surface right above them is just fracturing. Okay, let's unpack this. Because to understand how the plumbing is breaking, we really have to look at how the banking sector historically designed its safety nets.

SPEAKER_00

Aaron Powell Right, their whole backup plan.

SPEAKER_01

Yeah. For decades, business continuity planning, or BCP, was built around the assumption of isolated sequential disasters.

SPEAKER_00

Aaron Powell The traditional model was strictly linear. I mean, if a severe storm knocks out a data center in London, you fail over to a backup facility in Frankfurt. Exactly. Or if a specific vendor goes offline, you just switch to a precontracted alternate.

SPEAKER_01

It's a one-for-one swap.

SPEAKER_00

Right. The entire framework was designed under the assumption that the broader ecosystem remains totally stable while you fix one localized problem. You endure the event, you recover, and you return to a known baseline of normal operations.

SPEAKER_01

It's like a it's like an old school municipal disaster plan.

SPEAKER_00

Oh how so?

SPEAKER_01

Well, it gives you a highly detailed checklist of exactly what to do if a building catches on fire.

SPEAKER_00

Right. Step one, step two?

SPEAKER_01

Exactly. But that manual completely falls apart if there's a fire and a massive flood and a coordinated cyber attack on the fire department's dispatch system all happening at the exact same time.

SPEAKER_00

Wow. Yeah. The manual assumes you only have to fight one enemy.

SPEAKER_01

Right.

SPEAKER_00

What's fascinating here is that the CEDA report actually mathematically proves this shift.

SPEAKER_01

Oh, really?

SPEAKER_00

Yeah. The defining characteristic of the 2026 operational landscape isn't the introduction of new risks, it is the sheer speed and convergence of existing threats.

SPEAKER_01

Convergence. They're all happening at once.

SPEAKER_00

Exactly. Banks are currently facing elevated, highly coordinated cyber activity at the exact same moment. Their physical infrastructure is under threat from geopolitical tension.

SPEAKER_01

Aaron Powell And then you add in global supply chain disruptions.

SPEAKER_00

Right, which prevents the delivery of critical networking hardware, and you top it all off with rapidly evolving regulatory sanctions.

SPEAKER_01

So the threats act as multipliers for each other.

SPEAKER_00

You absolutely do.

SPEAKER_01

Like a cyberattack on a logistics port delays the shipment of servers you desperately need to upgrade a data center.

SPEAKER_00

Aaron Powell A data center that is currently buckling under a surge of panicked customer traffic.

SPEAKER_01

Right.

SPEAKER_00

Which means traditional BCP is effectively obsolete. The risk is no longer linear, it's exponential.

SPEAKER_01

Aaron Powell So how do banks even handle that?

SPEAKER_00

Aaron Ross Powell Well, the report says it requires a fundamental restructuring of how institutions govern themselves. They are adamant that the first step to survival is elevating technology risk out of the IT department and planting it directly into the boardroom.

SPEAKER_01

Strategic governance.

SPEAKER_00

Exactly. Strategic governance has to change before the conditions demand it.

SPEAKER_01

But I want to push on that a bit. Strategic governance sounds great in a corporate memo, right?

SPEAKER_00

Oh, sure.

SPEAKER_01

But what does that actually look like in practice? I mean, if a board is largely made up of finance experts and former CEOs, how do they suddenly grasp the existential threat of interconnected digital plumbing?

SPEAKER_00

Aaron Powell Well, it requires translating deeply technical exposures into immediate business consequences. So a board might not understand the intricacies of like a BGP routing vulnerability.

SPEAKER_01

Most people don't.

SPEAKER_00

Right. But they absolutely understand when you tell them if this specific digital corridor goes down, we lose the ability to process $80 million in cross-border trade tomorrow morning.

SPEAKER_01

Oh yeah. That gets their attention.

SPEAKER_00

And we will be legally liable for the failed settlements.

SPEAKER_01

Yeah, that translates it perfectly.

SPEAKER_00

The governance model has to match the reality of the threat. And that means leadership needs structured, scenario-based briefings that map these simultaneous stress tests before they happen.

SPEAKER_01

Aaron Powell So if the board finally grasps that this interconnected web is fragile, where do they look first? What's the first piece of plumbing that actually bursts when the pressure builds?

