LinkedIn·Friday, 31 July 2026·26d ago

You can outsource payment processing. You cannot outsource resilience. That is the uncomfortable part of DORA. Since 2025, European…

ByQwest

493 followers

You can outsource payment processing. You cannot outsource resilience. That is the uncomfortable part of DORA. Since 2025, European financial institutions have had to demonstrate that critical operations survive serious ICT disruption. DORA never says "appoint a second processor." It requires something harder to satisfy: tested continuity and recovery, managed third-party concentration risk, and exit plans that are actually executable. This makes one position increasingly hard to defend at board level: A critical payment function running on a single provider, with no technically ready alternative. A signed contract is not a contingency plan. A slide titled "exit strategy" will not keep cards working. And "we could migrate" is not the same sentence as "we can keep authorising transactions." In Belgium, the concentration is stark. Bancontact Company handles more than 2.5 billion payments a year. Yet at issuer-processing level, the market has effectively offered banks two serious options. Here is the part most resilience plans quietly skip: card issuer processing does not fail over like a web tier. A credible second route means BIN routing that can actually be switched, scheme certifications held in advance rather than started under pressure, key management and HSM configuration mirrored, and token provisioning that survives the cutover. Without those, a secondary provider is a contract, not a capability. That is the work ByQwest has been doing: Bancontact Company application testing completed, a PCI DSS Level 1 issuing engine, and a platform built and operated in-house rather than assembled from third parties. Independent of the incumbents, and designed to serve as a warm secondary, a tested migration path, or a modern primary. This is not about distrusting your current provider. It is about ensuring no single provider, however established, becomes your only path to continuity. DORA turned processor selection from a procurement decision into a board-level resilience decision. So the question is no longer "how reliable is our processor?". It is: "If it becomes unavailable tomorrow, can our customers still pay?" If that question doesn't yet have a tested answer at your institution, we're happy to walk through what a second route actually requires. #DORA #OperationalResilience #Bancontact #PaymentInfrastructure #FinTechBE #Belgium #PCIDSS Guillaume Flies Benjamin BeeckmansElliot SilberwasserRose Van den Ende