The payment infrastructure is the foundation of the payments market

The payment infrastructure consists of systems, frameworks and services that support payment service providers in sending, clearing or settling payments. The framework for the payment infrastructure is determined by law, including the Act on clearing and settlement of payments (2024:114). In Sweden, Bankgirot, Getswish AB and the Riksbank are among the key players in the payment infrastructure. Rules on how payments should be structured and executed are mainly developed by standardisation organisations such as the Nordic Payments Council. The infrastructure is also supported by technology and communication service providers such as Swift.

Payments between financial institutions are usually made to accounts at the Riksbank in the RIX payment system. RIX consists of two services: RIX-RTGS for large-value payments and aggregated payments and RIX-INST for individual instant payments.

Illustration 1. Payment infrastructure:

(1) Individuals, companies or public authorities need to make a payment. (2) The payment is made via a service provided by the bank or another payment service provider. (3) The payment is processed in the payment infrastructure: a) With clearing (e.g. bank transfers): several payments are collected at Bankgirot before being sent on to settlement. b) Without clearing (e.g. Swish): the payment is sent directly, one by one, to settlement.(4) The actual transfer between the banks takes place in RIX – the Riksbank's system in which the banks have accounts.

Few interruptions in the payment infrastructure

In 2025, the payment infrastructure has experienced few disruptions. The Riksbank’s RIX payment system experienced some disruptions in its IT operations, which led to a couple of short interruptions in RIX-RTGS. This meant that the Riksbank was unable to meet its target of having the system available at least 99.85 per cent of the time last year. Instead, the availability rate was 99.78 per cent. Measures have been taken to reduce the risk of the same types of disruption occurring again.

Bankgirot had good availability during the year with only a few operational disruptions. These were due to operational incidents at subcontractors. In addition, in spring 2025, both BankID and Swish suffered several disruptions due to distributed denial-of-service attacks (DDoS). Since then, their protection has improved and the attacks have decreased, resulting in higher infrastructure availability in the autumn.

Payments under threat from cyber attacks

In autumn 2025, cyber attacks against financial infrastructure decreased compared with spring 2025, but the threat landscape remains. It is mainly distributed denial-of-service attacks that threaten infrastructure. At the same time, protection against such attacks has been improved, which has contributed to their effective management. A strong focus on preventing and managing cyber threats is central to increasing resilience.^[39] The risks in the financial infrastructure are described in more detail in Financial Stability Report 2025:2 (Riksbank). Another growing concern is that threat actors are rapidly exploiting new technical vulnerabilities, while AI is being used for fraudulent purposes, as described by the Finance Sweden and others in their threat assessment.^[40] Hotbildsbedömning för Sveriges banker(Finance Sweden, Swedish only).

More types of actor can use the payment infrastructure

Changes in European legislation have made it possible for more types of actor to participate in payment infrastructures such as the Riksbank's RIX payment system and Bankgirot.^[41] The EU Finality Directive which is implemented in Lag (1999:1309) om system för avveckling av förpliktelser på finansmarknaden. Payment institutions and electronic money institutions can now also apply to become participants in such systems. This means that they can now participate in RIX, subject to certain restrictions on maintaining the security of the system.^[42] The description of the special requirements and limitations can be found in Terms and Conditions for RIX and monetary policy instruments. This confirms the conditions for competition and innovation on the payments market. However, the participation of more and new actors in payment infrastructures such as RIX can entail risks. In particular, if participants do not have adequate procedures and processes to deal with unexpected situations such as incidents, communication breakdowns or other events affecting the payment system. To manage the risks, the Riksbank sets high requirements for participants and continuously monitors their compliance.

Settlement via a central bank reduces risks in the payment system

In Sweden, most people use money issued by a commercial bank when making payments, i.e. the money they have in their bank account. When we make Swish payments, pay bills, e-invoices or direct debits, these payments are settled, i.e. finalised, in the Riksbank's system – RIX. Card payments with cards connected to the Visa and Mastercard networks, which are among the most common payment methods in Sweden, are, on the other hand, settled in privately owned foreign commercial banks. Settling payments in commercial bank money is riskier than settling in the Riksbank’s system. This has to do with the fact that the Riksbank cannot go bankrupt and there is therefore no credit risk associated with settlement in the Riksbank's system.

As card payments account for more than 90 per cent of in-store payments, disruptions to the settlement of card payments can have serious consequences in the financial system. Card payments in some other countries and currencies, such as British pounds, are already mainly settled in central bank money. To increase the security of the Swedish payment system, the Riksbank has now initiated a dialogue with Visa and Mastercard on the procedures for settling card payments in Sweden. The Riksbank considers that these payments should in future be settled in the Riksbank's payment system, RIX. This would help make payments in Sweden more secure and less dependent on foreign actors.