SPEAKER_00

Aaron Ross Powell The report points directly at the payments and transaction infrastructure.

SPEAKER_01

Trevor Burrus The money moving.

SPEAKER_00

Right. Specifically mapping out how international money movement is cracking under this pressure. Payments are the ultimate unforgiving litmus test of operational reality.

SPEAKER_01

Unforgiving is a good word for it.

SPEAKER_00

Especially in the Middle East right now, where cross-border flows and complex trade corridors are the absolute lifeblood of the regional economy. When the system is stressed, cross-border payment timelines begin to stretch.

SPEAKER_01

They bottleneck.

SPEAKER_00

Remittance corridors bottleneck, yeah. And for an exchange settlement, which is supposed to happen almost instantly in the background, well, it becomes incredibly complex.

SPEAKER_01

And let's look at the mechanism driving that friction. The report highlights the strain on correspondent banking and Swift connectivity.

SPEAKER_00

Aaron Powell Yeah, this is a huge point.

SPEAKER_01

Now most people listening know that correspondent banking requires banks to essentially trust each other to hold accounts and process localized payments on their behalf.

SPEAKER_00

Aaron Powell Right. It runs on trust.

SPEAKER_01

But what the report explains is why this breaks down during a geopolitical crisis. It's not just that the wires physically get cut.

SPEAKER_00

No, it's that the algorithmic trust evaporates.

SPEAKER_01

Wait, explain that.

SPEAKER_00

So the mechanism of failure here is driven by risk aversion. In stable times, a correspondent bank automatically routes millions of transactions based on established baselines of trust.

SPEAKER_01

It's just algorithms talking to algorithms.

SPEAKER_00

Exactly. But the second a geopolitical conflict erupts, that baseline shifts. Intermediary banks suddenly get spooked.

SPEAKER_01

Their systems freak out.

SPEAKER_00

Their systems stop automatically routing money and start flagging massive volumes of transactions for manual compliance reviews.

SPEAKER_01

Manual reviews for millions of transactions.

SPEAKER_00

Yeah. And they demand immediate prefunding for accounts that previously operated on credit.

SPEAKER_01

Wow. So the friction isn't always a broken pipe.

SPEAKER_00

No.

SPEAKER_01

Sometimes the friction is the system actively deciding to freeze the water just to be safe.

SPEAKER_00

That is exactly what happens. Interbank routing requires pre-tested contingency protocols because you can no longer assume your correspondent partner will actually accept your digital handshake tomorrow.

SPEAKER_01

And this demand for absolute real-time visibility falls squarely on the shoulders of treasury desks.

SPEAKER_00

Aaron Powell And capital markets, yeah. They have to manage trade finance platforms under concurrent demand, knowing that the pathways they rely on could close at literally any second.

SPEAKER_01

Aaron Powell Here's where it gets really interesting. I want to bring up the data and cloud section of the CEDAR report because it completely shatters a massive tech industry narrative.

SPEAKER_00

It really does.

SPEAKER_01

The report explicitly states that the assumption that cloud hosting provides inherent insulation from disruption has been tested and found incomplete.

SPEAKER_00

Tested and found incomplete, yes.

SPEAKER_01

But wait a minute, isn't the entire multi-billion dollar sales pitch of the cloud that it is a decentralized, bulletproof backup?

SPEAKER_00

That's the marketing, sure.

SPEAKER_01

Like if an entire server farm in one country goes dark, another one seamlessly takes over without dropping a single packet.

SPEAKER_00

Well, if we connect this to the bigger picture, we see the flaw in that promise. The cloud itself, like the massive data centers owned by the tech giants, might be incredibly resilient. Right. But your bank's operational continuity is only as strong as its unmapped vendor dependencies.

SPEAKER_01

Break down unmapped vendor dependencies. How hidden are we talking?

SPEAKER_00

Like of it as a nesting doll of vulnerabilities. Your bank might use a highly secure top-tier cloud provider, but to run your specific banking application on that cloud, you utilize a specialized third-party vendor for, say, a data analytics function.

SPEAKER_01

Right.

SPEAKER_00

That third-party vendor, unbeknownst to you, relies on a fourth-party supplier for a critical API that handles identity verification.

SPEAKER_01

Oh no.

