Banks affected by IT outage: what customers lose, and how to count it

The banks affected by IT outages in the UK's best-documented recent record are nine of the largest banks and building societies, which reported to Parliament's Treasury Committee at least 158 IT failure incidents and at least 803 hours of unplanned outages between January 2023 and February 2025: Barclays, HSBC, Lloyds, Nationwide, Santander, NatWest, Danske Bank, Bank of Ireland and Allied Irish Bank. What customers lose in such an outage is rarely measured in hours alone. It is the rent payment that misses its due date, the salary that cannot be moved on payday, the customer with a support need who cannot reach anyone. Since March 2025 UK banks have had to show that their important business services stay within impact tolerances set in exactly those terms of harm. Botminds' Operational Resilience Management is an agentic solution for that work, and its Impact agent counts the payments, value and customers a disruption would hit, from a real day's volumes.

The public record on this page comes from the Treasury Committee and the FCA, linked where it appears. The worked example is the solution's fictional sample bank, Corvane Bank UK, and one disruption window replayed through its payments hub.

Which banks were affected by IT outages?

Nine banks and building societies reported their outages to the Treasury Committee, which published the data on 6 March 2025. "Nine of the top banks and building societies operating in the UK accumulated at least 803 hours, the equivalent of more than 33 days, of unplanned tech and systems outages in the last two years," the Committee said, and "At least 158 banking IT failure incidents affected millions of customers' ability to access and use services between January 2023 and February 2025" (House of Commons Treasury Committee, 6 March 2025).

The totals understate the period's disruption. The Committee noted that its data "does not include the most recent outages affecting Barclays customers between 31 January – 2 February and various banks on 28 February", the last of which fell on a payday. For the Barclays outage alone, the bank told the Committee that 56% of online payments failed during the incident and that it expected to pay between £5 million and £7.5 million in compensation for "inconvenience or distress".

Outside the UK record, the largest single event of recent years was not a bank failure at all. On 19 July 2024 a defective content update to a widely used security product crashed Windows systems; the FCA found "varying degrees of operational impact on regulated firms, with no sector more impacted than others, and minimal consumer harm" (FCA, CrowdStrike outage lessons, October 2024). The firms that coped best, the FCA said, had mapped their services and the resources behind them and could prioritise what to bring back first.

Why do bank IT outages happen?

The banks' own answers to Parliament point to three causes: suppliers, change and software faults. "Common reasons given for the IT failures include problems with third-party suppliers, disruption caused by a change in systems and internal software malfunctions" (Treasury Committee). The FCA's incident data agrees on the first: "Between 2022 and 2023, third-party related issues were the leading cause of operational incidents reported to us" (FCA).

The causes matter for the customer because they decide how a disruption unfolds. A failed change is often reversible within hours if the rollback was planned. A supplier outage is not in the bank's hands at all, and its length depends on whether the bank can switch to an alternative that does not share the same failure. Two suppliers that turn out to run in one cloud region is the case the sample bank found in its own map.

What was the TSB IT failure, and what did it cost?

TSB's April 2018 migration to a new IT platform is the UK's reference case for a bank outage priced by its customers' losses. The data migrated, but "the platform immediately experienced technical failures", disrupting branch, telephone, online and mobile banking. "All of TSB's branches and a significant proportion of its 5.2 million customers were affected by the initial issues," and "it took until December 2018 for TSB to return to business-as-usual" (FCA press release, 20 December 2022).

The regulators' findings were about governance and suppliers, not code: TSB "failed to organise and control the IT migration programme adequately, and it failed to manage the operational risks arising from its IT outsourcing arrangements with its critical third-party supplier." The FCA's enforcement director added a line that now sits at the centre of the UK rules: the failings "had a real impact on the day-to-day lives of a significant proportion of TSB's customers, including those who were vulnerable."

How much compensation do banks pay for outages?

It varies by orders of magnitude, from tens of thousands of pounds to tens of millions, and the variation follows the number of customers hurt and how long they could not pay or be paid. In the Treasury Committee's data, Barclays "could pay out up to £12.5 million in compensation due to outages", while "The second highest amount paid out by a firm in the last two years is £350,000 by the Bank of Ireland" (Treasury Committee). TSB's redress after a migration that ran for months was £32.7 million.

Compensation is the visible end of the harm, not its measure. It pays for fees, missed-payment charges, interest and distress after the event, usually through complaints. The UK rules ask a bank to estimate the harm before the event and to set its tolerance where harm becomes intolerable, which is a different calculation from what it ends up paying.

What happens to customers when a bank goes down?

Customers cannot see balances, make or receive payments, use cards, or reach the bank, and the harm compounds with time and with the customer's situation. The FCA puts it plainly: disruption "can cause wide-reaching harm to consumers like being unable to access their accounts or pay bills" (FCA, operational resilience). The same hour costs a salaried customer with savings an inconvenience and a customer with a rent payment due today a late fee or worse.

