Summary

  • On 20 December 2022 the Financial Conduct Authority and the Prudential Regulation Authority announced penalties against TSB Bank plc totalling £48,650,000 over failings connected with the bank's 2018 IT platform migration — £29,750,000 imposed by the FCA and £18,900,000 by the PRA.
  • The regulators' stated findings concerned migration governance and oversight, risk management, planning and testing. The durable lesson is not about project budgets or test coverage on paper; it is about whether the programme contained a person with the standing to halt it, and whether that halt had ever been rehearsed.

A migration is a promise made by an institution to itself: that the new platform will carry what the old one carried, that the people doing the carrying know what to do when it does not, and that somebody will call a stop before customers discover the failure for them. On 20 December 2022, the Financial Conduct Authority and the Prudential Regulation Authority announced penalties against TSB Bank plc totalling £48,650,000 over failings connected with the bank's 2018 IT platform migration, as recorded in the regulators' announcement (FCA and PRA announcement). The FCA's share was £29,750,000; the PRA's was £18,900,000. The same announcement reports findings in the areas of migration governance and oversight, risk management, planning and testing, and the disruption that customers experienced.

Those figures and that characterisation come from the regulators' own 20 December 2022 announcement. The instrument that would carry the legal basis, the statutory provisions and the paragraph-by-paragraph factual findings is the FCA's final notice (FCA final notice for TSB Bank plc), which is a public document and the right place to test any claim about which rule was engaged. This case file does not name a rule, because a penalty announcement is not the same artefact as the notice that supports it, and because a forensic account that borrows specificity it has not read is just a louder kind of guessing.

TSB answered the same day. Its newsroom carries a statement under the headline "TSB responds to the FCA and PRA findings in relation to the 2018 Migration Programme", dated 20 December 2022 (TSB news releases). Read the two documents side by side and the grammar of the thing becomes visible. The regulators issue findings. The bank responds to findings. Both sentences are true, and the distance between them is where accountability actually lives. A response is a statement about a company's posture. A finding is a statement about what the company's controls did and did not do. Only one of those can be tested by a supervisor, and only one of them can be tested by you.

So treat the penalty as an entry point rather than a conclusion. The interesting engineering sits upstream of the bill: in prevention, in detection, and in the authority to reverse a decision that has already been signed, staffed and announced.

Prevention in a migration programme is mostly administrative, and that is precisely its weakness. Plans exist. Test regimes exist. Steering committees exist, with terms of reference and minutes and risk registers whose red cells have a habit of turning amber as the date approaches. What a plan does not contain, by default, is an answer to a simple question: at what measured point does this programme stop, and who says so? That question is not technical. It is a delegation of authority, and it is usually left unwritten because writing it down creates an owner for an outcome nobody wants to own.

The regulators' reported finding areas — governance and oversight, risk management, planning and testing — converge on that unwritten question. Governance is not the existence of a committee. It is the allocation of a decision right, with a name and a date attached. Oversight is not the volume of reporting. It is whether the report can carry a decision that costs money and reputation today in exchange for avoiding a worse outcome tomorrow. Planning and testing are not proof of diligence unless the test can fail in a way that changes the launch decision.

A test that cannot stop the launch is a rehearsal of the announcement, not of the risk.

Detection deserves its own paragraph, because it is usually where institutions congratulate themselves too early. Banks are good at instrumenting systems; they are much worse at instrumenting the decision to proceed. A migration readiness dashboard will tell a board that the platform is prepared. It will rarely tell a board how long it would take to get back if the platform were not. Those are different measurements, and only the second one can save a customer's afternoon.

The reported finding areas point at both halves — risk management and planning and testing — and the distinction between them is the difference between knowing your plan and knowing your exit.

Rollback authority is the least glamorous control in any IT programme and the one with the highest salvage value. An abort path that has never been exercised is not a control; it is a document with a diagram. Exercising it once, under time pressure, with the executives who would have to sign it in the room, converts it into something a supervisor can believe. The harder question is not whether the path exists but whether the person expected to walk down it had the standing to overrule the programme's sponsor at 02:00 with no committee available.

Most organisations cannot answer that question honestly because they have never asked it in writing.

Now the arithmetic of time. The migration happened in 2018. The penalties were announced on 20 December 2022. More than four years separate the disruption from the accounting. A penalty of this size prices the failure; it does not price the interval. Nothing in the enforcement outcome tells a reader how long the control surface took to recognise what it was looking at, and that gap — between an incident and an institution's recognition of it — is where supervisory attention has been migrating for a decade. The number is a fine. The interval is a capability.

Which brings us to remedy durability, the part of a case file that most reporting skips. A bank's assurance that it has transformed its operations is not falsifiable from outside, and it is not meant to be. It becomes testable only at the next major migration, in front of the next supervisor, with the next set of customers watching their balances fail to load. So the useful question is not what a bank says about its repair. It is what artefact an outsider could audit.

Candidate artefacts are concrete: a published abort-criteria standard with named decision authorities; evidence that the abort path has been executed end to end within the last cycle; a change-freeze rule that binds the programme sponsor rather than advisory to them; independent attestation of the control environment whose scope is stated, not implied; and customer-facing restoration commitments that are measured in hours and published after the fact.

None of that is exotic. All of it is cheap relative to £48,650,000. And all of it is invisible in a press release, which is exactly why the announcement and the statement can both be accurate while the public record still tells you almost nothing about whether the next migration is safer than the last one.

There is one more structural point worth making, and it is the reason the split between the two numbers matters. Two regulators acted on one programme. The FCA is the conduct regulator; the PRA is the prudential one. When two different statutory lenses converge on the same migration, an institution should stop telling itself a story about an unlucky release. Two lenses mean two failures of control, evaluated against two different questions: whether customers were treated properly while the platform misbehaved, and whether the firm was managed with the resilience its authorisation requires.

The £29,750,000 and the £18,900,000 are not a single punishment divided for administrative convenience. They are two separate assessments of two separate questions, and their sum is the least interesting thing about them.

For the board reader, the practical residue is a single line of inquiry that costs nothing and is almost never run: ask the programme's executive sponsor, in writing, who can stop this and what measurement triggers them. If the answer is a committee that meets weekly, the control is a calendar. If the answer is a named individual with a threshold, a rehearsal record and a standing instruction that overrides the delivery date, you have something a supervisor would recognise as governance rather than governance theatre.

The TSB file is often read as a story about an outage and a fine, with a bank's apology in the middle. It is more useful read as a story about a decision that no one was empowered to take. The migration had a plan, a budget, a steering structure and a date. What the record suggests it lacked, and what the penalties of 20 December 2022 ultimately price, is a brake with a hand on it.