TSB's 2018 move off the Lloyds platform could not be rolled back. The FCA and PRA notices show the go decision rested on a supplier letter, a test run on one of two data centres, and a memo that left the letter's caveats behind.
On 10 April 2018, TSB's board met to decide whether to serve notice on Lloyds Banking Group. Serving it would commit the bank to moving its customers off the Lloyds IT platform it had run on since it was carved out of Lloyds in 2014, and onto Proteo4UK, a platform built for it by its new owner, Sabadell. It would also give up the fallback, a copy of the Lloyds platform that TSB had the option to carve out and keep. That same day, the last outstanding confirmation from the platform's supplier chain arrived.
The board went ahead. On the weekend of 20 to 22 April, TSB moved its customers' accounts across, predominantly in a single event. When the new platform opened, its online and mobile channels failed, and they kept failing. TSB "did not return to a BAU position until 10 December 2018," the FCA found, and between April 2018 and April 2019 it received 225,492 complaints.
There was no way back. The FCA's Final Notice puts it plainly: "after MME it was, technically speaking, essentially impossible to roll back from the changes made and revert to using the LBG IT Platform." MME is the Main Migration Event, that April weekend.
So the go decision was the whole decision, and what it rested on is the story. The record is unusually complete: two Final Notices issued on 20 December 2022, one from the Financial Conduct Authority and one from the Prudential Regulation Authority; a third from the PRA in April 2023, against the bank's chief information officer; and the bank's own 2018 accounts. Read together, they show a cutover with no way back approved on three pieces of evidence: a letter, a test and a memo. None of the three was what it looked like.
Why the bank was moving at all
Sabadell bought TSB in July 2015, and the migration was the point of the purchase. Its offer document promised "efficiency cost savings in IT amounting to approximately £160 million per annum on a pre-tax basis, in the third full year after completion of the Offer," and said those savings would "derive from a full migration" onto Sabadell's Proteo platform. The FCA records that "The strategic rationale for the takeover included the expected financial returns from a full migration," and that "The aim was to achieve migration by the end of 2017."
Sabadell knew how to do this. It "had previously migrated seven banks onto" Proteo, the PRA notes, and its "existing methodology for IT migrations was to use a 'big bang' or single operation data migration approach." This one was different in size, as the FCA notes: "The scale of the migration project was unprecedented," and the Proteo4UK platform "was not yet proven."
TSB's board saw the shape of the risk early. In December 2015 the minutes recorded that "the Board could not be put in a position where they gave up the carve-out option, migration "stalled" or was found to be unworkable leaving the bank in a position without an IT infrastructure." That is, in so many words, the risk the go decision would later take.
The schedule slipped once. In September 2017 the board was told the bank could not migrate in November as planned. It acknowledged that the November date, set two and a half years earlier, had been "deliberately very ambitious", had acted as a "forcing mechanism", and had been "based on very little information". The new "Defender Plan" was approved on 24 October 2017. Then, according to the PRA, "The Migration Programme quickly fell behind the Defender Plan schedule, with the result that critical testing plans and principles had to be deviated from to keep on track for MME."
The letter
The supplier was SABIS, Sabadell's IT subsidiary, which built and ran the platform. On 5 April 2018 it wrote to TSB expressing "confidence as to the migration readiness of the platform." The letter gave "an early report on certain test results (noting that some tests were still to be completed)" and referred to confirmations from SABIS's own suppliers, the "Critical Fourth Parties." Those confirmations "were referenced in (but not appended to) the letter."
Both regulators later read those confirmations and reached the same verdict, in the same words. They were "to some extent forward looking statements of good intention or expectation rather than statements of fact about the completeness of readiness activities undertaken." And "All but one was caveated with a number of outstanding tasks or tests which had not yet been completed."
The letter then travelled up the bank inside a summary. The memo that recommended going ahead carried the chief information officer's attestation, which "asserted that SABIS was ready for MME and, without any further explanation, that Mr Abarca was satisfied that the SABIS Confirmation could be relied upon." The memo "did not annex the letter itself. Nor was the letter included in any of the papers for the Board." The caveats were not in the papers of the board that committed the bank.