For families and individuals living paycheck to paycheck, losing access to banking services on payday can be a terrifying experience.

Dame Meg Hillier MP, Chair of the Treasury Committee, 6 March 2025

That is why the UK rules tell banks to weigh "the nature of the client base, including any vulnerabilities that would make the person more susceptible to harm from a disruption", "the time criticality for clients receiving the service" and "the potential financial loss to clients" when setting tolerances (SYSC 15A.2.4G and 15A.2.7G). A tolerance that ignores who the customers are has measured the system, not the harm.

An outage drawn against the customer's clock, not the system's

How do you measure customer harm from an outage?

Replay a real day's transactions through the disruption window and count what falls inside it: the number and value of payments, the customers behind them, the customers with a recorded support need, and the payments that were due that day. Annual averages do not work, because harm concentrates in the hours that matter. The FCA has pushed banks the same way, telling them that most tolerances have been set as time limits alone and that further metrics can be built from the types of customer, the value and type of transactions, how critical each transaction is and the losses expected (FCA, May 2024; the impact tolerance definition quotes the passage).

The order of the rows matters. The first three describe the size of the outage. The last three describe the harm: who could least absorb it, what had a deadline, and how much of it fell after the point the board said was intolerable. In the sample, the agent's conclusion was "intolerable harm is likely", with 38,200 payments missing their due day and 4,870 customers with a support need unable to pay.

Who would be hurt, and how much: one day replayed through the outage

Payday is not a Tuesday: why the peak day sets the tolerance

A tolerance has to hold on the worst day, not the average one. The FCA's guidance says a firm should account for "fluctuations in demand for its important business service at different times of the day and throughout the year" so that its tolerance is "appropriate in light of the peak demand" (SYSC 15A.2.8G), and the PRA says a tolerance must hold at peak times as well as on an ordinary day (SS1/21, 3.9).

Payday raises delayed payments by under a third but payments due that day by three fifths. The payments with deadlines grow fastest on the day people are paid, which is the day the Treasury Committee's chair singled out. A bank that set its tolerance from a Tuesday has set it for a day its customers can best afford to lose.

What do regulators require after an outage?

In the UK, a bank must tell its regulators promptly, communicate with customers, learn from the disruption and fix what it found. The FCA expects to hear of any breach of an impact tolerance (SYSC 15A.2.11G); the firm "must provide clear, timely and relevant communications to stakeholders in the event of an operational disruption" (SYSC 15A.8.3R); and it must "conduct a lessons learned exercise" after a disruption and make the improvements it identifies (SYSC 15A.5.8R and 15A.5.9R).

The reporting itself is about to change. Until 18 March 2027 firms report material incidents to their supervisor under Principle 11; after that date a single form will apply across the FCA, PRA and Bank of England, for incidents that risk intolerable harm to consumers from which they cannot easily recover, among other thresholds (FCA, reporting operational incidents). The 2027 incident reporting rules are set out in full in their own guide. A bank that already counts harm by window and by customer type will find the new forms ask for numbers it has.

To see a disruption counted on your own volumes, start from Operational Resilience Management. The tolerance those counts support is the subject of what an impact tolerance is.

Questions people ask

Which UK banks had the most IT outages?

In the Treasury Committee's data for January 2023 to February 2025, the nine firms reported at least 158 incidents and 803 hours in total. The Committee published each bank's letter and gave totals rather than a league table of outage hours, and it said the figures excluded the Barclays outage of 31 January to 2 February 2025 and the outages of 28 February.

What was the TSB IT failure?

In April 2018 TSB migrated its customer data to a new IT platform, which failed immediately; branches, telephone, online and mobile banking were disrupted and full service took until December 2018. The FCA and PRA fined TSB £48.65 million in December 2022, and TSB paid £32.7 million in redress.

Do banks have to compensate customers for outages?

Banks pay redress where customers suffered detriment, and the amounts reported to the Treasury Committee ranged up to £12.5 million for Barclays. The operational resilience rules do not set compensation; they require banks to stay within impact tolerances set at the point where harm to customers becomes intolerable.

What is the most common cause of bank IT outages?

The banks' letters to the Treasury Committee cited third-party suppliers, system changes and internal software faults as common reasons. The FCA reported that third-party issues were the leading cause of operational incidents reported to it in 2022 and 2023.

How do banks protect vulnerable customers in an outage?

The UK rules tell banks to consider vulnerabilities when identifying important services and setting tolerances, and to choose communication methods that take account of customers' needs (SYSC 15A.8.2G). In practice that means counting customers with a recorded support need in each disruption scenario, as the sample bank's 4,870 shows, and planning workarounds for them first.

Does an outage have to be reported to the FCA?

A material operational incident should be reported now under Principle 11, and a failure to meet an impact tolerance is something the FCA expects to be told about. From 18 March 2027, reportable incidents follow PS26/2: an initial report as soon as practicable and, the FCA expects, within 24 hours of the firm determining a threshold is met.