Recent events at Marks & Spencer have highlighted the disruption – and the financial impact – that a cyber incident can have on any business and its payment infrastructure. The retailer was forced to suspend its contactless payments and online orders following what is widely believed to be a ransomware attack and will no doubt have incurred significant costs in responding, as well as suffering reputational damage and a loss of consumer goodwill. In the longer term, an incident such as this can badly affect investor confidence. Its intellectual property may well drop in value, adding up to a loss of competitiveness. All this underscores the importance of agile cybersecurity practices and the need for constant vigilance to guard against threats.
The global economy relies on effective, secure payments and resilient payments architecture. Although the UK has an established regulatory landscape with sophisticated financial services regulators, the payments sector is seen as suffering from "regulatory congestion". The UK's National Payments Vision, published at the end of 2024 and widely welcomed by the industry, set out the UK government's ambitions for a world-leading payments sector. The report calls for significant investment in the payment infrastructure to be made by industry to make it more resilient and reliable. Progress has already been made with developments in Open Banking and moves to streamline regulation with the transfer of the PSR's functions to the FCA. But more needs to be done and, clearly, faster. Added to this the EU's proposed Payments Services Directive 3 has fraud prevention, cyber and security clearly at its heart.
Technology advances and innovation must go hand in hand with managing risk - whether from cyber threats, fraud, IT outages or supplier failure – if confidence in the payments ecosystem is to be upheld.
