Online Banking outages continue

What has led to this increase?

Alex Speedie

March 10, 2025

As digitalisation accelerates in the financial services sector, systemic failures are becoming more prevalent, resulting in a surge of online banking outages. In 2025 alone, we have already observed several significant disruptions:

End-of-month outages in both January and February affected customers of Barclays, Lloyds, Nationwide, and other financial institutions.
HSBC experienced an outage in mid-February that lasted several hours.
Santander faced disruptions last week, impacting mobile and telephone banking as well as card payments.

‍

These incidents align with a recent Treasury report surveying major financial institutions, including Barclays, HSBC, Lloyds, Nationwide, Santander, NatWest, Danske Bank, Bank of Ireland, and Allied Irish Bank. The findings revealed at least 158 banking IT failures between January 2023 and February 2025. According to the report:

Barclays anticipates compensation costs between £5 million and £7.5 million due to service disruptions.
NatWest, despite fewer outages (13), recorded the longest downtime at 194 hours, surpassing both HSBC and Barclays.

This data suggests the issue is escalating rather than improving. The key question remains: What could be driving these failures?

‍

Mainframe Performance Degradation
Legacy systems running on outdated code often require modernisation. Banks face a critical choice:
- Rewrite systems to optimise performance on modern hardware.
- Migrate existing software and data to newer but backward-compatible infrastructure.

If the latter is chosen, scalability and transaction volume capabilities become concerns, particularly as digitalisation demands continue to rise.

‍

Internal Software Malfunctions
As banks update their codebases to enhance performance and comply with open banking regulations, there is a risk of software failures. In the payments sector, such malfunctions typically manifest as transaction failures, with safeguards ensuring customer funds remain protected. However, these issues highlight the complexity of ongoing IT transformation efforts.
Third-Party Supplier Risks
The increased reliance on external vendors and service providers introduces additional vulnerabilities. Failures in third-party systems can result in widespread service disruptions, affecting online banking platforms, mobile apps, and card payments. Effective third-party risk management is therefore crucial for mitigating operational risks.
Open Banking leading to an acceleration of transactions
First launched in January 2018, since then there has been an explosion in transactions conducted thanks to the implementation of this technology. In 2024 it is estimated there were nearly 200 million transactions using open banking, compared to 70 million in 2022. Are the outages being caused by Banks struggling to handle the rise in open banking payments?

Looking ahead, there are growing recommendations for banks to establish instantaneous backup systems to mitigate outages. However, this does not come without its own challenges. Nonetheless, as outages become more frequent, industry and political pressure to restore confidence in banking infrastructure is mounting and it may be that increased regulation is the solution.

‍

The implementation of DORA compliance standards could help address many of these recurring issues. This regulation emphasises close collaboration with critical suppliers, such as data center providers, ensuring that operational failures do not lead to widespread service disruptions.

‍

Outside of DORA specific provisions, if voluntary improvements prove insufficient, stricter regulatory frameworks and increased financial penalties may become necessary. A recent Business Continuity Institute (BCI) study found that regulatory requirements are a primary driver for operational resilience implementation, suggesting that current frameworks may need to be further strengthened.

‍

Finally, the elephant in the room is Russia. The issues facing British Banks over the last few years are far greater than seen in their European counterparts. With the war in Ukraine raging, and the British seen as being central to the support being given to Ukraine, could it be that the Russians are targeting British banks as part of a campaign of hybrid warfare? If that is the case, is the DORA framework even sufficient?

‍

Share this to your socials:

Online Banking outages continue

sign up to our weekly newsletter