CAF Bank held £1.45 billion ($1.93 billion) in customer deposits at the end of its 2024/25 financial year — and a week after it suspended online banking, 14,000 UK charity customers remain cut off with no timetable for access to be restored.
Scope of the outage and who is affected
CAF Bank halted online banking a week ago and has yet to set a date for restoring the service. The suspension affects roughly 14,000 UK charities that rely on the bank’s online portal for day-to-day transactions. The Register reports the bank updated customers on Thursday and that the publication saw a customer message in which the bank said it was not yet able to restore the service safely.
What the bank says it found and how it is responding
CAF Bank told customers it detected attempted fraud on some accounts and "acted quickly to stop it." Its investigation, the message said, uncovered a previously unknown vulnerability in the connection between the bank’s systems and third‑party software. The bank stated its technical team is working around the clock with suppliers and external experts on a fix, but that it cannot restore access "until we are assured the issue is safely resolved."
Earlier this week CAF Bank chief executive Alison Taylor apologized for the disruption and emphasized that "the core bank is not affected," while acknowledging the serious customer impact. The Register understands no timetable has been set for restoring online banking.
Charities report immediate operational pain
The BBC has spoken to charities struggling to make essential payments, including payroll. Kevan Hodges, chief executive of Down's syndrome charity 21 Together, told the BBC the outage was "appalling" and said: "People are concerned that wages won't get paid because of this, and that's just stressful when they have bills to pay. My team have wasted days trying to get through to [CAF Bank], but all in vain."
Bali Rodgers, chief executive of Safer Communities Alliance, told the BBC grassroots organisations represented by her group were "slowly losing trust in the bank." The Register and the BBC reporting together underline that the interruption is affecting routine financial operations for organisations that serve vulnerable communities.
A pattern: last year’s platform rollout and unanswered operational costs
CAF Bank also faced criticism last year after the introduction of a new banking platform left customers unable to log in or make transactions. The bank later apologized for that disruption but has not disclosed how much it spent on the system. The recurrence of customer-facing platform failures — last year’s rollout and this week’s outage linked to a third‑party connection — is a concrete part of the story CAF Bank customers and observers are citing.
How technologists, charities, and suppliers are positioned
- Technologists and security teams: the bank says its technical staff are working "around the clock" with suppliers and external experts to fix a previously unknown vulnerability in a connection to third‑party software; they will be focused on identifying the vulnerability, validating any remediation, and ensuring attempted fraud has been contained.
- Charity leaders and payroll teams: charities already report stress over payroll and supplier payments, with at least one chief executive describing the situation as "appalling" and noting unsuccessful attempts to reach the bank; loss of trust was cited by a representative of grassroots organisations.
- Suppliers and third‑party vendors: they are named in the bank’s update as partners in remediation, and the unresolved connection between bank systems and third‑party software is the locus of the investigation and repair effort.
The immediate facts are straightforward: online banking for 14,000 charity customers remains suspended, CAF Bank says it found attempted fraud and a previously unknown vulnerability in a third‑party connection, and no timetable has been provided for restoring access. The bank insists the "core bank is not affected" and has pledged a technical remediation with suppliers and external experts, while charities report disrupted payroll, difficulty contacting the bank, and declining trust.
The next concrete milestones to watch are whether CAF Bank publishes a timetable for restoration, the nature of the vulnerability that linked its systems to third‑party software, and any disclosure about losses or operational costs. For now, charities dependent on the bank’s online services are managing an unresolved interruption to basic financial operations.
