Resilience is built through practice: how the Dutch financial sector exercises for crisis situations

Why exercising matters

The financial sector operates in an environment characterised by growing cyber threats, geopolitical tensions and complex dependencies between organisations and infrastructures. As discussed in our previous blog, financial institutions depend not only on each other, but also on critical services such as telecommunications and electricity.

While no organisation can prepare for every possible scenario, exercising helps participants understand how they would respond when disruptions occur.

For Jacco, the importance of exercising is straightforward: “You have to practise in order to know how to communicate and how to act during a crisis.”

Crisis situations place people in circumstances that are fundamentally different from day-to-day operations. Information is often incomplete, time is limited and decisions can have immediate consequences. “Not every manager is a crisis manager,” Jacco explains. “In a crisis, you may need to make decisions when you have a high level of uncertainty, instead of the full certainty people often seek in normal situations.”

Training an entire ecosystem

Exercising within the TCO structure goes far beyond a single organisation.

Approximately 300 people are involved in the broader structure. Being in the lead of the TCO structure, DNB has a responsibility to ensure that participants remain prepared through a multi-year exercise programme.

Exercises vary in size and complexity. Some are relatively small and focused on specific processes or decision-making structures. Others involve large numbers of participants and simulate significant disruptions affecting multiple organisations simultaneously. The TCO structure has also participated in national exercises and always aligns its planning with other relevant exercises taking place nationally and internationally.

Bringing together all relevant stakeholders

One of the defining characteristics of these exercises is the wide range of participants involved. Alongside financial institutions, exercises include representatives from DNB, AFM and the Ministry of Finance. Organisations such as the National Cyber Security Centre (NCSC) and the Dutch Payments Association also participate. As a long-standing participant in the Dutch payments ecosystem, Worldline values these partnerships highly and has been actively involved in supporting the sector's resilience efforts for many years.

During an exercise, participating institutions are free to activate larger internal teams if they choose. As a result, the number of people involved can quickly multiply beyond the formal exercise structure. The objective is to create a realistic environment in which participants can test communication lines, coordination mechanisms and crisis-management processes under pressure.

Dutch focus, international perspective

Although resilience challenges are increasingly international, most exercises organised within the TCO framework focus specifically on the Dutch payments and capital markets ecosystem.

Petra explains: “Our exercises focus on Dutch payments and capital markets. We look at the organisations that are relevant for us as the Netherlands.” At the same time, the sector also participates in European exercises and maintains close contact with international partners.

According to Jacco, there is an important difference between national and international exercises. Within the Dutch TCO framework, collective measures can be agreed and implemented by participating organisations when necessary. Internationally, exercises often focus more heavily on communication, coordination and building trust between different jurisdictions and organisations.

Can you ever exercise enough?

Both Jacco and Petra believe that exercising will always remain a critical part of resilience efforts in the years ahead. Also considering the risks evolve over time, look at the risks associated with Frontier AI models, a scenario that we take in mind in an upcoming exercise. At the same time, they acknowledge that exercises require significant investments of time and resources both in organising as well as in participating. Large-scale exercises often take up to a year to prepare.

The increasing interconnectedness of critical sectors also creates opportunities for broader exercises. In the past, the financial sector has exercised together with organisations from the energy and telecommunications sectors. According to Petra, those types of cross-sector exercises remain highly relevant because, as mentioned earlier, disruptions outside the financial sector can have a direct impact on financial services.

Success means finding room for improvement

Interestingly, neither Jacco nor Petra defines a successful exercise as one where everything goes according to plan. For Petra, the opposite may even be true. “I get very nervous when an exercise goes perfectly,” she says. “That cannot be the case. There is always something to learn.” According to her, an exercise that appears flawless can create a false sense of security. Every exercise should generate findings, new questions, challenges and opportunities for improvement.

Jacco shares that perspective. “The learning experience is central. What matters is that people fulfil their role and that we learn together.” Participants evaluate whether the right information reaches the right people, whether procedures and crisis plans are followed and whether communication and decision-making function as intended. The process and the structure are improved where necessary

What happens after an exercise?

The learning process does not stop when the exercise ends. Each exercise is followed by an evaluation phase in which findings are reviewed and documented. The outcome and lessons learnt are shared with all participating organisations.

Based on the outcomes, follow-up actions are identified, responsibilities are assigned and implementation is monitored. Importantly, these improvements are developed together with the sector rather than imposed unilaterally. The goal is not simply to identify shortcomings, but to continuously strengthen the collective resilience of the ecosystem.

Trust, communication and continuous learning

Throughout our conversations with Jacco and Petra, one theme consistently emerged: resilience is ultimately about people. Processes, plans and structures provide an important foundation, but their effectiveness depends on how people communicate, collaborate and make decisions under pressure. That is precisely why exercising remains such a vital part of the Dutch approach.

By bringing organisations together, testing assumptions and learning from mistakes before a real crisis occurs, the sector strengthens not only its procedures, but also the trust and relationships that underpin the TCO structure itself. Or, as Petra puts it, if an exercise leaves everyone feeling comfortable, it probably has not achieved its purpose.