By Biagio Bossone, Advisor Consultant to International Organisations, Governments Agencies and Financial Institutions
Financial market infrastructures (FMIs) lie at the heart of today’s global financial system. Central counterparties (CCPs), central securities depositories (CSDs), trade repositories and large-value payment systems process and safeguard trillions in financial flows each day. Their effective operation ensures stability, trust and the safe execution of markets that cross borders and asset classes.
For more than a decade, the CPMI-IOSCO Principles for Financial Market Infrastructures (PFMI) (published by the Committee on Payments and Market Infrastructures of the Bank for International Settlements and the Technical Committee of the International Organization of Securities Commissions in April 2012) have provided the core regulatory architecture for these entities. These principles—voluntary in form but near-universal in influence—establish the global benchmark for the sound design and oversight of FMIs. They address key risks in credit, liquidity, governance, custody and operational domains, and they have helped raise standards across jurisdictions.
But the world has changed. FMIs are no longer slow-moving, siloed utilities governed by national central banks. Today’s infrastructures are increasingly cross-border, faster and technology-dependent. They face new pressures—from cyber risks and cloud concentration to the rise of digital assets, tokenization and programmable money. At the same time, the perimeter of FMI oversight has blurred. Non-bank clearing providers, distributed ledger platforms and novel custodial solutions are increasingly systemic in function, yet often outside traditional regulatory reach.
In this context, the Principles for Financial Market Infrastructures, while still essential, are no longer sufficient. They were designed as a set of principles, not a toolkit. They lack direct enforcement power, offer limited guidance on implementation and are applied unevenly across jurisdictions. A decade of PFMI monitoring—through the Level 1, 2 and 3 assessments conducted by the CPMI and the IOSCO—has confirmed these structural limitations. While adoption has been broad at the legislative and regulatory level (Level 1), implementation depth (Level 2) and consistency in outcomes (Level 3) exhibit significant variation, especially in recovery planning, liquidity risk and cyber resilience. As FMIs become more interdependent, the need grows for a coordinating institution—one that can turn standards into action, bridge regulatory silos and respond to risks in real time.
To find a model for such an institution, we may need to look beyond finance—to the skies.
From fragmentation to coordination: what the IATA offers
The International Air Transport Association (IATA), established in 1945, was created to solve a familiar set of problems: fragmentation, inefficiency, inconsistent standards and rising systemic risks in the global air-transport network. Airlines, airports and national regulators were operating with incompatible ticketing systems, operational protocols and safety regimes. Cross-border travel was slow, expensive and often unsafe. No single regulator could fix the problem. What was needed was a coordinating body—one with the technical expertise, operational authority and international legitimacy to bind the system together.
Over the decades, the IATA evolved into a global backbone for aviation. It now manages detailed rulebooks for everything from reservation systems to baggage handling; it operates the Billing and Settlement Plan (BSP), a centralized netting and clearing platform for global ticket sales; and it runs the IATA Operational Safety Audit (IOSA), a peer-reviewed audit regime for airline safety and risk management. Crucially, the IATA also functions as a crisis coordinator—capable of mobilizing the industry in times of disruption, such as the COVID-19 pandemic or major cyber events.
The aviation sector remains regulated by national authorities. However, the IATA provides the technical and operational substrate that allows the system to function globally. It does what no single regulator can do on its own: It ensures interoperability, enforces standards through participation rules and builds institutional trust across thousands of market actors.
FMIs today are in a position strikingly similar to that of the airline industry in the 1940s. The need for an IATA-style body to complement the CPMI’s and the IOSCO’s efforts is no longer theoretical—it is operationally pressing.
Turning principles into participation
At its core, the PFMI framework provides a normative baseline. However, it does not instruct FMIs on how to implement the standards in practice (though it provides useful guidance), nor does it offer direct incentives for adoption or penalties for non-adoption. Compliance depends on the capacity and will of national regulators, which vary widely in interpretation, enforcement and resourcing. Level 3 monitoring has found significant divergence in actual outcomes—particularly in areas such as governance effectiveness, recovery planning and operational risk management—despite formal adherence to the PFMI. Cross-border oversight remains slow, often bilateral, and reliant on informal cooperation.
The IATA offers a different enforcement logic: participation-based compliance. Airlines that fail to meet standards lose access to interlining arrangements, ticketing platforms and settlement infrastructures. Compliance is enforced not through legal mandate but through operational necessity.
A comparable model in the FMI world would embed technical rulebooks and implementation standards into access agreements for shared systems—whether they are cross-border CCP links, DvP (delivery-versus-payment) mechanisms or tokenized asset-settlement layers. Certification could become a prerequisite for participation in interoperability frameworks, ensuring that CPMI-IOSCO principles are not just aspirational but binding through systemic incentives.
Such a model would preserve national sovereignty while dramatically improving cross-border alignment. It would lend substance to the idea that global standards should lead to global outcomes.
