Banks Can No Longer Take Months: The Speed Problem in European Banking
Since Thursday afternoon, 12 November, Microsoft 365 users in many countries have had trouble reaching Outlook, Teams, SharePoint, Copilot and Defender XDR. Microsoft has pointed to an infrastructure problem that pushed system loads too high, says servers failed their health checks, and has found no evidence of a cyberattack. By early Friday, it was still describing service as degraded, although recovery was improving across more of the affected infrastructure. For most offices, this has meant two awkward days without email.
For a financial sector that runs more and more of its operations on a small number of cloud platforms, it is another reminder of how quickly a technical fault at one provider becomes a business problem for everyone who relies on it. It is not the first reminder this autumn.
Less than a month ago, the same lesson started in a single building in London. At 06:53 on Tuesday 20 October, the London building that hosts one of the three zones in Google Cloud's London region lost its mains power. The backup generators did not start. Google's incident report says a design flaw and a misconfigured controller meant they were never told to start, so the batteries ran down and at 07:00 the zone went dark. Google puts the disruption at six hours and eight minutes. Its own list of corrective actions runs to 18 December.
By breakfast, Revolut customers across Europe reported they could not pay or sign in, and that evening Revolut attributed the disruption to the Google Cloud outage. Lloyds and HSBC reported problems the same morning, though neither group has said whether the same failure was behind them. One power fault in one building had reached a bank's customers across Europe, the kind of failure the ECB had warned about three weeks earlier. By the next day the European Banking Authority said it had been in contact with Google to assess the impact on EU financial firms. Google Cloud has been under direct EU oversight as a critical third-party provider since last year, and Reuters called the outage the first major test of those rules.
The supervisor had already said it
On 1 October, Patrick Montagner of the ECB's Supervisory Board spoke in Paris about dependencies on cloud and third-party providers. 'A weakness at one big provider can simultaneously affect several banks,' he said. Artificial intelligence, he went on, can shorten the time between identifying an IT weakness and exploiting it, and in that context 'banks can no longer take months to fix shortcomings'.
The day before, in Bali, Frank Elderson, Vice-Chair of the ECB's Supervisory Board, had called AI-enabled cyberattacks a 'gamechanger in the threat landscape'.
Both speeches followed Claudia Buch's July letter asking bank chief executives for action plans on AI-enabled cyber threats by 31 October, the subject of last month's piece on this site. In a written overview for the Eurogroup on 9 November, the ECB said it is 'now assessing these plans to identify areas for improvement'. Three days earlier, Supervisory Board member Sharon Donnery put the expectation plainly: 'Identifying weaknesses must lead to timely corrective action.' What this autumn adds is a unit of measurement. The question is moving from whether a bank has a plan to how long the plan takes.
The window has closed
The reason for the new tempo is set out in a paper from the BIS Financial Stability Institute, published on 9 September. Frontier AI models, the authors write, are 'collapsing the window from discovery to exploitation', with unpatched software becoming the leading initial access vector in many incidents. The paper's policy conclusion is modest: no new AI cyber regime, but faster patching, quicker response and recovery, and governance that takes decisions in time.
Bank of America showed the cost of patching on 14 October. Brian Moynihan, its chief executive, told CNBC that the bank had brought in 1,000 contractors in the second quarter to patch flaws, in its own code and its vendors' code, that frontier models including Anthropic's Mythos had exposed. Those contractors are still there, he said, working 'on top of the 3,000 people we have in that area'. Remediation and anti-money laundering work together added more than USD 200 million to third-quarter costs, he told analysts.
Finding flaws has become cheap and fixing them has not. Every confirmed flaw still needs a person to change the code, test it and release it without breaking a payment. Patch capacity is now a budget line.
Sometimes the way in runs through a supplier. On 4 November Crédit Mutuel Arkéa said that attackers 'used the platform of one of our service providers' to reach the bank directly. It later put the amount taken at about EUR 100 million and said customer assets were not affected. A provider can switch a bank off, as on 20 October, or let someone in.
Old problems, same root
The slower kind of failure persists, too. On 5 October De Nederlandsche Bank published a fine of EUR 722,160 against the e-money institution Modulr Finance for serious shortcomings in monitoring its customers from January 2023 to July 2024. It had relied heavily on intermediary partners, including crypto-asset service providers, and so had insufficient insight into its own customers.
Six days earlier, FINMA concluded its fifth enforcement proceeding against Julius Baer in less than ten years, over private debt lending and the handling of two Russian politically exposed persons. FINMA has no power to fine. Instead it is confiscating around CHF 10 million in profits, holding the bank to CHF 250 million in additional capital until it has divested clients outside its risk appetite, and requiring reports on risk and compliance culture. The ruling is not yet legally binding. If it stands, weaknesses FINMA first acted on in 2023 will carry obligations that run to 2032.
Fraud controls are being rebuilt as well. Verification of payee, the name-to-IBAN check that euro-area payment providers have had to offer on euro transfers since October 2025, turned one on 9 October. By March it was handling close to one billion requests a month, the European Payments Council reported. Figures it presented in August, as reported by Qombo, put the share returning no match at around 15%. In Belgium, Febelfin and the consumer protection minister have agreed a plan against phishing after losses of around EUR 93 million in 2025, from more than 11,000 reported cases. Higher transfer limits will apply only after a wait of at least four hours.
Different controls, different countries, different threats, and the same root. Each was built for a pace of risk that no longer exists, and each is being rebuilt one deadline at a time.
Rails that will not wait
Banks are also building. On 14 October Qivalis, the euro stablecoin venture backed by 37 banks across 15 countries, including ING, KBC and BNP Paribas, was authorised by De Nederlandsche Bank as an electronic money institution. It has not yet issued a token: issuance is subject to MiCA requirements, including a white paper, and is planned within months. It enters a market the ECB's Financial Stability Review put at more than USD 280 billion in November 2025. Around 99% of that was in dollars. Euro tokens came to around EUR 395 million.
On 21 September the Eurosystem launched Pontes, which settles wholesale tokenised transactions in central bank money. Deutsche Bank, Santander and Société Générale were among those onboarded at launch. Full implementation is expected by 2028. In retail, more than 48,000 merchants in five countries had processed Wero transactions by mid-September. On 26 October Wero began replacing iDEAL for online payments in the Netherlands, live for customers of 11 Dutch banks.
Each is a rail that a participating bank's core will have to connect to, reconcile with and keep running, and each arrives with a date. A bank whose change cycle is measured in years will be late to whichever of them it needs.
What speed now means
Innovation in banking used to mean a new feature at the front. The events of the past two months point somewhere else: innovation is the capacity to change the core quickly and safely, and that capacity has four parts.
Architecture that keeps critical services running when a single zone, or a single provider, fails.
Exit and contingency plans for each critical provider that have been rehearsed.
Patch capacity run as a standing team with its own budget.
Data that monitoring systems can rely on, because several of the slow failures in this piece began as data problems.
For technology companies selling into banks, the buyer's question has changed. It now asks how quickly a bank can put a product in, and how safely it can take it out.
None of this is a verdict on any single bank; Revolut, a bank built on the cloud, was among those disrupted on 20 October, Qivalis holds a licence, and Wero is live for online payments in the Netherlands. The question the supervisor has asked is one of speed: how long does your institution need today to fix a critical weakness, and who in the building could answer that by Friday?
If you lead innovation, technology or operations at a bank and want to compare your answer with your peers', book an innovation meeting with The Connector. If you sell into banks and want to understand what they will be buying next, reach us through FinanceX Magazine.
