Fintech · Operational resilience · Global and India, 2026
Microsoft Outage Lessons: Can Tokenisation Make Finance More Resilient — or Just Move the Single Point of Failure?
The 12 to 14 November 2026 Microsoft 365 outage stalled bank communications and trade deals in 74 countries. Tokenised settlement could help in places, but only if the infrastructure under it is spread out too.
On Thursday afternoon, a trader in Singapore had a financing deal ready to close. The documents were agreed and the money was there. What she did not have was email. For the next day and a half, a chunk of the world’s financial system went back to phones, WhatsApp and, in some offices, fax machines. Money kept moving through payment rails, but the paperwork and conversations that tell money where to go did not.
That gap is the most useful lesson of the Microsoft outage. It also reframes a question the industry has been asking for years. If finance moves more of its assets and settlement onto tokenised, shared ledgers, does it become harder to knock over? The honest answer is: partly, and only if it avoids rebuilding the same concentration in a new form.
Seventy-Four Countries, One Upgrade Gone Wrong
Problems began around noon US Eastern time on Thursday, 12 November 2026, roughly 4 pm GMT. Downdetector logged reports from 74 countries and territories within an hour. Outlook, Teams, Copilot, SharePoint and connected applications faltered because they depend on Exchange Online. Microsoft said servers were unexpectedly becoming unavailable after failing automated health checks, putting strain on the rest.
On Saturday, Microsoft said services were fully restored and that the incident “was introduced by an issue during an earlier network capacity upgrade”. It said the outage was not related to a cyberattack or AI agents. Reports described it as one of the longest outages in Microsoft’s history and the second major disruption to its 365 services this year.
- 450 million+Paid commercial Microsoft 365 subscriptions, as stated by Microsoft in January
- 200,000Approximate user problem reports logged during the outage
- 12+ hoursCore disruption to Outlook, Teams and Copilot
- $7bn+One analyst’s estimate of total cost if refund claims are pursued
- 19%Microsoft’s share of the global cloud infrastructure market, Q3 2026
- 2ndMajor Microsoft 365 disruption of 2026
What actually stopped in finance
The pattern is revealing. Euronext told companies to phone rather than email important financial information. Hong Kong Exchanges and Clearing said its email services were affected but that market operations continued as normal. Traders told Bloomberg that some banks in Singapore could not complete financing deals. A Taiwanese firm cancelled a scheduled bond repurchase, and fund management at Taiwanese securities firms and insurers was disrupted. In India, airlines including IndiGo, Akasa Air and Air India were among those hit.
Yet payment clearing itself was not affected. Problems hit payment networks and banking portals that required a secondary login through affected services. Kenyan and other African banks told customers that payments and mobile banking were working, while redirecting them to WhatsApp and phone lines for everything else.
The core lesson: the money rails held. What broke was the coordination layer — the emails, chats, document flows and log-ins that instruct, confirm and evidence transactions. That is the layer tokenisation is supposed to change.
Why One Vendor Can Halt a Trading Floor
Cloud concentration is not new, but it keeps getting deeper. Synergy Research Group estimates that global spending on cloud infrastructure services reached $167.7 billion in Q3 2026, up 55% from a year earlier. Three firms dominate it.
Share of global cloud infrastructure services revenue, Q3 2026, Synergy Research Group. “All others” is our calculation as the remainder.
Productivity software is even more concentrated than infrastructure, because a bank’s email, calendar, chat, file sharing, identity and security tools may all come from the same supplier. That bundling lowers cost and integration effort. It also means a single fault can silence most internal coordination at once. PYMNTS described it as a dependency that chief financial officers are not pricing in.
The price of the last big one
The closest comparison is the CrowdStrike incident of 19 July 2024, when a faulty security update crashed about 8.5 million Windows devices. Insurer Parametrix estimated direct losses for US Fortune 500 companies, excluding Microsoft, at $5.4 billion, with only 10% to 20% likely covered by cyber insurance. Banking was the second-hardest-hit sector.
US$ billion, direct losses excluding Microsoft, Parametrix estimate, July 2024. Bars scaled to healthcare.
No equivalent loss estimate exists yet for the November 2026 Microsoft outage. The two events also differ: CrowdStrike crashed machines, while this outage cut off cloud services. But both show the same shape of risk — a single supplier fault cascading across thousands of firms at the same moment.
What Tokenisation Means, Minus the Hype
Tokenisation is the process of representing an asset, such as a bond, a fund unit, a deposit or gold, as a digital token on a shared ledger. Ownership changes when the token moves, and the ledger is the record. When cash is also on the ledger, as a tokenised deposit, stablecoin or wholesale central bank digital currency, the asset and the payment can swap in a single step. That is called atomic settlement: either both legs complete, or neither does.
