What counts as an incident
A "major operational or security incident" is one the bank had to report to the FCA under its payment services rules, typically an outage or fault that stopped a significant number of customers making payments or reaching their accounts. One incident can affect several channels, so the channel columns can add up to more than the total. A dash means the bank printed "not applicable" (it has no telephone banking, for example). The quarter figure is the latest three months the bank has published; the 12-month figure is the rolling year to the same date. Banks publish within about six weeks of each quarter end, so the dates differ slightly.
Banks of different sizes are not directly comparable: a bank with 20 million customers runs far more systems than one with 500,000. A low count is not proof of reliability, and a high count in one year is often a single bad migration. Revolut publishes no such figures that we can find; Tesco Bank and Sainsbury's Bank no longer offer current accounts.
Sources: each provider's own service-quality disclosure under FCA rule BCOBS 7, read from the Open Banking "FCA service metrics" endpoint where the bank offers one and from its website otherwise. Collected every few days.