Payments - Introduction / Learning brief
Risks in Payment Systems
Your notes
In simple terms / 01
What this means in plain language
Payment systems carry credit, liquidity, settlement, operational, systemic, and legal risk. This guide names each risk plainly and explains the main mitigations, from settlement in central-bank money to payment-versus-payment and netting with finality.
Moving money is never entirely free of risk, and payment systems are designed around a small set of named risks. Credit risk is the chance that a party fails to meet an obligation when it is due. Liquidity risk is the chance that funds are not available at the moment they are needed, even from a party that is fully solvent. Settlement risk is the chance that a payment does not complete as expected, sometimes after one side has already paid. Operational risk covers failures of systems, people, and processes, including cyber incidents. Systemic risk is the danger that one failure cascades through the system to others, and legal risk is the chance that a transfer is not enforceable as intended. Payment systems reduce these risks with tools such as settling in central-bank money, real-time gross settlement, payment-versus-payment and delivery-versus-payment, netting with legal finality, and collateral or prefunding, guided by international standards for financial market infrastructures.
Complete lesson / 02
Understand the full idea, step by step
In June 1974, German regulators closed Bankhaus Herstatt at the end of its Frankfurt banking day. Counterparties had already paid the bank the Deutsche Mark legs of that day's foreign-exchange trades — but New York was still open, and the dollars Herstatt owed back were never sent. Whole principal amounts, paid and not received. Fifty years on, payment systems are still designed around the risks that day made unforgettable.
| Risk | What it means | What it looks like on the day |
|---|---|---|
| Credit risk | A counterparty cannot meet an obligation when due — the money may never come | A participant is insolvent; its unsettled positions are losses someone must absorb |
| Liquidity risk | A solvent counterparty does not have the funds at the moment they are needed | A participant misses a settlement cycle but pays later; others must bridge the gap |
| Settlement risk | The umbrella: a payment does not complete as expected — including principal risk, where one side pays in full and receives nothing | The Herstatt pattern: one currency leg paid, the other never arrives |
| Operational risk | Systems, people, or processes fail — outages, errors, cyber incidents | The settlement platform is down; nothing is wrong with anyone's money, and still nothing moves |
| Systemic risk | One failure cascades: sound participants are dragged down by an unsound one | A default at noon leaves others short at two, and their counterparties short at four |
Gone or late — the distinction everything rests on
The line between credit risk and liquidity risk is the most useful cut in the whole taxonomy. Credit risk is gone: the counterparty cannot pay, now or later, and the exposure is a loss. Liquidity risk is late: the counterparty is sound, but the money is not where it needs to be at the moment it is needed, and the exposure is a delay someone must fund. The distinction decides the response — a liquidity problem is bridged with credit and collateral; a credit problem triggers default procedures and loss allocation. Diagnosing one as the other, in either direction, is how a manageable afternoon becomes a bad week.
Settlement risk — the risk that settlement does not take place as expected, packaging credit and liquidity dimensions
Settlement risk is the umbrella over the moment of truth. Its most severe form is principal risk — paying away the full value of your side and never receiving the other, the specific lesson of Herstatt. Principal risk is worst where the two legs of an exchange can be separated in time or place: the two currencies of an FX trade, or a security and its cash.
The mitigations, in layers
Systems answer these risks in layers, each aimed at a specific exposure. Settlement in central-bank money removes the credit risk of the settlement asset itself. Real-time gross settlement makes each high-value payment final one at a time, so exposures never accumulate. Payment-versus-payment (PvP) ties the two currency legs of an FX trade together so neither settles without the other — the direct answer to Herstatt — and delivery-versus-payment does the same for securities and cash. Netting with legal finality shrinks what must actually move, provided the law upholds the net when a participant fails. Prefunding, collateral, and position caps measure and secure the exposures that deferral creates, and liquidity-saving mechanisms cut the funding a gross system demands. Above all of it sits oversight: the CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI) set the international expectations a systemically important system must meet.
If netting reduces liquidity risk, does it not increase credit risk?
It trades one for the other — that is the honest way to say it. Netting means less cash must move, but obligations stay open until the cycle settles, which is credit exposure. Well-designed systems buy the liquidity saving and then pay down the added credit risk deliberately: caps on net positions, collateral or prefunding sized to cover the largest exposures, loss-sharing rules for the remainder, and — critically — legal certainty that the netting itself survives a participant's insolvency. A control that reduces one risk should always be checked for what it does to the others.
WHAT IF — In the drill, Nordbank cannot fund its net debit position at the noon cycle
What happens: The cycle does not collapse. Delta invokes its default procedures: Nordbank's prefunded collateral covers its position up to the agreed cap, the cycle settles at Central Bank Omega for everyone, and payees keep the payments already accepted.