The dates make it starker. The last supplier confirmation "was received on 10 April 2018, the same day that the TSB Board was meeting to determine whether to serve the definitive notice of migration on LBG." The tests the letter called outstanding "were completed on 17 April 2018." The board's decisions came on 10, 18 and 19 April, and the migration began on the 20th.
One more change sat underneath. On 9 February 2018, confirming that non-functional testing was complete became the IT function's sole responsibility. The FCA found that this change "does not appear to have been explicitly drawn to the attention of the TSB Board" when it made those April decisions.
The test that ran on half the system
The failure itself was not in the data. The PRA is explicit that "the data migration itself was successful." What failed was the way customers reached the new platform.
Proteo4UK ran in two data centres in an "Active-Active" configuration, with a Global Load Balancer in front deciding which centre served each session. Each centre "had the capacity to run the entirety of the customer sessions on its own." And there was nowhere safe to rehearse: "TSB did not have a pre-production environment on which to conduct testing which would stress the platform without affecting the live production environment."
TSB first decided to performance-test both data centres together, "to ensure that the conditions were the same as expected at MME." After a testing forum on 28 February 2018, it accepted a "counter-proposal" from SABIS to test only one, "due to concerns that the live services would otherwise be unavailable (for example ATMs would not have been available for a period of approximately three to four hours)."
The notice records the reasoning. The configuration of the two centres was assumed to be "symmetric following assurances received," and "if it could pass with half the capacity, it would be able to easily pass using data centres." So the test, too, stood on an assurance. The NFT Final Report and the memo that went with it did not refer "to any risks associated with conducting performance testing in only one data centre."
Then the platform went live, and "following MME it became apparent that both the Global Load Balancer and the Security Session (OpenAM) component of the data centres had not in fact been correctly configured, leading to the issues experienced by customers in trying to access the digital channels."
The notice states those facts and stops. The inference is ours, and it is the operator's lesson of the whole case. A capacity test on one node proves capacity. It cannot prove that two nodes are the same, and it never exercises the component that routes between them. The fault sat in exactly the parts the one-centre test left out: the load balancer, whose job is to divide traffic between the two centres, and the session component, whose configuration was assumed to match. The test was real and it passed. It answered a different question from the one the go decision needed answered.
TSB's incident plan had made a similar assumption about failure itself. The bank "was prepared to deal with "bumps in the road"" but not "a massive failure in the configuration leading to an erratic digital service."
The bill
TSB's 2018 annual report puts the post-migration charges at £330.2 million. The two largest pieces were customer redress and associated costs, £107.3 million, and additional resource and advisory costs, £122.4 million. Against that the bank booked "the estimated recovery of £153.0 million of post migration charges" from SABIS under its two service contracts, "up to the level of liability caps in each agreement." Net of the recovery, the charges came to £177.2 million.
That recovery deserves a sentence of context. SABIS is "a subsidiary of the Banco Sabadell Group," and so is TSB. The £153.0 million moved money from one Sabadell subsidiary to another. The accounts read here do not net the group's position, so they cannot say what the group as a whole lost.
Then there were the costs of getting to the cutover. The same report shows £417.3 million of costs for preparing the migration, including "£249.0 million payable to Sabadell under the Migration Services Agreement." Preparation and aftermath together come to £747.5 million in one year's accounts. That is 4.7 times the annual IT saving the takeover promised. The comparison is a sense of scale, not a payback calculation: the promise was for the third full year after the deal, and nothing read here says whether it was ever met. (Our list of the most expensive software failures in history does not include TSB; on these figures it would not look out of place there.)
The regulators priced the failure more than four years later. The FCA fined TSB £29.75 million and the PRA £18.9 million, £48.65 million in all. That is 14.7% of the gross post-migration charges, or 27.5% of the net. Both fines ran the standard discount chain: the FCA's started at £50 million and came down by 15% for remediation and 30% for settling. The FCA found the breaches "committed negligently", and the PRA found them "neither deliberate nor reckless."
The customers' redress is in the record too. To 7 April 2019, TSB paid £32,705,762 in redress against 225,492 complaints, about £145 per complaint. The complaints equalled about 4.3% of a customer base the notices put at "approximately 5.2 million," roughly one for every twenty-three customers.