SPEAKER_00

And that fourth party supplier has their physical infrastructure located in a region that just experienced a severe geopolitical disruption.

SPEAKER_01

Because the top-tier cloud provider is perfectly fine.

SPEAKER_00

Running at 100% capacity.

SPEAKER_01

But the tiny crucial gears running inside it just seized up.

SPEAKER_00

Exactly. Single points of failure almost always sit well beyond your formal vendor list.

SPEAKER_01

The unmapped ones.

SPEAKER_00

Right. The report stresses that dependencies that were never formally mapped out or audited are suddenly carrying direct operational consequences. When that fourth party API times out, your mobile banking app crashes. Even though your primary servers are totally fine.

SPEAKER_01

It's like installing a state-of-the-art military-grade security system on your house, complete with backup batteries and encrypted feeds. But you didn't realize that the system's central processor relies on a continuous Wi-Fi signal from your neighbor's incredibly cheap faulty router.

SPEAKER_00

Yes.

SPEAKER_01

When their router reboots, your entire fortress shuts down.

SPEAKER_00

That is a perfect analogy. And the current geopolitical environment is mercilessly exposing all of those hidden routers.

SPEAKER_01

So we have this invisible back-end plumbing, the cross-border routing delays, the evaporating correspondent trust, the unmapped fourth-party cloud dependencies. Right. But let's shift to the visible front-end reality. How do these systemic abstract technology risks directly impact human behavior?

SPEAKER_00

Oh, deeply.

SPEAKER_01

Because the CETA report dives deep into the intense pressure placed on digital channels and customer service during these geopolitical shocks.

SPEAKER_00

The translation from back-end latency to frontline panic happens almost instantly. I'm sure it does. In times of profound uncertainty, whether it's rumors of a conflict escalating or sudden economic sanctions being announced, customers crave reassurance. Their immediate reflex is to check their balances. So they flood their bank's mobile app and online portals.

SPEAKER_01

And if that app is down because of a hidden fourth-party API failure, the customer doesn't know about the API.

SPEAKER_00

They don't care about the API.

SPEAKER_01

Exactly. They just see a loading screen that eventually times out. And in a crisis, a timed-out app is the modern-day equivalent of walking up to your local bank branch and finding the heavy steel doors padlocked shut with no explanation.

SPEAKER_00

It really is. And the report is definitive on this. In the modern era, platform availability is institutional credibility.

SPEAKER_01

If the app is down, the psychological jump for the customer is immediate.

SPEAKER_00

Right. They don't assume a routing glitch. They assume the bank is insolvent.

SPEAKER_01

Which forces banks to actively review platform stability and vastly expand service desk capacity.

SPEAKER_00

And engineer proactive customer communication strategies that get ahead of outages before the rumor mill starts.

SPEAKER_01

But while millions of anxious customers are legitimately trying to log in and check their savings, the ecosystem is being flooded by something else entirely.

SPEAKER_00

Bad actors.

SPEAKER_01

Bad actors. The report tracks a severe, measurable spike in fraud and social engineering OBMs during these exact periods of volatility.

SPEAKER_00

This raises an important question about how our defensive systems are built. Organized threat actors know that during a crisis, attention is fractured.

SPEAKER_01

Right. Everyone's distracted.

SPEAKER_00

Bank staff are overwhelmed trying to maintain basic operations, and customers are highly susceptible to deception because they are operating out of fear.

SPEAKER_01

Panic makes people vulnerable.

SPEAKER_00

A panicked customer is far more likely to fall for a phishing email claiming their funds are about to be frozen and need to be transferred to a safe account.

SPEAKER_01

Which creates an absolute nightmare scenario for the bank's automated fraud detection system. Oh, the total nightmare. Think about the mechanism of how fraud algorithms work. They are trained to look for anomalies, right? Deviations from a baseline of normal behavior. It's like a highly sensitive car alarm that's calibrated to go off if someone breaks a window. But suddenly a geopolitical hurricane hits. The wind is rattling every single window, so the alarm is just screaming nonstop, and you have absolutely no idea if it's the storm or an actual burglar breaking in.

SPEAKER_00

That is exactly what happens. The baseline for normal is completely obliterated. During a crisis, legitimate customers start acting erratically.