How it is handled: Maya's checklist at Bank Alfa: confirm the cycle settled and Bank Alfa's own position is clean; identify any exposure to Nordbank outside the scheme's protection; and watch for the second-order effect — counterparties who were expecting money from Nordbank and may now be short themselves. The overseer is informed; whether Nordbank's problem was liquidity or solvency determines everything that happens next.
COMMON CONFUSION
“A solvent bank cannot cause a settlement problem — risk only comes from banks that are going under.”
A perfectly solvent bank that misses a settlement deadline creates real exposure: counterparties planned on that money, and some of them now cannot fund their own obligations on time. Liquidity risk propagates through timing, not solvency — and because payment obligations chain together, one late payer can make several others late. This is precisely why systems police intraday funding and not just capital.
REMEMBER IT
Four words carry the taxonomy: credit is gone, liquidity is late, operational is broken, systemic is contagious. Settlement risk is the umbrella where gone and late meet the moment of exchange — and principal risk is its worst case.
FOR NOW, REMEMBER
- Credit risk is a counterparty that cannot pay; liquidity risk is one that cannot pay yet — the responses to each are different, so the diagnosis matters.
- Settlement risk packages both at the moment of exchange; principal risk — pay in full, receive nothing — is the Herstatt lesson.
- Operational risk stops sound money from moving; systemic risk is one failure cascading into many.
- Mitigations layer up: central-bank money, RTGS finality, PvP and DvP, netting with legal finality, prefunding and collateral — under PFMI oversight.
TRY IT YOURSELF
At the drill debrief, Maya reviews the scripted facts: Nordbank was fully solvent, but an operational failure at its funding bank meant its money reached Central Bank Omega two hours after the noon cycle. Meanwhile two other participants, expecting inflows from Nordbank, had to draw emergency intraday credit. Which risks did the drill exercise?
Herstatt's specific problem — two currency legs settling apart — got a specific answer. Next, how payment-versus-payment settlement works in practice, and the infrastructure built to deliver it for foreign exchange.
KEEP GOINGKey takeaways / 03
Three things to remember
- 01
The core risks are credit, liquidity, settlement, operational, systemic, and legal; each names a distinct way a payment can go wrong.
- 02
Settlement risk includes principal risk, where one party pays but never receives the other side, the classic lesson of the Herstatt failure in foreign exchange.
- 03
Mitigations layer up: central-bank money, real-time gross settlement, payment-versus-payment and delivery-versus-payment, netting with finality, and collateral, framed by the CPMI-IOSCO Principles for Financial Market Infrastructures.
Practical use cases / 04
Where you would use this
A foreign-exchange desk uses payment-versus-payment settlement so that neither currency leg is released unless both legs settle together, removing principal risk.
A central bank runs a real-time gross settlement system so that large-value payments settle one by one in final central-bank money rather than piling up unsettled exposures.
A clearing house requires members to post collateral and prefund positions so that one member's default does not cascade into systemic failure.
Worked example / 05
Put the idea into a real situation
Illustrative example: Bank Corvara in one time zone pays out 5,000,000 in euros to Bank Solano at 09:00, expecting 5,300,000 US dollars back later that day. If Bank Solano fails before it sends the dollars, Corvara has paid the full principal and received nothing, which is principal risk, a form of settlement risk once seen in the Herstatt case. Under a payment-versus-payment arrangement the two legs are linked, so the euros are only released if the dollars are released at the same instant, and the loss cannot occur. Netting with finality would further reduce the amounts actually exchanged, and settling in central-bank money would make each settled payment final and irrevocable.
Evidence & review / 07
Evidence & review
General risk taxonomy for payment systems, anchored to the CPMI-IOSCO PFMI; the Herstatt episode (1974) is historical context
What this brief simplifies: Legal risk is touched only through netting finality rather than treated as a separate section; default-arrangement mechanics (collateral sizing, loss-sharing waterfalls) are system-specific and described qualitatively.
Sources for this brief3
- Official requirement
Principles for financial market infrastructures ↗ — CPMI and IOSCO (Bank for International Settlements) · Principles on credit risk, liquidity risk, settlement finality, money settlements, and operational risk
Published by the CPSS (now CPMI) and IOSCO; contains 24 principles plus responsibilities for authorities. This site uses it only for high-level concepts such as settlement finality.
- Market practiceMarch 2003 edition
A glossary of terms used in payments and settlement systems ↗ — CPSS (now CPMI), Bank for International Settlements · Definitions of credit, liquidity, settlement, principal, operational, and systemic risk
Terminology has evolved since this edition; newer CPMI publications refine some definitions.
- Simplified educational illustration
Payments Signal editorial teaching models — Payments Signal · Default-drill scenario and gone/late/broken/contagious framework
Used wherever diagrams, scenarios, figures, or example values are didactic constructions rather than sourced facts; every such use carries a simplifications disclosure. All people, companies, banks, and list entries in examples are fictional.