.svg)
The UK Prudential Regulation Authority (PRA) has fined the former chief information officer of TSB Bank plc for a breach of Senior Manager Conduct Rules.
The PRA has come down hard on Carlos Abarca, the former chief information officer (CIO) of TSB Bank.
The former employee has now been fined £81,620 for breaching PRA Senior Manager Conduct Rule 2 as he failed to take reasonable steps to ensure that TSB adequately managed and supervised appropriately its outsourcing arrangement in relation to its disastrous 2018 IT migration programme.
This rule determines that individuals “must act with due skill, care and diligence”.
The announcement also follows on closely from the enforcement action taken in December 2022 against TSB for operational resilience failings after what one payments insider referred to as a “monumental disaster”.
This had resulted in a joint financial penalty of £4.8m, imposed by the PRA and the Financial Conduct Authority (FCA).
As CIO of TSB, Abarca had responsibility for TSB complying with the PRA’s outsourcing rules.
In particular, he was responsible for TSB’s key outsourcing relationship with its main third-party supplier for the IT migration programme and, as part of this, he gave assurance to the TSB board that the third party, as key supplier, was prepared for migration.
However, he failed to ensure that TSB had itself obtained sufficient assurance from the third party before doing so.
“Senior managers have an essential role to play in ensuring that firms manage and supervise outsourcing effectively,” said Sam Woods, deputy PRA governor. “In this case, the PRA has fined Mr Abarca because his management of a key outsourcing relationship fell below the standard we expect.”
Abarca agreed to resolve this matter with the PRA, and qualified for a 30 percent reduction in the overall fine imposed by the PRA. Without this discount, the financial penalty would have been £116,600.
TSB’s big blunder
In April 2018, TSB updated its IT systems and migrated the data for its corporate and customer services on to a new IT platform. Although the data itself migrated successfully, the platform immediately experienced technical failures, prompting plenty of negative headlines.
Publications such as the Evening Standard, BBC News and the Guardian referred to the situation as a “meltdown”.
The system failure resulted in significant disruption to the continuity of TSB’s banking services, including branch, telephone, online and mobile banking.
Meanwhile, TSB’s branches and a significant proportion of its 5.2m customers at the time were affected by the initial issues.
Some customers continued to be affected by some issues and it took until December 2018 for TSB to return to business-as-usual.
Since, TSB has paid £32.7m in redress to customers who suffered detriment.
The PRA’s investigation found that Abarca, whose LinkedIn shows he has been on a career break since the start of this year, breached the PRA’s Senior Manager Conduct Rule 2 because he failed to take reasonable steps to ensure that TSB complied with the PRA Outsourcing Rules.
In particular, the CIO did not ensure that the third party’s ability and capacity were adequately reassessed on an ongoing basis, nor ensure that TSB obtained sufficient assurance from the third party in relation to its readiness to operate the new IT platform.
Sufficient consideration was also not given to whether further investigation was required before giving assurance to the TSB Board as to the third party’s readiness for migration.
The failing undermined TSB’s operational resilience and contributed to the significant disruption TSB experienced.
