Shock-resilient payments start with collaboration: Dutch Central Bank on resilience, geopolitics and TCO

To answer that question, we spoke with two experts from the Dutch Central Bank (De Nederlandsche Bank - DNB): Jacco Jacobs, Department head Cyber Resilience and Crisis Management, and Petra Steenbakker, Senior Policy Advisor in this blog. In a second blog that will be published in the near future, Jacco and Petra dive into the exercises organised and set up for the Tripartite Crisis Management Operational (TCO) structure to train for crisis situations and how to make sure payments will remain running smoothly. 

Central bank, supervisor and a key player in payments and infrastructure

DNB fulfils three main roles, which are reflected in the organisation: central bank function, its supervisory and oversight role, and an internal organisation that is comparable in size to a mid-sized “bank” in the Netherlands. Importantly, the supervisory oversight arm is separated from the central bank function.

Within DNB, the domain of Payments, Cash and Market Infrastructure also plays a central role. A specialised department within this domain focuses on operational resilience: Cyber Resilience & Crisis Management.

Geopolitics is changing the conversation: more focus on autonomy and dependencies

Recently, DNB has become more visible and outspoken about geopolitical risks.  An important reason: the resilience of the payment system is increasingly influenced by international developments and strategic dependencies.

Within its payments division, DNB works toward a clear mission: a payment system that is robust, accessible, resilient and secure. This includes themes such as information sharing, resilience exercises, and safeguarding compliance with laws and regulations. A key concern in today’s climate is how autonomous Europe - and the Netherlands - can remain without being overly dependent on third parties.

Highly dependent on chain partners

Our payment system is robust and safe, digitalization and outsourcing are a reason for that. However, that also means that the entire chain or partners need to work together. Because processes are distributed across multiple parties, an incident at one link in the chain can affect the entire system. Jacco Jacobs explains: “As financial institutions, we are highly dependent on chain partners. Everyone outsources extensively. On the one hand, that is very efficient, but you also need to remain vigilant: if something goes wrong somewhere, it can impact all of us.”

These dependencies go beyond the direct supply chain of a bank or payment institution. Petra Steenbakker emphasises that the sector also relies heavily on vital processes and critical infrastructure outside of finance: “These dependencies are not just in the first line. The financial sector is dependent on electricity and telecommunications. You need to look not only at your own supply chain, but also at indirect dependencies.”

Resilience requires choices

Preparation is essential, but never absolute. Petra is realistic about this: “You never have 100% certainty, especially in complex crises where cyber threats, geopolitics and physical infrastructure intersect. You cannot keep investing endlessly in every possible scenario. What is possible, is learning from similar events and ensuring that individual organisations as well as the sector are structured in a way that limits impact and accelerates recovery in times of crisis. This is where the Dutch TCO structure comes into play.”

TCO: The Dutch sectoral crisis management structure

The Netherlands has a distinctive approach to collaboration in payments- and capital markets related crisis situations: the TCO structure, is a structural partnership aimed at critical processes. A structure that has been active for many years and the current context once again highlights the importance of this structure.

At its core, this tripartite crisis management structure consists of three partners: The Dutch Central Bank (DNB), the Dutch Authority for the Financial Markets (AFM), and the Ministry of Finance. DNB chairs the structure. While the current form has existed since 2012, its roots go back to around the turn of the century, and its approach continues to evolve.

The added value of the TCO structure lies in ensuring that, during crises, stakeholders act collectively instead of individually, aimed at a common purpose, without competition, and with the ecosystem as the guiding principle.

Petra describes how this works: “When the TCO structure is activated, there is no competition within it. If one institution faces a serious situation, others help with the objective to minimize impact, because it can potentially affect the entire ecosystem.”

Trust as the foundation

What makes the TCO structure particularly powerful is that it is not just a consultation platform, but an operational network built on trust. That trust must be actively developed, within the sector, but also with external and international partners.

Jacco and Petra emphasise that open information sharing is not a given everywhere. In many countries, crisis organisations (if it exists at all) are more strongly rooted in supervisory frameworks. This brings limitations, because the supervisory function has a different dynamic than a central bank role.

In the Netherlands, this openness is a distinguishing factor. Petra even calls it “very Dutch,” but also essential: “The foundation of this structure is trust. It is available 24/7, 365 days a year. If an institution calls with an incident and something is agreed upon, then we act upon it.”

Payments have no borders, so neither does resilience

Even though the TCO structure is a Dutch structure the challenge regarding resilience goes beyond national borders. Payment systems are globally connected, so disruptions and threats can spread across countries and supply chains just as easily as transactions flows. That is why international cooperation and the exchange of best practices are actively pursued, at European level and beyond. At the same time, the Dutch model remains notably unique in practice, particularly in its level of collaboration and the central bank’s role as a connector.

What this means for the sector (and the ecosystem)

The common thread in the conversation with Jacco and Petra is clear: resilience is not a checklist, but a matter of organising and (agile) adaptation. It requires continuous attention to stakeholder management, exercising, information sharing, supply chain dependencies, and crisis arrangements that work in practice, at any moment.

In a time when geopolitical tensions and digital threats increasingly converge, this is not a luxury. It is a prerequisite for maintaining trust in payments, for consumers, businesses, and society.