That matters for resilience in a specific way. Much of today’s settlement depends on messages and reconciliation between separate systems: an email confirming terms, a file sent to a custodian, a manual check that both sides match. Each of those hand-offs is a place where an outage like this one can stall a deal. A tokenised trade can carry its terms in a smart contract and settle itself without that chain of messages.
Distributed value, excluding stablecoins, US$ billion, RWA.xyz data as reported. Bars scaled to November 2026.
The market is growing fast, but it is still tiny next to global finance. RWA.xyz also tracks about $358 billion in assets that are only represented on-chain, mostly on permissioned ledgers run by banks and market operators. Most tokenised value today sits in tokenised Treasury funds and private credit, not in everyday banking.
The Blockchain Myth the Outage Exposes
A common belief is that decentralised networks cannot go down the way a single company’s cloud can. The evidence is more awkward. During the Amazon Web Services outage of October 2025, data from Ethernodes showed about 37% of Ethereum’s execution-layer nodes, roughly 2,371 of 6,408, were hosted on AWS. Ethereum kept producing blocks, but many users could not reach it, because about 70% of Ethereum RPC traffic, the gateways apps use to talk to the chain, ran through two providers, Alchemy and Infura.
- Layer 1Ledger and consensusEthereum kept running in Oct 2025 despite 37% of nodes on one cloud
- Layer 2Node hostingOver 70% of Ethereum execution nodes were cloud-hosted in 2020
- Layer 3Access gatewaysAbout 70% of RPC traffic through 2 providers
- Layer 4Office toolsEmail and chat, the layer that failed in 74 countries
Blockchains have had their own outages too. Solana suffered several network-wide halts between 2021 and February 2024, though its status page shows no full-cluster incident since 6 February 2024, about 30 months. Bugs, congestion and shared software clients can stop a ledger just as a bad update can stop a cloud.
What people get wrong: “on the blockchain” does not mean “off the cloud”. A tokenised system whose nodes, gateways and custody wallets all run in one provider’s region has simply moved the single point of failure, not removed it. A widely shared post-mortem put it bluntly: cryptographically decentralised, operationally centralised.
Where Tokenisation Would Have Helped — and Where It Would Not
Map the outage’s actual failures against what tokenised infrastructure does, and the picture becomes concrete.
| What broke on 12 to 13 Nov | Real example | Would tokenisation help? | Why |
|---|---|---|---|
| Trade finance documents | Singapore banks unable to complete financing deals | Yes, largely | Digital trade documents and token-based terms do not need email to move |
| Settlement instructions | Taiwanese firm cancels a bond repurchase | Yes, if both legs are on-ledger | Atomic settlement swaps bond and cash without confirmation emails |
| Payment clearing | Clearing kept running | Not needed this time | Existing payment rails held up |
| Secondary log-ins | Bank portals needing Microsoft sign-in failed | Only with independent identity | Wallet keys can avoid the cloud log-in, but bring custody risk |
| Internal communication | Euronext tells firms to phone, not email | No | People still need to talk; tokenisation is not a chat tool |
| Disclosure to markets | Exchanges reroute price-sensitive filings | Partly | On-chain records can timestamp events, but rules still require formal filings |
Worked example, illustrative. Take a ₹100 crore corporate bond trade between two institutions. In a conventional flow, at least four messages may pass between dealers, custodians and clearing agents before settlement, and each can travel by email or a vendor portal. If email is down for more than a day, as it was for many users here, the trade can slip a full business day. In a tokenised flow with wholesale CBDC, the bond token and the cash token swap together the moment both parties sign, so the email outage does not stop settlement. But if both institutions’ signing wallets sit in the same cloud region that fails, the trade stops anyway.
The gain is real, but conditional. Tokenisation removes message dependencies; it does not remove hosting dependencies.
India’s Quiet Head Start on Tokenised Rails
India is building its own version of this infrastructure, with the central bank at the centre. In October 2025 the RBI launched a pilot to tokenise certificates of deposit and settle them using wholesale CBDC. It also developed the Unified Markets Interface (UMI), which its annual report describes as a multi-layer platform to facilitate tokenisation of financial assets while leveraging wholesale CBDC to enhance settlement.
On 10 September 2026, SEBI and the RBI announced “Demat 2.0”, a pilot for tokenised corporate bonds connected to the RBI’s wholesale e-rupee through UMI, enabling atomic settlement of the bond and money legs. Moneylife reported that three issuers raised ₹1,025 crore in the pilot. Still, the scale is small: the RBI reported wholesale CBDC in circulation as nil on 31 March 2026, as it is used for settlement within pilots rather than held.
- CrowdStrike update crashes about 8.5 million Windows devices.
- A misconfigured DDoS defence leaves Microsoft services down for around 10 hours.
- AWS outage hits crypto exchanges; 37% of Ethereum nodes sit on AWS.
- RBI launches tokenised CD pilot on wholesale CBDC.
