TL:DR
- Concentration risk in financial digital infrastructure poses hidden resilience threats when multiple network vendors share the same underlying physical paths and subsea cables.
- Auditing physical infrastructure dependencies — including subsea cables, terrestrial fiber and cable landing stations — reveals true network diversity gaps without requiring costly architectural rebuilds.
- Financial institutions that address concentration risk at the infrastructure layer gain redundant connectivity, flexible failover capabilities and stronger operational resilience.
Our entire global financial system relies on digital infrastructure to connect institutions with partners, providers and customers. It’s because of cable systems and data centers that funds can flow between global financial hubs in milliseconds.
About 99% of international internet traffic crosses subsea cables, including trillions of dollars in financial transactions daily.[1] When a single subsea cable fails, it can take many different service providers offline with it. These cables break about 200 times a year, and the responsibility for fixing them falls on a small, aging fleet of repair vessels—only about 20 ships globally.[2]
This illustrates an uncomfortable fact: The foundation on which our financial system rests may be more fragile than some leaders realize, and concentration risk is to blame for that.
What is concentration risk?
Concentration risk is when an organization is overly dependent on particular infrastructure, such as a specific subsea cable. Many financial firms don’t realize that signing contracts with multiple telco providers doesn’t fully address concentration risk, because those providers may all run on the same underlying physical infrastructure. Network vendor diversity doesn’t necessarily indicate network infrastructure diversity.
While most cable breaks are inconsequential, others can have a big impact:
- In 2023, the SEA-ME-WE-5 cable went offline for maintenance, and latency spiked by about 40 milliseconds across many routes.[3]
- Cable cuts in the Red Sea during 2024 disrupted an estimated 70% of data traffic between Europe and Asia.[4]
- In 2025, there were once again multiple cable faults in the Red Sea chokepoint. Providers rerouted traffic to avoid complete outages, but Microsoft Azure still reported higher latency for services routed through the Middle East.[5]
This demonstrates that concentration risk isn’t just about availability. Even when there’s a reliable failover path, increased latency can still cause problems.
Subsea cables aren’t the only source of concentration risk: In 2025, the European Central Bank (ECB) TARGET2 system went offline for about 7 hours due to hardware failure, delaying settlement of about €3 trillion in transactions.[6] Earlier this year, that same system experienced two short outages in one week, causing further disruption to euro and Danish krone payment processing.[7]
Concentration risk has traditionally been a blind spot for regulators. However, the launch of the European Union’s Digital Operational Resilience Act (DORA) could mark the beginning of a new regulatory era for financial institutions.
Regulations inspire resilience, but compliance isn’t the end goal
Third-party risk management is one key pillar of the DORA framework, requiring firms to strengthen contractual oversight over their providers and manage concentration risk. That’s because third parties can be a major source of risk: about one-third of the 3,383 major incidents reported under the DORA framework in 2025 originated with failures attributed to third parties.[8]
DORA also places critical third-party providers (CTPPs) under the same regulatory oversight as the financial customers they serve.
Compliance with DORA isn’t enough to ensure operational resilience, especially since it doesn’t apply outside of Europe. It’s true that other jurisdictions have proposed their own DORA-like frameworks, but financial firms shouldn’t wait for legislation to force them to act. They need to pursue operational resilience proactively.
How financial institutions can enable operational resilience
Real resilience isn’t measured in the number of telco contracts you’ve signed. It requires the ability to reroute workloads and swap out providers whenever the need arises, without an architectural redesign.
Firms must start by uncovering the concentration risk hidden inside their day-to-day operations. The following steps can help:
- Audit the physical infrastructure they’re dependent upon, including subsea cables, terrestrial fiber, and cable landing stations
- Ensure that perceived network diversity reflects actual network diversity, not just different vendors sharing the same routes
- Compile a complete inventory of every system, protocol and dependency, and evaluate to determine whether advances in quantum cryptography could place them at risk
- Map each workload by jurisdiction, latency requirements and data sensitivity
It’s noteworthy that these steps are about auditing current operations, not re-architecting them. Extending visibility throughout the organization can help target vulnerabilities that need to be addressed, and it doesn’t require starting over with a complex, expensive rebuild.
How Equinix is helping real financial customers enable operational resilience
Borsa Istanbul, Türkiye’s sole securities exchange, needed to streamline distribution of real-time data to European financial markets while also ensuring privacy and resilience. After working with Equinix to establish redundant private connectivity between Istanbul and London, they increased data transmission continuity by 400%.
Dojo, a U.K.-based payments provider, worked with Equinix to deploy hybrid multicloud connectivity and ensure reliable access to services from different cloud hyperscalers. The company can now process payments 80% faster than the industry average.
Both customers improved operational resilience not by adding new vendors, but by working with Equinix to ensure redundancy and infrastructure flexibility.
Also, the Forrester Total Economic Impact™ of Equinix Networking Solutions study commissioned by Equinix looked at a composite organization based on decision-makers from real companies. After adopting Equinix software-defined networking solutions, these leaders consistently reported improved operational resilience through redundant connectivity and simplified failover capabilities.
More than 1,300 financial institutions worldwide trust Equinix for private connectivity, predictable performance and jurisdiction control. We also give those firms easy access and vendor-neutral connectivity to more than 3,000 cloud and IT service providers in our dense partner ecosystem. This means that no single provider controls the physical paths that our customers depend on.
Equinix has also been designated as a CTPP under the DORA framework, making us a foundational element in the EU’s operational resilience framework.
Learn more about the fundamental shifts that are forcing financial firms to rethink the way they approach operational resilience: Read the white paper, “When continuity isn’t enough.”
[1] Sachin Gaur, Invisible highways: The vast network of undersea cables powering our connectivity, UN News, February 2, 2026.
[2] Josh Dzieza, The Cloud Under the Sea, The Verge, April 16, 2024.
[3] Doug Madory, SMW-5 maintenance leads to higher latencies between Europe and Asia, Kentik, October 25, 2023.
[4] Gyana Swain, Red Sea cable cuts disrupted up to 70% of traffic, says RETN, Network World, October 8, 2024.
[5] Nidhi Singal, Red Sea cable cuts trigger latency for Azure, cloud services across Asia and the Middle East, Reuters, September 8, 2025.
[6] Tom Sims, Francesco Canepa and John O’Donnell, ECB’s multi-trillion payments breakdown sends shutters through Europe, Reuters, February 28, 2025.
[7] ECB payment system suffers second outage in a week, Reuters, July 5, 2026.
[8] 2025 Report on major ICT-related incidents, Joint Committee of the European Supervisory Authorities, June 3, 2026.
Subscribe to the Equinix Blog