Lessons for Senior Managers to learn from TSB IT migration enforcement action

Home
Knowledge
Lessons for Senior Managers to learn from TSB IT migration enforcement action

Lessons for Senior Managers to learn from TSB IT migration enforcement action

{26E5FAD9-9FE4-4544-B580-F959A4044BBF}

April 28, 2023

On 13 April, the Prudential Regulation Authority (PRA) issued a Final Notice against Carlos Abarca (TSB’s Chief Information Officer (CIO)), imposing a fine of £116,000 (reduced to £81,620 upon settlement) for failure to comply with Senior Manager Conduct Rule 2.¹The relevant period covered by the Final Notice is from 7 March 2016 to 22 April 2018. TSB is regulated by the PRA for prudential purposes and by the Financial Conduct Authority (FCA) for conduct matters.

TSB was formed as a result of a Lloyds Banking Group (LBG) divestment in June 2014. Following the divestment, LBG continued to provide a number of services to TSB, including providing access to LBG’s IT platform for a period of up to 10 years. In 2015, Banco de Sabadell, S.A. (Sabadell) acquired TSB via a takeover, with Mr Abarca moving from Sabadell to become TSB’s CIO shortly after this acquisition.

Mr Abarca, as TSB’s CIO, held an SMF18 position (Other Overall Responsibility) throughout the relevant period and was responsible for TSB’s information technology and IT business continuity planning.

In 2018, following a process that lasted a number of years, TSB proceeded to migrate its IT services from LGB to Sabadell. Immediately following the migration, TSB encountered serious issues, including failures with online, telephone and mobile banking services, branch technology failures, and consequential issues with payment and debit card transactions (the Incident). The Incident resulted in a significant disruption to the continuity of TSB’s provision of core banking immediately post migration, with some more limited issues persisting for a sustained period of months. All 550 of TBS’s branches and a significant proportion of its customers were materially impacted.

While the testing of the readiness of the new IT platform was the responsibility of SABIS (Sabadell’s IT subsidiary, which provided core IT services on an intra-group outsourced basis following the migration) in conjunction with fourth party providers (i.e. the entities to which SABIS had subcontracted certain tasks), Mr Abarca retained responsibility within TSB for the migration. The supply chain of service providers delivering services to TSB (i.e. through SABIS and the fourth parties) exposed TSB to operational risk.

As a result of the Incident, the PRA decided to investigate whether Mr Abarca took reasonable steps in carrying out his responsibilities and complied with the relevant requirements in the PRA Rulebook, particularly the Outsourcing Rules.

The PRA has the following expectations for a CIO:

to act reasonably in carrying out their role and responsibilities, particularly in relation to the identification and mitigation of risks from an IT perspective;
to take reasonable steps to ensure that the business of their firm for which they are responsible complied with relevant regulatory requirements and standards; and
to take reasonable steps to ensure that the business has operating procedures and systems which include well-defined steps for such compliance and for ensuring that the business is run prudently (e.g. taking reasonable steps to ensure TSB’s compliance with the PRA Outsourcing Rules, including obtaining sufficient assurance from suppliers to reduce the risk of operational disruption and the potential impact on financial stability).

The PRA found that Mr Abarca breached Senior Manager Conduct Rule 2² because he failed to take reasonable steps to ensure that TSB complied with the PRA’s Outsourcing Rules in adequately managing and appropriately supervising its outsourcing arrangement with SABIS. In particular, Mr Abarca failed to ensure that he or his CIO team obtained sufficient assurance from SABIS in relation to its readiness to operate the Proteo4UK Platform.

The PRA based its findings on the following aspects:

Mr Abarca did not ensure that TSB formally and adequately re-assessed SABIS’s ability and capacity to deliver the IT migration on an ongoing basis in light of the performance and service issues encountered with the limited number of services which had already been transferred prior to the IT migration. The errors and issues identified in these already transferred services should have caused Mr Abarca to reconsider SABIS’s (and its subcontractors’) suitability to take on the wider services being transferred.
Mr Abarca failed to give adequate consideration to the risk as to whether SABIS’s supplier management gave TSB sufficient visibility over the risks associated with the fourth parties. Where there is extensive outsourcing, the PRA expects firms to consider whether the extent of that outsourcing compromises their ability to properly oversee the third parties providing the services.
The tests and confirmations obtained on the readiness of the new IT platform were not sufficient and were to some extent forward-looking statements of good intention or expectation rather than statements of fact about the completeness of readiness activities undertaken, and contained caveats around further tests that still needed to be run prior to transfer. Specifically, Mr Abarca did not give sufficient consideration to the appropriateness of relying on SABIS’s confirmation of readiness without further investigation or challenge and was over-reliant on that confirmation.
It was also insufficient for Mr Abarca to rely on the fact that the fourth parties were engaged under contracts which conformed to the PRA’s Outsourcing Rules i.e. the fact that those providing an outsourced service were subject to PRA rules did not absolve Mr Abarca of oversight responsibility.

It is notable in this case that TSB’s Chief Revenue Officer flagged concerns around being unable to identify TSB’s risk exposure in connection with the migration, in part because of a lack of visibility over the subcontractors providing certain services. These concerns do not appear to have been addressed prior to migration. Further, Mr Abarca provided limited information to TSB executives on SABIS’s readiness for migration, simply setting out in a paragraph that SABIS would be ready without providing the underlying evidence, such as the caveated letter referred to above.

Mr Abarca’s failings contributed to some of the regulatory breaches by TSB, for which the PRA imposed a fine of £27 million (reduced to £18.9 million upon settlement) on 20 December 2022. The PRA concluded that TSB breached Fundamental Rule 2 because it failed to exercise due skill, care and diligence in managing appropriately and effectively the outsourcing arrangements with, and services provided by, SABIS and the risks arising from this (e.g. operational risk). TSB’s breach of Fundamental Rule 2 was caused by the undue reliance on SABIS as an intragroup provider, which led to a level of oversight that was not consistent with the importance and scale of the IT migration.

There are a number of takeaways for senior managers from this decision, including:

Senior managers retain responsibility for services even when they are outsourced and it is therefore important that senior managers have oversight of outsourced service providers and properly test information that is being provided to them by service providers. This is the case even when:
- those providers are subject to PRA (or FCA) rules – senior managers cannot assume that service providers are complying with rules just because they are subject to them; and
- outsourcing is done on an intragroup basis – senior managers are still required to assess the group company’s ability, capacity and resources to provide the services.
Risks and concerns were identified and flagged prior to the migration of IT services, without being considered in sufficient detail. Where risks are flagged to senior managers in this way, they should take the time to consider these properly, even if under internal pressure to meet particular deadlines.
When reporting matters to the Board or other executive functions, senior managers should ensure they are giving clear and balanced updates, including underlying materials if appropriate. One of the issues for Mr Abarca was that he wrote a short summary for the executives confirming that the service provider was ready for the migration when the letter the service provider wrote to him included certain caveats around further tests that still needed to be run.

With thanks to Juulia Kontio for her help in writing this article.