What Nordic and Ukrainian banks can learn from each other

Resilience is easy to discuss when systems are running, infrastructure is stable and tomorrow looks more or less like today.

Ukraine offers a very different perspective. Despite years of extraordinary disruption, Ukrainian banks continue to provide essential services to businesses and citizens. They have been forced to rethink infrastructure, decision-making, dependencies and innovation, not as separate initiatives, but as parts of the same operating model.

That was at the heart of Itera's Oslo Innovation Week event, “The future of financial services: innovation, resilience and readiness.”

And perhaps the most important conclusion was this:

From recovery plans to continuous operations

For many financial institutions, resilience has traditionally meant preparing to recover after an incident. The Ukrainian experience challenges that assumption. Banks have had to operate through prolonged uncertainty, while adapting physical and digital infrastructure, securing connectivity and power, strengthening cybersecurity and changing how decisions are made. This has required an evolution from centralised structures towards operating models that can continue functioning even when normal conditions disappear.

For Nordic banks, the lesson is not to replicate Ukrainian solutions. The conditions are fundamentally different. The lesson is to ask a harder question: If disruption lasts for days, weeks or months rather than hours, which services absolutely must continue, and what would it take to keep them running?

That changes the conversation from disaster recovery to minimum viable operations. Payments, identity and communication become critical.

Architectures need portability. Decision-making needs to work when information is incomplete. And dependencies need to be understood well beyond the first tier of suppliers.

Resilience extends far beyond your own technology

One theme returned throughout the discussion: a bank can have resilient applications and still be unable to serve its customers. Why? Because financial services depend on an ecosystem. Power. Telecommunications. Cloud and data centres. National registers. Payment infrastructure. Suppliers and their subcontractors. Even the ability of employees to get to work and perform their jobs. As one of the discussions highlighted, there is little value in having a payment system available if the customer's local shop has no power or connectivity.

This makes resilience a value-chain challenge, not simply an IT challenge. For financial institutions, that means understanding not only whether their own systems can withstand disruption, but where critical dependencies are concentrated across the wider ecosystem.

Don't choose between cloud and on-premises. Design for optionality.

The discussion also challenged one of the recurring questions in financial technology: cloud or on-premises? The Ukrainian experience suggests that the more important question may be: How easily can you move?

The participants on stage discussed combinations of on-premises infrastructure, geographically distributed capacity and cloud-based alternatives. The principle is not simply technical redundancy. It is avoiding an architecture in which one environment, location or provider becomes an unavoidable dependency.

For Nordic banks, this points towards an architectural principle with growing strategic importance: Design for portability and interoperability from day one. That can mean testing whether workloads can actually be transferred between environments, rather than assuming that a theoretically portable architecture will work when it is urgently needed.

Optionality has a cost. But in a period of increasing geopolitical and technological uncertainty, it can also have significant value.

Compliance is the floor, not the finish line.

For European banks, operational resilience is already deeply connected to regulation, particularly DORA. But the discussion raised an important distinction between being compliant and being capable. Detailed risk assessments, controls and documentation have an important role. Yet a crisis rarely unfolds according to the scenario described in a document. Ukraine demonstrates the importance of something harder to codify: organisations and people capable of adapting when events do not follow the plan.

That requires exercises, empowered teams and clear decision rights. It can also require leaders to make decisions with incomplete information. As discussed during the event, the cost of waiting for certainty can sometimes become greater than the cost of making an imperfect decision quickly.

The question for executives therefore becomes: Are we preparing to pass an audit, or preparing the organization to operate through the unexpected? Strong financial institutions need to do both.

Resilience and innovation are not opposites.

Perhaps the most interesting lesson from Ukraine is that extreme constraints have not stopped innovation. In many cases, they have accelerated it. Instead of pursuing perfect end states, organisations have had to identify what matters most, build practical solutions and continuously improve them as circumstances change. The event highlighted Ukraine's rapid digital transformation and the role digital public services now play in maintaining access to essential services. The broader lesson is significant for Nordic financial institutions: digitalisation can become part of a country's resilience infrastructure.

This is also where Ukraine and the Nordics have something meaningful to offer each other. Ukraine brings experience with rapid adaptation, decentralised execution and engineering under extraordinary constraints. The Nordic financial sector brings decades of experience in trusted infrastructure, payments and collaboration between banks, regulators and infrastructure providers.

Combining these strengths creates opportunities not just for knowledge sharing, but potentially for new services, architectures and ways of working.

From discussing resilience to practising it.

One message stood out at the end of the event: we should move from talking about resilience to practising it. For Nordic financial institutions, that could start with a few practical questions:

What are the absolute minimum services we must keep running?
Where are the hidden single points of dependency in our technology and supply chain?
Can critical workloads actually move between environments
Can teams make the right decisions if central coordination is unavailable?
Are we exercising for unexpected situations rather than only documenting expected ones?
How would our organization operate if disruption became the normal state rather than a temporary exception?

Ukraine provides no simple blueprint, nor should it. But it does provide something extremely valuable: real-world knowledge of what happens when assumptions about infrastructure, availability and stability are tested simultaneously. For almost 20 years, Itera has worked with teams in Ukraine. Today, that relationship provides more than access to highly skilled engineers. It gives us direct exposure to a technology community that has learned to build, adapt and operate in circumstances few Nordic organizations have experienced.

That knowledge should not flow in only one direction. The opportunity is to combine Ukrainian experience with Nordic expertise and build financial services that are more adaptable, more innovative and better prepared for whatever comes next.

Because resilience is ultimately not about predicting the next crisis. It is about being ready to keep moving when reality does not follow the plan.