Charities' access to online accounts and, in some cases, the ability to run payroll is at stake after CAF Bank — the Charities Aid Foundation-owned lender serving about 14,000 charities — suspended its online banking service on July 24 while it fixes a newly discovered security weakness.
CAF Bank suspends online banking and notifies customers
The bank confirmed in a message to customers, seen by The Register, that its online services have been unavailable since July 24 and "will be unavailable until further notice." The communications said the decision followed reports of "suspicious activity on some customer accounts" and that the bank had detected the problem early and notified customers of any attempted fraud.
In a statement, CEO Alison Taylor said: "We have informed CAF Bank customers that the online banking service will be unavailable until further notice. I am very sorry for the disruption and understand the frustration this can cause for our customers." She added the bank could not restore access "until we are assured the issue is safely resolved."
The technical vector: a vulnerability in third-party software connection
Following an investigation, CAF Bank identified "a previously undetected vulnerability in the connection between third-party software and the online banking portal." The bank said it is working with its technology partner on a fix and is engaging external experts to resolve the issue.
The bank also stressed that its "core banking services were not affected" and that money held in customer accounts remained safe while changes were made to the online service.
Immediate operational impact: payroll and time-sensitive payments
The outage has already affected customers: The Register reported that some organisations were "struggling to run payroll after being cut from their accounts." CAF Bank said it remained able to support customers by phone and that it was "prioritising time-sensitive payments such as payroll."
CEO Taylor acknowledged customer frustration and said the bank was "acutely aware of the impact this has on our customers and want this to be fixed as soon as possible." She declined to comment on whether the bank will compensate customers whose operations were disrupted.
Recent platform history and financial scale
CAF Bank's decision to take online services offline follows a prior period of disruption last year when customers experienced problems logging in and making transactions after the bank introduced a new banking platform. At that time the bank apologised and said it was "focused on supporting its customers through the transition and helping them with the new online banking service." A CAF Bank spokesperson then also noted: "The vast majority of our customers are online, with thousands of payments being made and received every day. We are sorry for the disruption and waits on calls that some of our customers have experienced following the launch."
The bank has not disclosed how much it has spent on the platform. At the end of its 2024/25 financial year, CAF Bank held £1.45 billion ($1.93 billion) in customer deposits.
How charities, technology partners, and CAF Bank leadership are responding
- Charities and payroll teams: Some organisations have already been cut off from online access and faced difficulty running payroll; CAF Bank says it is prioritising time-sensitive payments and offering phone support to mitigate immediate harm.
- Technology partner and external experts: CAF Bank is working with its technology partner on a fix and has engaged external specialists to investigate and remediate the "previously undetected vulnerability" in the third-party connection before restoring online access.
- CAF Bank leadership and customer services: The CEO publicly apologised for disruption, emphasised that core banking functions and customer deposits are unaffected, and declined to comment on compensation while telling customers access will remain suspended until the issue is resolved.
CAF Bank's decision to cut its online portal underscores a specific trade-off: remove access to prevent ongoing or future fraud, while imposing real operational strain on 14,000 charity customers who rely on online payments. The bank has said it detected suspicious activity early, has notified affected customers, and will not reopen the portal until fixes are verified. How long that will take, whether compensation will be offered, and how customers will be made whole for missed or delayed transactions remain open questions CAF Bank has not answered publicly.
