Danish financial sector stress test reveals resilience gaps

This report presents the results of a pioneering sector-level stress test of operational resilience, jointly conducted by the Danish Financial Supervisory Authority and Danmarks Nationalbank in 2025.

The exercise involved 11 key financial actors, including Danske Bank, Nordea, and VP Securities A/S.

Unlike previous tests focusing on individual firms, this initiative examined how the entire sector manages an extreme yet plausible ICT incident in the securities area.

The test provided valuable insight into strengthening crisis management, recovery, and continuity of critical functions when the entire sector is affected, challenging the assumption that the rest of the sector operates normally during a crisis.

This approach, the first of its kind in the EU, shifts the focus from individual preparedness to collective resilience, recognizing the high degree of interconnectedness within the financial sector.

The financial sector faces a rapidly evolving threat landscape, with cyber threats, ransomware, and AI creating more complex and unpredictable risks.

AI, in particular, can both enhance defenses and enable more advanced, efficient attacks targeting multiple firms simultaneously.

This necessitates not only robust defenses but also the ability to maintain and restore critical business processes during and after prolonged operational incidents.

The test scenario involved a gradual manipulation of trading data over weeks, making discovery, response, and recovery challenging, especially if backups were compromised.

This scenario aimed to test how business continuity and recovery processes are managed when backups are compromised, how cooperation functions in restoring shared critical data, and how firms balance joint and local contingency plans.

The securities area was chosen for the scenario due to its foundational role in the sector, where a technical disruption can quickly impact the entire financial system.