Two figures, on purpose
In the synthetic card-authorisation service our payments extension publishes, layer 6 reads an index of 4,748 – Concentrated, second band of four, unremarkable. The same cell reports a second figure. The largest failure domain is bounded at 100% of the service, because three generation points share one certification profile and no entropy design is disclosed, so a single design behind everything can’t be excluded. On the index alone, the layer looks like a middling remediation priority. With the pair, it is the reason the service’s disclosure programme exists.
Why one number can’t do both jobs
The index answers one question, how concentrated the executing estate is, and it answers with a specific structure. Its unit is exclusive by construction, each asset counted once, shares summing to 100, which is what makes it a valid Herfindahl computation and makes two assessors converge on one value.
Failure domains do not fit that structure. A hybrid key exchange places two implementation lineages on one asset. A codebase merged from two parents places its assets in both parents’ domains, and an undisclosed supplier can be placed in no domain and excluded from none. In this data, overlap is the finding rather than noise.
Force the overlap into a partition and you either connect unrelated families through a shared intermediary or discard the overlap itself. Our diversity ladder refuses a single count of effective failure domains for exactly that reason, in writing, so nobody helpfully adds the invalid number later.
So every cell reports two figures, and neither substitutes for the other. Reach is the share of the cell’s assets whose failure domain includes a named upstream node under the stated failure mode. The node can be an ancestor codebase, a bridge authority, a multi-family manufacturer or a generation design. Reach is deliberately non-exclusive and evidence-tiered. Each node is in one of two states. Evidenced means membership is established. Bounded means it can’t be ruled out, and the node reports an interval instead of a point, known reach from evidenced edges at the bottom and everything not excludable at the top. The width of that interval is the price of a supplier’s silence, denominated in reach points, a more useful currency than indignation.
The pair at work
The same synthetic service shows the mechanics at layer 2. The index reads 4,184 and the dominant family’s upstream shows a bounded reach of [57.1%, 78.6%] – 2,400 assets evidenced, 3,300 not excludable. The service’s two-hour impact tolerance passes when the failure-impact determination runs on the evidenced domain and fails when it runs on the bound. Whether a regulatory test passes or fails depends on one supplier’s undisclosed lineage, which tells the institution what an answer is worth before anyone drafts the request. And at layer 6, closing that 100% bound is the disclosure programme’s whole objective. The index there was never the problem.
At the roll-up, the pairing is mandatory rather than encouraged. Every service report names the largest failure-domain reach across services, with its bound and its node, as a required companion to the reported index. A single institution-level number in a board pack gets quoted out of context indefinitely. Two numbers force the sentence that explains them.
Size was never the whole score
Financial regulation has made this move before. When the Basel Committee built the G-SIB assessment, in the 2013 methodology as revised in July 2018, it did not score systemic importance on size and stop. The methodology scores twelve indicators in five categories, with interconnectedness and substitutability weighted alongside size. A bank’s balance sheet and the set of institutions exposed to its failure are different facts about the same firm, and no single figure reports both. Our payments whitepaper takes the comparison one step further, as a stated proposition awaiting computation on real exposure data. Scored on those same indicators, the largest shared node beneath payments would rank above any individual bank, and no such node holds capital against that exposure.
The framework’s rule is one sentence, and the reference vectors in the published kit enforce it fixture by fixture: a cell reported with one figure and not the other is incomplete.