TSB Bank plc fined £48.65 million for operational resilience failings

In April 2018, TSB updated its IT systems and migrated the data for its corporate and customer services to a new IT platform (through the ‘IT Migration Programme’). While the data itself migrated successfully, the platform immediately experienced technical failures. This resulted in significant disruption to the continuity of TSB’s banking services, including branch, telephone, online and mobile banking.

All of TSB’s branches and a significant proportion of its 5.2 million customers were affected by the initial issues. Some customers continued to be affected by some issues and it took until December 2018 for TSB to return to ‘business as usual’. TSB has since paid £32.7 million in redress to customers who suffered detriment.

TSB’s ‘IT Migration Programme’ was an ambitious and complex IT change management programme carrying a high level of operational risk. Its success was critical to TSB’s ability to provide continuity of critical functions and safety and soundness. However, the regulators’ found that TSB failed to organise and control the process adequately. The bank also failed to manage the operational risks arising from its IT outsourcing arrangements with its critical third party supplier.

Operational resilience is a priority for both the FCA and the PRA. As demonstrated by this incident, operational disruption can cause wide-ranging harm. It’s critically important that firms invest in their resilience.

Widespread and serious failings

Mark Steward, executive director of enforcement and market oversight at the FCA, said: “The failings in this case were widespread and serious and had a real impact on the day-to-day lives of a significant proportion of TSB’s customers, including those who were vulnerable.”

Steward continued: “The firm failed to properly plan for the IT migration. The governance of the project was insufficiently robust and the firm failed to take reasonable care to organise and control its affairs responsibly and effectively with adequate risk management systems.”

Sam Woods, deputy governor for Prudential Regulation and CEO of the PRA, added: “The PRA expects firms to manage their operational resilience as well as their financial resilience. The disruption to continuity of service experienced by TSB during its IT migration fell below the standard we expect banks to meet.”

TSB was fined £29,750,000 by the FCA and £18,900,000 by the PRA. TSB agreed to resolve this matter with the FCA and PRA, which qualified the business for a 30% discount in the overall penalty imposed by both regulators. Without this discount, the FCA and PRA would have imposed a combined financial penalty of £69,500,000 (with a £42,500,0000 fine being levied by the FCA and £27,000,000 by the PRA).