T2 (formerly known as TARGET2) is a systemically-important payment system and the Real-Time Gross Settlement System (RTGS) for the euro. As such it should be a ‘5-nines’ system, enjoying 99.999% availability during its scheduled operating hours.
On 27th February it went down from 10:15 until 18:00 CET, according to the operational update message sent by the European Central Bank (ECB) on 28th February at 17:10 CET.
Our analysis of the ECB’s explanation of the outage, when set against how a top New York commercial bank had configured its Disaster Recovery and how that performed on 9/11, demonstrates that the Disaster Recovery arrangements behind T2 are synthetic to
the point of non-existence.
The two environments in the Eurozone national central bank that for the time being is running the production and first failover environments (this role rotates around) are not kept in exact synchronisation. These two environments may not even be physically
separate. They cannot be replicas of one another if, as occurred, a fault appeared in one environment and not the other.
The failover from a production to a first failover environment (the hot standby) should be instantaneous, not take several hours.
The environment in the reserve Eurozone national central bank is ‘cold’, not ‘warm’, and is incapable of being brought up on a timely basis as the second failover, as it is supposed to do when neither of the production and first failover environments are
available. It is perforce separate from the production and first failover environments, but is unlikely to be an exact replica of either.
It should have been available, and the ‘inter-region failover’ to it invoked, once the production and first failover environments had been either down or unavailable for more than a few minutes.
T2 needs to go to a single centralised IT platform, probably housed in the most neutral and unobjectionable EU venue – Luxembourg – and having two standby sites also in Luxembourg, or else it requires a large extra monetary investment in what exists now.
What exists now is a weak, politically-driven division-of-labour that falls far short – in the Disaster Recovery area – of what US authorities would permit for a Fedwire and CHIPS clearing bank.
What is expected of a member of Financial Market Infrastructures (the official umbrella term applied inter alia to payment and securities clearing and settlement systems) like Fedwire and CHIPS should be all the more expected of the Financial Market Infrastructure
itself.
T2 is a priori weak because of its concept of ‘sharing’ and the compromises that derive from that.
The T2 concept needs to be completely revised, and the hardware and application architectures and the Disaster Recovery arrangements brought up to a 5-Star standard, ensuring ‘5-nines’ availability.
