A national stock exchange is a single point of systemic risk. When a submarine cable severs, a power grid collapses, or a cyberattack severs the exchange's terrestrial backbone, the cascade is immediate: order books freeze, clearing houses lose connectivity, and investor confidence craters within minutes. Regulatory frameworks in the EU, UK, and APAC now mandate defined recovery time objectives (RTOs) of two hours or less for trading venues, but almost every existing disaster recovery plan still assumes terrestrial fallback links that share the same physical vulnerabilities as the primary path.
A sovereign satellite layer closes that vulnerability cleanly. A small constellation of LEO communications microsatellites, paired with a GNSS-disciplined timing signal, gives the exchange an out-of-band path that no terrestrial event can sever simultaneously. The matching engine at the primary data centre connects to the recovery site over a dedicated VSAT or direct inter-satellite link; atomic-clock-derived timestamps keep trade sequencing legally defensible even when the primary NTP chain is down. Payload throughput of 200–500 Mbps per beam is sufficient for equities and derivatives order-flow even at peak volatility.
The operational outcome is a measurable and auditable RTO. Regulators receive a credible continuity certificate backed by live telemetry rather than a paper promise. The exchange avoids the reputational and legal exposure of a prolonged halt, and the central bank retains the ability to intervene in markets during a crisis—the exact moment sovereign control over the communications layer matters most.
Frequently asked
Why can't a stock exchange simply use a second terrestrial data centre as its disaster recovery site?
Terrestrial backup data centres share physical risk factors — the same fibre routes, the same power grids, and often the same flood plains or seismic zones as the primary site. The CPMI-IOSCO Principles for Financial Market Infrastructures (Principle 17) explicitly warn against geographically correlated backup infrastructure. A sovereign satellite link breaks that correlation entirely: it is immune to cable cuts, regional blackouts and physical access restrictions that affect ground infrastructure simultaneously.
What is the realistic recovery time objective a satellite-backed system can meet?
A pre-provisioned satellite link with warm standby routing can achieve a recovery time objective (RTO) of under 15 minutes for order-book replication and under 2 hours for full trading resumption, meeting the DORA Regulation (EU) 2022/2554 Article 12 requirement for systemic exchanges. Achieving sub-2-minute RTO requires hot standby configurations with continuous synchronisation over the satellite channel, which is technically achievable with existing LEO constellations but demands careful latency budgeting.
How does satellite timing support MiFID II or equivalent trade timestamp compliance during a disaster?
Under MiFID II RTS 25, all timestamped trading events must be synchronised to UTC within 100 microseconds for algorithmic trading and 1 millisecond for other venues. During a terrestrial outage, NTP servers and PTP grandmaster clocks may become unreachable. A sovereign GNSS-disciplined receiver fed by a sovereign satellite signal provides an independent, traceable UTC source that satisfies the RTS 25 traceability chain, provided the ground oscillator holdover is rated for the expected outage duration.
How many satellites does a sovereign nation actually need to field for this use case?
A minimal viable configuration for a single-nation exchange continuity use case requires as few as 6–8 microsatellites in sun-synchronous or inclined LEO orbits to guarantee at least one satellite in view above 10° elevation at all times over the national territory, assuming a ground station diversity of three sites. Scaling to 24–48 satellites with inter-satellite links removes single-pass dependence and allows near-continuous coverage without ground relay, which is the recommended sovereign architecture.
Does operating a sovereign disaster-recovery constellation violate stock exchange rules or market data regulations?
No. The satellite system is an infrastructure layer, not a market participant. It carries encrypted, authenticated data between authorised nodes of the exchange — replicating order books, clearing records and market data — in the same way a private leased-line network does. Regulatory frameworks such as DORA, the SEC's Regulation SCI and MAS Technology Risk Management Guidelines explicitly encourage diversity of communication paths, which a sovereign satellite backbone provides.
What happens to end-to-end encryption and data sovereignty when traffic transits a satellite?
Traffic should be encrypted at the application layer using FIPS 140-3 or equivalent national cryptographic standards before it ever reaches the satellite modem, meaning the satellite operator — including any foreign ground station operator — sees only ciphertext. A sovereign programme should also use domestically certified encryption modules and control all ground segment key management infrastructure, ensuring no foreign jurisdiction can compel decryption of market-sensitive data.
How does this application relate to broader financial sector continuity, such as banking networks and payment systems?
Stock exchange disaster recovery is one layer of a wider sovereign financial continuity stack. The satellite backbone that keeps exchange order books replicating can simultaneously carry RTGS (real-time gross settlement) failover traffic and interbank messaging — see Banking Network Continuity Backups and Cross-Border Payment Failover in this atlas. Designing the satellite capacity and ground segment as shared sovereign infrastructure rather than single-use exchange backup dramatically improves cost efficiency and national resilience.
Is there an off-the-shelf commercial solution a nation could buy instead of building its own?
Yes — Inmarsat BGAN, Viasat ViaSat-3 and Starlink Business all offer broadband satellite backup links that an exchange could procure today. The sovereignty argument against them is threefold: the service can be terminated, price-changed or downgraded unilaterally by the vendor; traffic routing may pass through foreign ground stations subject to interception or legal compulsion; and the timing chain depends on the vendor's GNSS infrastructure rather than a nationally controlled source. For exchanges classified as systemically important financial infrastructure, that dependency is an unacceptable single point of failure.