The one person in the record
One individual penalty appears in the published record. In April 2023 the PRA fined Carlos Abarca, TSB's chief information officer through the migration, £81,620. That was 15% of his relevant income of £777,356.86, cut by 30% for settling. He owned, by his senior-manager responsibilities, the risk that "migration causes operational instability or a degradation in resilience and poor customer outcomes."
The PRA's notice to him adds a detail. Before TSB, "Mr Abarca was Chief Process and Information Officer at Banco de Sabadell, S.A. ('Sabadell'), and at the same time, the Chief Executive Officer ("CEO") of Sabadell Information Systems, S.A. ('SABIS Spain')." At TSB he was responsible for the bank's "key outsourcing relationship with Sabadell Information Systems Limited ('SABIS UK')." The man whose job was to judge the supplier's word had run its Spanish counterpart.
The PRA drew the general rule from it: "The fact that a firm and its service provider are within the same group does not do away with the need for a careful assessment." Sam Woods, then the PRA's chief executive, put it in one line when the fine was announced: "the PRA has fined Mr Abarca because his management of a key outsourcing relationship fell below the standard we expect."
His fine was 0.17% of the firms' fines and 0.025% of the post-migration charges. The failure the PRA made personal was the management of an outsourcing relationship, down to an attestation that a supplier's letter could be relied upon.
What a readiness claim has to say
Strip the bank out of it and the case is about the grammar of "ready." SABIS's letter was written in the future tense: confidence, expectation, tests still to be completed. The board received it as a conclusion: the memo that carried it asserted readiness and left the letter, and its caveats, behind. Regulators later separated the two tenses for them: statements of good intention on one side, statements of fact about completed activities on the other.
The test made the same move in a different register. That the second data centre matched the first was a claim of fact. It rested on assurances, nobody had tested it, and the test plan treated it as settled.
For a team running any cutover, the lessons are plain. A readiness claim counts as evidence only when it says what was completed, not what is expected. An equivalence assumption is a test that has not been run, and it belongs on the list of open items rather than in the reasoning that closes them. And the less reversible the step, the more the go decision has to rest on evidence of the first kind. TSB's migration could not be rolled back, so its go decision was the last point at which the difference mattered.
The same grammar now turns up in software that reports on itself. An AI agent that says a task is "done" is writing SABIS's letter: a confident summary of activities, some of them still outstanding, written by the party that did the work. The fix is the one the regulators applied after the fact: ask for the statements of fact, attached, and read them before the step you cannot undo.
TSB's board met again on 18 and 19 April. The outstanding tests had finished on the 17th, and the memo in its papers still carried the attestation, not the letter. On 20 April the weekend began.
Sources
- Financial Conduct Authority, Final Notice to TSB Bank plc, 20 December 2022 (115 pages), paragraphs 2.1-2.8, 2.24-2.25, 4.48-4.52, 4.179-4.205, 4.257-4.258, 4.267 and section 6.
- Prudential Regulation Authority, Final Notice to TSB Bank plc, 20 December 2022 (108 pages), including paragraph 1.9 (Sabadell's offer document) and the penalty annex.
- Prudential Regulation Authority, Final Notice to Carlos Abarca, 13 April 2023 (35 pages).
- TSB Banking Group plc, Annual Report and Accounts 2018.
- Financial Conduct Authority, press release, 20 December 2022; Bank of England, press release, 20 December 2022 and press release, 13 April 2023.
How this was computed. Every ratio above (fines against charges, the £747.5 million, the multiple of the promised saving, the redress per complaint and the CIO's fine against his income) is arithmetic on figures quoted in this piece from the notices and the 2018 accounts, so each can be recomputed from the text. Page and paragraph references are to the PDFs as published. Every quotation was checked against the saved text of its source.
Related on our blog: Citibank's $900 Million Mistake: Six Eyes on an Approval Screen That Never Showed the Amount and “Done” Is Not a State.
Originally published at vibeagentmaking.com. If you want a tamper-evident, dated record of what a system actually completed, and when: pip install chain-of-consciousness or npm install chain-of-consciousness, or try Hosted Chain of Consciousness.