SPEAKER_01

They move large sums of money around.

SPEAKER_00

Right. They log in from unusual IP addresses if they are fleeing a region. They wire funds to relatives across borders at three in the morning.

SPEAKER_01

And to the algorithm, this looks exactly like fraud.

SPEAKER_00

To the algorithm, they are all burglars.

SPEAKER_01

So the bank is trapped in a mathematical dilemma.

SPEAKER_00

A severe one. If they don't recalibrate their fraud detection rules on the fly, one of two things happens.

SPEAKER_01

Okay. What are the options?

SPEAKER_00

Either they loosen the rules and hemorrhage millions of dollars to opportunistic cybercriminals.

SPEAKER_01

Yikes.

SPEAKER_00

Or they keep the rules tight and trigger massive false positives.

SPEAKER_01

And a false positive means freezing an innocent person's account.

SPEAKER_00

Exactly. A false positive means the algorithm freezes the account of a panicked mother trying to legitimately wire money to her stranded child.

SPEAKER_01

Oh, wow. That creates a catastrophic public relations crisis on top of the operational one.

SPEAKER_00

Exactly. And while the tech teams are frantically trying to tune the fraud dials, the compliance teams are dealing with the absolute whiplash of international sanctions.

SPEAKER_01

Right. Because during geopolitical conflicts, global regulators do not pause.

SPEAKER_00

No, they accelerate. The velocity of regulatory change during these periods is staggering.

SPEAKER_01

Sanctions lists update constantly.

SPEAKER_00

Constantly. A bank's compliance technology must be incredibly agile to ingest and apply rapid updates to international sanctions databases.

SPEAKER_01

Without causing massive bottlenecks in payment processing.

SPEAKER_00

Right.

SPEAKER_01

The mechanism here is brutal. If your compliance API takes, say, 24 hours to sync with the newly published sanctions list, and you accidentally process a multimillion dollar trade for an entity that was sanctioned 15 minutes ago.

SPEAKER_00

Your bank is legally liable.

SPEAKER_01

But if you pause all transactions to manually check the new lists, you bring regional commerce to a grinding halt.

SPEAKER_00

The margin for error drops to zero at the exact moment the complexity reaches its peak.

SPEAKER_01

So what does this all mean? We've painted a picture of a battlefield where the backups are outdated, the international payment routes are heavily restricted by fear, the cloud is vulnerable to hidden failures.

SPEAKER_00

The customers are panicking, algorithms are freezing legitimate accounts.

SPEAKER_01

And regulators are updating the rules by the minute. How do the banks that actually survive this pressure operate?

SPEAKER_00

Well, the CEDA report provides a 10-point technology leadership playbook for moving from reactive panic to what they call a structural advantage.

SPEAKER_01

Let's look at the critical steps in this playbook. They emphasize mapping every single vendor dependency, right?

SPEAKER_00

Going three or four levels deep to find those hidden points of failure.

SPEAKER_01

The fourth party routers.

SPEAKER_00

Exactly. They also mandate stress testing for simultaneous overlapping disasters.

SPEAKER_01

Not sequential ones.

SPEAKER_00

Right. And they require securing payment rails and tightening compliance tech to absorb sanctions changes in real time.

SPEAKER_01

Aaron Powell Okay, but I really want to zero in on point number eight in their playbook because it seems entirely counterintuitive.

SPEAKER_00

Oh, I know which one you're talking about. Accelerate key projects.

SPEAKER_01

Yes. And I have to push back hard on this.

SPEAKER_00

Go ahead.

SPEAKER_01

Wait, you're telling me that while my cross-border supply chains are breaking, my correspondent trust is evaporating, and my cloud providers are facing fourth-party outages? Right. My board should be approving a multi-million dollar AI infrastructure upgrade.

SPEAKER_00

That is what they recommend.

SPEAKER_01

How does any CEO stand in front of nervous shareholders and justify accelerating massive tech spending during a crisis? Shouldn't they batten down the hatches, freeze all nonessential budgets, and just focus on survival?

SPEAKER_00

That instinct to pause, to freeze budgets and wait for the dust to settle is exactly what destroys long-term value.

SPEAKER_01

Wait, really?

