Two days ago a faulty CrowdStrike update knocked Windows machines offline around the world, and banks and brokerages were among the hardest hit, with branch systems, call centers and trading desks down. It's a good moment to look at what the core of the financial system actually runs on, because the answer surprises people outside the industry. It's mostly Linux.
The London Stock Exchange learns a lesson
The story every financial technologist knows is the London Stock Exchange's. In the mid-2000s it rebuilt its trading platform, TradElect, on Microsoft's .NET and Windows. It was expensive, it struggled with latency as electronic trading volumes exploded, and in September 2008, on one of the busiest days of the financial crisis, it went down for most of a trading day.
The LSE bought a small Sri Lankan company, MillenniumIT, and in 2011 replaced TradElect with Millennium Exchange, running on Linux. Latency dropped dramatically. Most of the world's major exchanges have run their matching engines on Linux for years.
Why finance runs on Linux
Latency. In electronic trading, microseconds are money. Linux lets firms tune everything: pin processes to CPU cores, isolate cores from the scheduler, disable power-saving states, use real-time kernel features, and bypass the kernel network stack entirely with tools like OpenOnload or DPDK, so packets go straight from the network card to the application. You can't do that with an operating system you can't see inside.
Time. Regulations like Europe's MiFID II require trading systems to timestamp events with tight accuracy, as fine as 100 microseconds for high-frequency trading. Linux with the Precision Time Protocol, via linuxptp, and hardware timestamping on the network card is how much of the industry meets that.
Control and auditability. Regulators want to know exactly what software is running, what changed and when. Open source code can be audited by the firm itself, and the firm controls when anything is updated.
Scale and cost. Risk calculations, fraud detection, backtesting and end-of-day processing run on huge Linux compute grids, increasingly in the cloud. Licensing an operating system per core across tens of thousands of cores would cost a fortune.
The open source stack in finance
Beyond the operating system, the industry leans heavily on open source:
- Messaging and streaming: Apache Kafka is the backbone of real-time data pipelines at many banks and payment processors, alongside RabbitMQ and specialized low-latency messaging like Aeron.
- Databases: PostgreSQL has become a common choice for new systems, alongside Redis and its fork Valkey for caching and fast lookups, while big established platforms remain on Oracle and DB2.
- Analytics and machine learning: Python, pandas, Apache Spark and the scikit-learn and PyTorch ecosystems dominate quantitative analysis, risk modeling and fraud detection.
- Infrastructure: Kubernetes, Terraform or OpenTofu, Ansible, Prometheus and Grafana are as common at banks as at any tech company.
Banks contributing back
Finance used to consume open source quietly. That's changing. FINOS, the Fintech Open Source Foundation, part of the Linux Foundation since 2020, gives banks a neutral place to collaborate on code they'd all otherwise write separately. Goldman Sachs open sourced its Legend data platform through it in 2020, and Morgan Stanley, JPMorgan, Citi and others contribute projects. Competing banks sharing infrastructure code would have been unthinkable twenty years ago.
And the mainframe
It would be dishonest to leave out the other half. A great deal of core banking, the systems of record for accounts and transactions, still runs on IBM mainframes, often in COBOL written decades ago. Those systems are extraordinarily reliable, and replacing them is risky and expensive. Even there, Linux is present: IBM Z runs Linux alongside z/OS, and many banks use Linux partitions on the mainframe for the newer applications that talk to the old ones.
What regulators now expect
Regulators have noticed that the financial system depends on software supply chains it doesn't control. The European Union's Digital Operational Resilience Act, DORA, takes effect in January 2025. It requires financial firms to manage risk from their technology providers, test their resilience and report major incidents. Friday's outage is going to feature in a lot of DORA risk assessments.
For open source, that means banks need to know what open source they run, keep it patched, and support the projects they depend on. An unmaintained library in a payment system is now a regulatory problem as well as a technical one.
The short version
When you tap a card, check a balance or place a trade, there's a very good chance the transaction passes through Linux, Kafka and PostgreSQL on its way. Finance chose open source for speed, control and cost, and it's now learning, as everyone else has, that relying on code means looking after it.
Since then
Added October 2026. DORA came into force in January 2025, and regulators in other regions have moved in a similar direction.