What exactly fails during a terrestrial outage that this system would replace?

Cross-border payments rely on SWIFT messaging, correspondent-bank TCP/IP links and real-time gross settlement (RTGS) connections — all of which travel over submarine cables or leased terrestrial fibre. A cable cut, BGP routing incident, or targeted cyberattack can sever all of these simultaneously. The satellite layer provides an out-of-band data path that does not share any physical or logical infrastructure with the failed terrestrial network, allowing ISO 20022 payment messages to continue flowing.

Why can't the nation simply contract Starlink or OneWeb as a backup?

Commercial constellation operators route traffic through their own ground gateways, impose their own terms of service, and can deprioritise or terminate service during geopolitical disputes — exactly the scenarios a failover system needs to survive. A sovereign constellation means the nation controls the spectrum licence, the encryption keys, the gateway locations and the uptime guarantees. Commercial LEO is a viable interim measure but not a permanent substitute for sovereign continuity.

How many satellites does a minimum-viable payment-failover constellation need?

A polar or inclined LEO constellation of 6 microsatellites (each ~80 kg, Ka-band) can provide continuous single-pass coverage over a mid-latitude nation and its primary correspondent banking partners with approximately 15-minute revisit intervals, which is adequate for batch-style RTGS failover but not real-time clearing. Six satellites represent a realistic Phase 1; scaling to 12–18 adds redundancy and reduces latency to near-real-time settlement.

Does the CPMI-IOSCO framework actually require satellite backup?

The Principles for Financial Market Infrastructures (PFMI, 2012) require systemically important payment systems to maintain recovery time objectives of two hours or less and to have geographically diverse backup facilities. They do not prescribe the technology, so satellite is one compliant option among several. However, for nations where geographic diversity cannot be achieved through terrestrial diversity alone — landlocked states, island nations, or countries with limited fibre redundancy — satellite is often the only credible path to PFMI compliance.

How is the financial data secured in transit over the satellite link?

Financial messaging over satellite should be encrypted end-to-end using AES-256 (or quantum-resistant algorithms per NIST SP 800-208 for forward-looking deployments), with keys managed in hardware security modules (HSMs) held under the sovereign's custody. The satellite link itself can add an additional transport-layer encryption layer (CCSDS 352.0-B-1 security protocol). The ITU-T X.805 framework provides the overall security architecture reference for the end-to-end channel.

What is the realistic procurement and deployment timeline for a sovereign constellation?

From cabinet approval to first operational pass: ITU coordination and filing take 12–24 months, satellite manufacturing for microsatellites runs 18–30 months (some overlap is possible), launch procurement 6–12 months, and ground-segment build and regulatory clearance 12–18 months. An aggressive but credible end-to-end timeline is 36–42 months. Nations in urgent need can lease capacity on an existing allied constellation as a bridge while the sovereign asset is built.

Can a single constellation serve both military communication and payment failover?

In principle yes, and dual-use design reduces per-unit cost significantly. In practice, military and financial-sector security classifications impose conflicting requirements on key management, access control and audit logging. Most programmes separate the payloads but share the bus and launch vehicle, achieving cost efficiency without security compromise. ESA's Phi-Lab and several national space agencies have published dual-use constellation architecture studies supporting this approach.

What happens to data latency when the satellite is low on the horizon at handover?

During handover between LEO satellites, link margins tighten and latency can spike to 80–120 ms for 2–5 seconds. For RTGS batch settlement this is inconsequential. For real-time clearing systems, the payment gateway must implement a brief hold-and-retry buffer — typically 500 ms — to absorb handover gaps gracefully. This is a standard feature in financial-grade LEO terminal software and should be specified in the system requirements document at procurement.

12.8.4Live

Cross-Border Payment Failover

Woman at a mobile money agent kiosk in a rural Kenyan market completing a cash transfer transaction — Satellite failover ensures this contactless café payment completes instantly, even when terrestrial networks fail across borders.

Satellite Failover Keeps Cross-Border Payments Live

1
Satellite Constellation
LEO/GEO birds relay encrypted payment signals
2
Downlink Gateway
Ground station receives failover transaction stream
3
Clearing Engine
ISO 20022 messages routed to backup settlement rail
4
Recipient Bank / Agent
Funds credited within seconds despite terrestrial outage

When terrestrial internet fails, the satellite link automatically reroutes payment messages to keep cross-border settlements uninterrupted.

Page in the build queue

This application has its place in the atlas. The full page — short and long descriptions, what-matters bullets, sovereignty rationale, and the eight-field architecture block — is being written next.

Maturity reading: Operational systems exist with paying customers. Phase 1 built §4.1 (Maritime Intelligence) end-to-end as the depth-and-format reference. Section 4 is the next section to graduate from scaffold to full content; the rest follow on the roadmap.

Related applications

12.8.3 · Previous

Banking Network Continuity Backups

All in financial sector sovereign continuity

12.8.5 · Next

Stock Exchange Disaster Recovery

Bring this into your sovereign programme.

All solutions Speak with engineering