- SEBI and RBI launch Demat 2.0; 3 issuers raise ₹1,025 crore.
- Microsoft 365 outage begins; 74 countries in an hour.
- Day 2: banks turn to phone and fax; bond repurchase cancelled.
- Microsoft reports full restoration; cites network upgrade issue.
A central bank-run ledger has one resilience advantage over public blockchains: the operator can choose where nodes run, require geographic spread and test failover. It also has the obvious weakness of being one operator. The design question is the same either way: how many independent places does the system need to keep working when one of them fails?
What We Know
- The Microsoft 365 outage began on 12 November 2026 and services were fully restored on 14 November.
- Microsoft blamed an issue from an earlier network capacity upgrade and ruled out a cyberattack.
- Payment clearing was not affected, but email-based workflows and secondary log-ins were.
- Tokenised assets on public chains reached about $39.4 billion on 6 November 2026.
- India’s RBI and SEBI are piloting tokenised CDs and bonds with atomic settlement.
What Is Still Unclear
- The full financial cost of the outage; estimates are early and partial.
- Microsoft’s detailed root-cause report, which had not been published at the time of writing.
- How tokenised pilots would perform in a real cloud outage; none has been publicly stress-tested this way.
- Whether regulators will set concentration limits on cloud and node hosting for tokenised infrastructure.
A Resilience Checklist That Works With or Without Tokens
The outage offers practical lessons for banks, brokers, fintechs and finance teams, whatever their tokenisation plans. None of them require a blockchain to start.
- Map which client-facing and settlement processes depend on email, chat or a single sign-in provider, and how long each can stall before money is at risk.
- Keep at least one tested out-of-band channel, such as phone trees or a secondary messaging platform from a different vendor, for urgent instructions.
- For any tokenised or DLT pilot, ask where every node, gateway and signing key is hosted, and require more than one cloud provider and region.
- Run failover drills that assume the main productivity suite is down for 24 to 48 hours, not just a few minutes.
- Warn staff and customers about phishing during outages; security firms noted that criminals typically exploit such events within hours.
- Review contracts and insurance: CrowdStrike showed only 10% to 20% of losses may be covered.
Bottom line for decision-makers: tokenisation is a settlement upgrade, not an uptime guarantee. Judge any tokenised system by its weakest hosting dependency, not by the word “decentralised” in its brochure.
Frequently Asked Questions
What caused the Microsoft outage in November 2026?
Microsoft said the incident was introduced by an issue during an earlier network capacity upgrade that surfaced after a recent network change. It said the outage was not related to a cyberattack or AI agents, and reported full restoration on 14 November 2026.
Were bank payments affected by the Microsoft outage?
Payment clearing itself was not affected, according to reports. However, payment networks and banking portals requiring a secondary login had problems, and banks’ email-based workflows were disrupted, delaying some trade finance and bond transactions.
What is tokenisation in finance?
Tokenisation means representing an asset such as a bond, fund unit or deposit as a digital token on a shared ledger. Ownership transfers when the token moves, and when cash is also tokenised the asset and payment can settle together in one step.
Can blockchain prevent outages like Microsoft’s?
Not by itself. Blockchains can keep running when one provider fails, but many nodes and access gateways are hosted on the same large clouds. During the October 2025 AWS outage, about 37% of Ethereum nodes were on AWS and users had trouble reaching the network.
How big is the tokenised asset market?
RWA.xyz data put tokenised real-world assets on public blockchains, excluding stablecoins, at about $39.4 billion on 6 November 2026, up from $8.8 billion in April 2025. Tokenised Treasuries are the largest category.
What is India’s Unified Markets Interface?
The Unified Markets Interface (UMI) is an RBI platform to tokenise financial assets and settle them using wholesale CBDC. It hosts a tokenised certificate of deposit pilot and is connected to SEBI’s Demat 2.0 pilot for tokenised corporate bonds.
What is atomic settlement?
Atomic settlement means both legs of a trade, the asset and the payment, transfer at the same instant or not at all. It removes the risk that one side delivers while the other does not, and reduces dependence on confirmation messages.
How much did the CrowdStrike outage cost banks?
Parametrix estimated that US Fortune 500 banks lost about $1.15 billion directly from the July 2024 CrowdStrike outage, out of $5.4 billion in total Fortune 500 losses excluding Microsoft.
The Takeaway in Under 100 Words
The Microsoft outage showed that finance’s money rails are sturdier than its coordination layer. Payments cleared, but deals stalled because emails, chats and log-ins failed. Tokenisation can shrink that weak layer by letting assets and cash settle together without a trail of messages. But tokens run on nodes, gateways and wallets that often sit in the same few clouds. Resilience comes from spreading infrastructure, testing fallbacks and refusing single points of failure, whether they are labelled cloud or blockchain.
