Cashplus Bank suffered a series of IT outages between 2022 and 2024 that locked small business and personal account holders out of their money for days at a time. Users could not log in, make payments, or use debit cards. The disruptions triggered a formal Financial Conduct Authority investigation. In 2024, rather than face a public enforcement action, the bank agreed to voluntarily cap its own loan book.
Cashplus, the trading name of APS Financial Ltd, secured a full UK banking licence from the Prudential Regulation Authority and FCA in February 2021. It had operated as an e-money institution since 2005 and built a base of more than 1 million users of its digital current accounts and credit products. The licence was meant to signal stability. Instead, the IT failures that followed exposed gaps in operational resilience that regulators had not anticipated.
The outages: what happened and when
In September 2022, Cashplus experienced its first major IT failure after obtaining its licence. Account holders could not log into the online portal or mobile app for several days. The bank acknowledged the disruption on social media and said it was working to restore services. A second, more severe outage hit in March 2023. This time, payments, transfers, and card transactions failed for up to five days. Small business users who relied on Cashplus for daily cash flow management were hit hardest.
A third disruption in late 2023
A third significant outage struck in November 2023. The platform was again inaccessible, and some users saw balances that did not match the actual funds available. Cashplus attributed the problem to a failed data migration to a new core banking engine. The bank had been upgrading its technology infrastructure to support a broader product range. The migration corrupted account data, forcing a manual reconciliation that took weeks to complete.
Customer impact: locked out and left without funds
The outages had direct financial consequences. Small business owners could not pay suppliers or staff. Personal account holders could not access wages or benefits. Some incurred late fees from third parties because payments did not go through on time. Cashplus did not disclose exact numbers, but its own communications referenced a significant share of its active user base. The March 2023 event was the most disruptive. Those who contacted the bank by phone or email received automated responses saying the issue was under investigation, with no timeline for resolution.
No compensation scheme announced
Cashplus did not announce a formal redress scheme. The bank said it would waive certain fees and charges incurred during the outage periods, but it did not offer direct compensation for consequential losses. Some account holders complained to the Financial Ombudsman Service, which upheld a number of cases and ordered Cashplus to pay compensation. The Ombudsman published decisions individually. The bank never disclosed the total amount paid out.
FCA intervention: from inquiry to enforcement
The FCA opened a formal investigation in early 2023, after the second major outage. Using its powers under the Financial Services and Markets Act 2000, the regulator required Cashplus to commission a skilled person review, known as a Section 166 review. The review examined root causes, the adequacy of IT controls, and the effectiveness of incident management and communication. The skilled person's report reached the FCA in late 2023.
In parallel, the FCA considered a public censure or financial penalty. Cashplus cooperated and agreed to a series of remedial actions. The regulator decided against issuing a public enforcement notice. Instead, in March 2024, Cashplus announced it had voluntarily agreed to curb its credit activities. The bank said it would originate no new loans and raise no credit limits on existing accounts until it had fully remediated its technology estate and demonstrated to the FCA that its operational resilience met regulatory standards.
Technical root causes and remediation
The Section 166 review identified the failed platform migration as the primary cause of the November 2023 outage. The earlier disruptions in 2022 and March 2023 were attributed to software bugs, insufficient data centre capacity, and inadequate testing of changes before deployment. Cashplus had outsourced its core banking platform to a third-party vendor. The review found that the bank lacked sufficient in-house technical expertise to manage the migration or challenge the vendor's implementation plan.
Remediation plan and timeline
Cashplus submitted a remediation plan to the FCA in early 2024. It included hiring additional IT staff with experience in core banking infrastructure, implementing a new change management process requiring independent testing of all changes, and establishing a dedicated operational resilience team. The bank also agreed to commission an independent audit of its technology environment every six months for two years. Cashplus said the remediation would finish by the end of 2025. The lending restriction remained in place as of April 2025.
Impact on banking license and corporate trajectory
The IT failures and subsequent FCA investigation did not trigger revocation or formal restriction of Cashplus's licence. The PRA, which supervises the safety and soundness of UK banks, imposed no public action. The voluntary lending curb agreed with the FCA was not a statutory restriction on the licence itself. It was a self-imposed measure that the bank announced publicly. The curb did, however, materially hit revenue. The loan book, which generated a significant portion of income, stopped growing.
Cashplus had been exploring a potential sale or merger before the outages. The IT failures and regulatory scrutiny made it harder to find a buyer. In 2024, a larger financial services group acquired Cashplus. Terms were not disclosed, but the valuation was reported to be lower than it had been before the disruptions. The new owner committed to completing the IT remediation and maintaining the lending restriction until the FCA was satisfied.
Lessons for digital banks and regulators
Cashplus's experience illustrates a pattern that has hit other digital banks. The transition from e-money institution to licensed bank brings higher regulatory expectations for operational resilience. The FCA and PRA require licensed banks to have robust technology, comprehensive business continuity plans, and the ability to restore critical services within defined timeframes. Cashplus's failures suggest its infrastructure, adequate for an e-money business, was not scaled appropriately for a full banking licence.
The FCA's decision to accept a voluntary lending curb rather than impose a public fine or censure fits its stated approach to operational resilience cases. The regulator has said it prefers outcomes that protect consumers and fix the underlying problem over punitive measures that do not address the root cause. The restriction on new lending meant Cashplus could not grow its loan book until it could demonstrate reliable systems. As of April 2025, the curb remained in place and the remediation program was ongoing.
Key facts
- Bank name: Cashplus (APS Financial Ltd)
- License obtained: February 2021 (PRA and FCA)
- Major outages: September 2022, March 2023, November 2023
- Primary cause: Failed core banking platform migration; software bugs; insufficient capacity
- FCA action: Section 166 skilled person review; voluntary lending restriction agreed March 2024
- Regulatory outcome: No public fine or censure; lending restriction in place as of April 2025
- Corporate event: Acquired in 2024 by a larger financial services group at a reduced valuation
Timeline of major IT outages
| Date | Duration | Customer impact | Root cause |
|---|---|---|---|
| September 2022 | Several days | Unable to log into online accounts or mobile app | Software bugs; inadequate testing |
| March 2023 | Up to 5 days | Unable to make payments, transfer money, or use debit cards | Data centre capacity failure |
| November 2023 | Several days; data reconciliation took weeks | Accounts inaccessible; balance discrepancies | Failed core banking platform migration |
Frequently asked questions
Did the FCA fine Cashplus for the IT failures?
No. The FCA did not impose a public fine or censure. Cashplus voluntarily agreed to restrict its lending activities until its IT systems were fully remediated.
Were customers compensated for the outages?
Cashplus waived certain fees during the outage periods but did not announce a formal compensation scheme. Some customers received compensation after complaining to the Financial Ombudsman Service.
Did Cashplus lose its banking license?
No. The PRA did not revoke or formally restrict the license. The voluntary lending restriction was not a statutory action on the license itself.
What caused the November 2023 outage?
A failed migration to a new core banking platform corrupted customer account data, requiring manual reconciliation.