SPEAKER_00

Yes. The CEDAR report highlights this as the most crucial conceptual shift for executive leadership. Deep uncertainty is not a reason to pause. It is a mandate to move aggressively on resilience-building projects.

SPEAKER_01

What is the mechanism behind that logic? Why spend when everything is burning?

SPEAKER_00

Because the underlying assumption of waiting for the dust to settle is flawed. The dust might not settle for a decade.

SPEAKER_01

Wow.

SPEAKER_00

The baseline operating environment has permanently changed. Geopolitical volatility is the new normal.

SPEAKER_01

So if you freeze your upgrades.

SPEAKER_00

If you delay migrating away from legacy on-premise servers, or if you hold off on implementing advanced machine learning for your fraud detection, you are choosing to fight tomorrow's simultaneous threats with yesterday's sequential tools.

SPEAKER_01

Ah, I see where this leads. If you use the pressure of the crisis to force through vital system upgrades, you are building capacity.

SPEAKER_00

Exactly. Meanwhile, your competitor gives in to fear, freezes their budget, and just tries to keep their head above water.

SPEAKER_01

So when the market finally establishes a new turbulent equilibrium, you aren't just surviving, you are operating with unprecedented efficiency.

SPEAKER_00

You have engineered a structural advantage. A structural advantage.

SPEAKER_01

Yes.

SPEAKER_00

Your systems can automatically route around localized outages. Your fraud algorithms can parse false positives in milliseconds.

SPEAKER_01

Your compliance tech ingests sanctions instantly.

SPEAKER_00

Right. And your competitor will take years and billions of dollars to close that operational gap. The technology decisions a board makes under maximum pressure will define their market dominance well beyond the current geopolitical cycle.

SPEAKER_01

Which brings us to the ultimate takeaway here.

SPEAKER_00

Yeah, bringing it back to the big picture.

SPEAKER_01

Even if you, listening to this deep dive right now, have absolutely nothing to do with Middle Eastern banking. Right. Even if you work in global logistics or healthcare administration or international e-commerce, this report is an absolute masterclass in modern operational survival.

SPEAKER_00

It really redefines what it means to be prepared.

SPEAKER_01

It proves that in a hyper-interconnected digital economy, your resilience is only as strong as your weakest, unmapped third-party vendor.

SPEAKER_00

That fourth party Wi-Fi router.

SPEAKER_01

Exactly. And it proves that true continuity doesn't mean having a plan for a disaster. It means having a mechanism to absorb simultaneous, overlapping disasters without losing the trust of your user base.

SPEAKER_00

The principles of resilience are universal across all sectors. It all comes down to speed, coordination, and the verifiable ability to maintain digital integrity when the physical environment around you is completely unpredictable.

SPEAKER_01

Very true.

SPEAKER_00

Which actually leaves us with a fascinating, broader concept to consider.

SPEAKER_01

Oh lay it on us.

SPEAKER_00

For the last century, we have valued companies based on very specific traditional metrics. We look at profit margins, quarter over quarter growth projections.

SPEAKER_01

User acquisition costs, market share.

SPEAKER_00

Exactly. But is overlapping global disruptions, whether they're geopolitical conflicts, massive technological shifts, or environmental crises become the absolute norm rather than the exception. Yeah. We might need an entirely new metric for valuation.

SPEAKER_01

What kind of metric?

SPEAKER_00

What if the ultimate measure of an organization's future worth becomes its chaos tolerance?

SPEAKER_01

Chaos tolerance.

SPEAKER_00

Yes. It's mathematically proven, battle-tested ability to maintain digital trust and uninterrupted operational continuity when the physical world around it is unraveling.

SPEAKER_01

So the companies that can audit, prove, and expand their chaos tolerance will be the ones that command the most value in the markets of tomorrow.

SPEAKER_00

That's the idea.

SPEAKER_01

That is a completely new lens for evaluating corporate strength. And it brings us right back to the image we started with.

SPEAKER_00

The cup of coffee.

SPEAKER_01

Exactly. When you picture an institution in crisis, you no longer need to look for a plummeting stock ticker or a physical run on a local branch.

SPEAKER_00

The signs are much subtler now.

SPEAKER_01

The real test of an organization's survival is happening right now, silently, in the hidden digital architecture that keeps our world moving. The true crisis and the true victory are completely invisible.