TSB 2018: A Big-Bang Migration That Was Not Reversible
also called TSB IT Migration
A UK bank moved millions of customer accounts to a new platform in a single weekend cutover, and the failure locked customers out for weeks.
What happened
In April 2018, TSB migrated its customer records from the platform it had been renting from its former parent onto a new system built by its owner. The migration was a big-bang cutover — roughly 1.9 million customers moved over a weekend, with the old platform switched off.
It went wrong immediately. Customers could not access accounts, some saw other customers' data, and services were disrupted for weeks rather than hours. The reported cost was in the region of £330 million, the chief executive resigned, and regulators subsequently imposed penalties.
The design failures
No incremental path. Every customer moved at once, so there was no small cohort whose failure would have been contained and informative. The first evidence of whether the migration worked was the entire customer base experiencing it.
No viable rollback. Once the old platform was decommissioned and the new one had accepted transactions, reverting was not a realistic option. The organisation was committed at the moment of highest uncertainty.
Insufficient testing at production scale and shape, so behaviours that only appear under real volume, real data variety and real concurrency were discovered in production.
Capacity underestimated for the post-migration surge — customers checking their accounts after a publicised migration produce far more traffic than a normal day, and the support channels were overwhelmed simultaneously.
What the alternative looks like
Migrate in cohorts. A small tranche first, monitored, then expanding waves. Failure affects thousands, not millions, and the plan can stop.
Run both platforms in parallel with reconciliation, so differences are found before the old system is retired.
Keep the old platform live until the new one has demonstrably worked at full load for a period.
Plan for the post-migration traffic surge, in both the platform and the contact centre.
The transferable lesson
Irreversibility is the risk, not complexity. A complex migration executed in reversible increments is recoverable at every step. A simple one executed as a single irreversible event has a failure mode with no remedy.
The question to ask of any cutover plan: at what point does this become impossible to undo, and what evidence do we have before that point? If the answer is "at the start" and "very little", the plan needs restructuring regardless of how confident anyone is.