Echo — TSB Migration (2018)

What happened

In April 2018, the UK bank TSB moved its customers off the banking platform it had been renting from its former parent, Lloyds, onto a new platform of its own — in a single big-bang weekend. The plan was clean on the slide: switch the old system off, migrate the records for roughly five million customers, and bring the new system live for Monday morning. Instead, the moment real traffic hit, the new platform buckled. Customers could not log in, some who did log in saw account information that was not theirs, and payments and transfers failed. What was meant to be one quiet weekend became weeks of very public disruption.

The mechanism

The cutover was driven by the calendar and the invoice, not by evidence that the new system worked. TSB's owner wanted to stop paying a large annual fee to keep running on Lloyds' legacy platform, so ending that arrangement had real commercial urgency. The replacement was cut over all at once, but it had never been proven at genuine production scale — the load and the messy full mix of real customer behaviour only arrived on go-live day, and defects that the pre-launch testing had not caught surfaced immediately. Crucially, this was a big bang with no parallel run and no viable rollback: once the old platform was switched off and the new one was live and taking writes, there was no equivalent old system left to compare against or fall back to.

Blast radius

The impact was national. Around 1.9 million customers who used digital banking were locked out, and the disruption stretched on for weeks rather than hours. Customers missed payments, businesses could not reach their money, and some saw other people's account details — a serious trust and security failure for a bank. The fallout reached the top: the chief executive resigned later that year, an independent review was commissioned, and in December 2022 regulators fined TSB £48.65 million for the operational-resilience failings behind the migration. The wider cost to the bank — remediation, compensation, and fraud — ran to hundreds of millions of pounds.

The same-class lesson

A migration is an experiment, and an experiment needs a control group. The transferable reflex: never cut over on faith. Run the old and new systems in parallel on real production traffic, reconcile every difference until the diff is zero or individually explained, and prove the new system at true production scale before go-live — a curated test set contains only the cases someone already imagined, and the failures that matter live in the mix only production supplies. Keep the old path executable, not decommissioned, until the new one has survived a full business cycle, so that "roll back" is a switch and not an archaeology project. Irreversibility is a cost, never a virtue: the instant you delete the thing you would have compared against, "correct-looking" and "same as before" can silently diverge and you have no way to tell.

Rhymes with

Drill 54 — The Big Bang. Same shape at national scale: one heroic weekend, the old system switched off before the new one was proven, no parallel run, and nothing left to compare against or roll back to.

Timeline

timeline
    title TSB big-bang migration, 2018
    Before : Renting the legacy platform from Lloyds : Paying a large annual fee to keep using it
    April 2018 weekend : Old platform switched off : Records for roughly 5 million customers migrated : New platform brought live
    Go-live : New system buckles under real load : Around 1.9 million digital customers locked out : Some see other people's accounts
    After : Weeks of disruption : CEO resigns : Regulators later fine TSB 48.65 million pounds

Named concepts: big-bang cutover, parallel run / shadow mode, reversible cutover, production-scale testing.