Over the weekend of 21-22 April 2018, TSB Bank tried to move its data from the legacy Lloyds Banking Group systems it had relied on since the 2013 split to a new in-house core banking system called Proteo4UK. The migration failed immediately. Up to 1.9 million people lost access to online and mobile banking for weeks. Some logged in and saw other people's account details, a serious safety failure. Five months later, chief executive Paul Pester resigned. In December 2022 the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA) jointly fined TSB £48.65 million, a penalty set by the regulators for operational resilience failings. The bank's own accounts put the total cost at £330 million, covering compensation, fraud losses and IT remediation. TSB's parent, Banco Sabadell, abandoned a sale attempt in 2021 after failing to find a buyer, and later itself became the target of a hostile takeover bid by BBVA.
What went wrong during the migration weekend
TSB had run on a service agreement with Lloyds Banking Group since being spun off in 2013. In 2015, Banco Sabadell bought TSB for £1.7 billion. Sabadell wanted to bring the technology in-house and built Proteo4UK, a version of its own banking system adapted for the UK. The cutover was scheduled for a single weekend in April 2018.
When the data transfer completed, the new system could not handle the transaction volumes. Online banking went down. Mobile banking went down. Account holders could not check balances, make payments or access standing orders. Some branches stayed open late to handle queues. The outage lasted for weeks. Intermittent service returned only gradually.
The root cause was never publicly specified in technical detail. The independent review by law firm Slaughter and May, published in November 2018, found that TSB's board had been given overly optimistic assurances about the migration's readiness. Testing had been insufficient. Contingency plans were not adequate for a failure of this scale.
Security flaws and customer harm
Alongside the outage, the migration introduced an access-control failure inside Proteo4UK that let some users see other people's account details after logging in. This was not a data breach by an external attacker. It was a flaw in the system itself. Affected individuals reported seeing names, account numbers and balances belonging to strangers. TSB acknowledged the flaw and said it had been fixed. The damage to trust was severe.
Being locked out of their own money, then learning their data might have been exposed, triggered a wave of complaints. People who lost access could not make mortgage payments or pay bills on time. Some were charged late fees by other companies. TSB set up a compensation programme, but the process was slow. Many account holders complained to the Financial Ombudsman Service. The FCA and PRA later cited the safety failure and the prolonged outage as evidence of systemic failings in TSB's operational resilience.
CEO Paul Pester's departure and the board's role
Paul Pester had been TSB's chief executive since 2013. He led the bank through the Lloyds separation and the Sabadell acquisition, and was the public face of the bank during the migration crisis. The Treasury Select Committee questioned him aggressively in parliamentary hearings about why the bank had proceeded despite warning signs.
The Slaughter and May report, commissioned by TSB's board, concluded that the board itself had been misled by overly optimistic internal updates. Pester initially resisted calls to resign. He stepped down in September 2018, five months after the failure. He was replaced by Debbie Crosbie, a former Clydesdale Bank executive.
The Treasury Select Committee later published a critical report on the IT failures. The FCA and PRA investigation continued for more than four years before resulting in the £48.65 million penalty in December 2022. As far as public records show, no other individual executives faced personal regulatory sanctions.
Financial cost and the impact on Banco Sabadell
TSB reported total costs of £330 million related to the IT failure, a figure disclosed in the bank's own financial statements. That sum covered customer compensation, fraud losses from the period when safety controls were weakened, and the cost of rebuilding and stabilising Proteo4UK. The FCA and PRA fine added another £48.65 million, set by the regulators and announced in December 2022. The reputational damage was harder to quantify but affected TSB's ability to attract new business and retain existing account holders.
For Banco Sabadell, the TSB disaster became a strategic problem. The Spanish parent had hoped to use TSB as a vehicle for international expansion. Instead, it spent years trying to fix the UK business. In 2021, Sabadell abandoned a formal sale process for TSB after failing to find a buyer willing to pay an acceptable price. The following year, Sabadell itself became the target of a hostile takeover bid from BBVA, a larger Spanish rival. As of December 2024, TSB continues to operate under Sabadell ownership. The 2018 migration failure permanently altered the trajectory of both the UK bank and its parent.