Governing the infrastructure beneath the infrastructure
Despite ongoing efforts by the CPMI and the BIS (Bank for International Settlements) Innovation Hubto foster interoperability—such as through Project Nexus and regional connectivity pilots—global FMI infrastructure remains a patchwork. Multilateral netting platforms for securities and foreign exchange exist only in pockets. Efforts to harmonize collateral mobility, cross-border liquidity access and real-time settlement are fragmented. Emerging systems for tokenized assets are being built in silos, each with different data models, custody regimes and legal wrappers.
The IATA, in contrast, created the BSP to streamline financial flows between thousands of agents and airlines across more than 180 countries. It reduced the operational burden of bilateral settlement and created a common financial rail that is used globally.
An IATA-style institution for FMIs could play a similar role—certifying or even operating shared utilities that serve as the connective tissue between national systems. It could help coordinate the implementations of cross-border clearing mechanisms, standardized onboarding tools and trusted-identity frameworks. It could also serve as a technical interface between public infrastructures (such as central bank digital currency platforms) and emerging private settlement rails.
This would not be central planning—as it is certainly not in the case of the IATA and global airlines. It would be shared infrastructure for shared risk, built to reflect the systemic interdependence of modern FMIs.
Raising the floor on resilience
The PFMI include guidance on operational risk and require FMIs to maintain robust continuity and cyber-resilience plans. But those requirements are interpreted and assessed within national contexts. There is no global audit regime, no shared database of operational incidents and no structured mechanism for collective benchmarking or learning. Even the most recent Level 3 assessments have highlighted inconsistencies in how FMIs test and manage business continuity, with limited supervisory insight into the broader interdependencies that amplify risk.
Here, too, the IATA’s model is instructive. Through the IOSA, airlines undergo standardized third-party audits that are centrally reviewed. Audit results are shared with regulators and used to support a culture of continuous improvement. The result has been a measurable decline in operational failures and systemic safety risks.
A similar audit regime for FMIs—covering resilience, data integrity, cloud dependency and incident response—would offer immense value. It could create a common operational standard for both traditional and emerging actors, including fintechs (financial technology firms) and tech platforms performing FMI-like functions. It would enable regulators to compare system performances across borders and give market participants greater confidence in the resilience of the infrastructures on which they rely. Most importantly, it would shift the industry from passive compliance to active stewardship.
Preparing for the next crisis
FMIs must be able to respond quickly to systemic stress—whether a cyberattack, a market-wide liquidity event or a geopolitical disruption. The PFMI outline expectations for recovery and resolution, but crisis management requires a crisis command center. During times of stress, coordination still depends on fragmented communication between national authorities and FMI operators.
When COVID-19 grounded much of the world’s aviation network, the IATA coordinated repatriation flights, lobbied for regulatory exemptions and helped harmonize new biosafety protocols. It could do so because it had the trust of both the industry and the regulators, as well as pre-existing protocols and communication tools.
An FMI-coordination body, built on similar principles, could do the same in finance. It could operate a real-time system-status dashboard across key infrastructures. It could organize tabletop crisis simulations involving CCPs, CSDs, custodians and regulators. It could serve as a central node for incident reporting, data sharing and coordinated response.
In an interconnected market, the ability to respond together is as important as the ability to act alone.
A partnership, not a replacement
This proposal is not a call to replace the CPMI or the IOSCO. On the contrary, their work on standard-setting, coordination and global policy dialogue remains critical. What is needed is a functional partner—an operational institution that turns principles into performance.
Much like the IATA coexists with national aviation regulators, an FMI-focused body would complement the mandates of central banks and securities authorities. It would serve as an implementation hub, a coordination platform and a technical integrator—not a supervisor. Its legitimacy would derive not from law but from trust, participation and performance.
The seeds of such an institution already exist—in projects at the BIS Innovation Hub, in collaborative FMI pilots and in regional interoperability frameworks. However, to mature, these efforts require institutional structure, governance continuity and shared ownership.
Finally, the IATA’s role in supporting the aviation sector’s climate transition offers another compelling parallel. From coordinating industry-wide emissions targets to standardizing the use of sustainable aviation fuels and offsetting frameworks, the IATA has helped embed ecological goals into the operational logic of air transport. A similar role could emerge for FMIs, for which questions around energy usage, carbon impact and ESG (environmental, social and governance) data infrastructure are becoming increasingly salient. A global coordination body could help define climate-related operational standards, support consistent disclosures and harmonize supervisory expectations—ensuring that the green transition in finance is not only capital-led but infrastructure-enabled.
Conclusion
The Principles for Financial Market Infrastructures have provided a critical foundation for safe and efficient financial market infrastructures. But in a world of digital platforms, real-time settlement and global interdependencies, principles alone are no longer enough.
The future of FMI oversight must be designed, not assumed. It must combine policy with infrastructure, supervision with execution and ambition with architecture. If the financial world were building FMI oversight from scratch today, it would not rely solely on informal coordination and national implementation. It would build something similar to the International Air Transport Association.
The skies are safer because that institution exists. It’s time for FMIs to follow suit.
—–
Disclaimer: The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the views or positions of any of the institutions with which he is associated.
—–