Ex-TSB CIO personally fined £81,000 for breach

Bank of England refuses to say if anyone else is under investigation

UK regulators have fined Carles Abarca, who led IT at TSB during its disastrous IT migration in 2018, £81,620 for his role in the project.

According to the Prudential Regulation Authority (PRA), Abarca "failed to take reasonable steps" to ensure the outsourcing firm TSB was using - which was also owned by the bank's parent company, Banco Sabadell - was ready to carry out the work.

The 2018 migration was intended to move TSB's systems to Banco Sabadell's own banking platform. However, the work dragged on past the expected finish date and nearly 2 million customers were locked out of their accounts.

Some customers trying to access online banking found themselves able to see other peoples' account information, and there were even reports of people having their mortgage debt affected.

The work began in Spring, but customers were still reporting issues in December 2018.

TSB has already paid out £32.7 million to compensate customers, and last December the Financial Conduct Authority fined it an additional £48.65 million.

Now the penalties have reached the personal accountability stage.

So far, Abarca - at the time the bank's CIO and, ironically, head of migration - is the only executive to have been fined. The Bank of England has not confirmed whether anyone else is under investigation.

Falling foul of the Senior Manager's Regime

Abarca was responsible for making sure TSB complied with the PRA's outsourcing rules - particularly the bank's relationship with its main third-party supplier.

The BoE says Abarca assured TSB's board that the supplier was ready for the migration, but "failed to ensure that TSB had itself obtained sufficient assurance from the third party before doing so."

He has been held to account under the Senior Manager's Regime, a 2016 rule that allows the PRA to personally fine people it deems guilty of breaking rules.

In particular, the regulator said Abarca failed to:

• Ensure that the third party's ability and capacity were adequately reassessed on an ongoing basis;
• Ensure that TSB obtained sufficient assurance from the third party in relation to its readiness to operate the new IT platform; and
• Give sufficient consideration to whether further investigation was required before giving assurance to the TSB Board as to the third party's readiness for migration.

While the CIO role is covered by the SRM, the CTO role is not. Sources told Sky News that Abarca's move to chief technology and innovation officer in Spring 2019 may have been partly motivated by a desire to shield him from the potential consequences of the botched migration.

Abarca left TSB in 2020 to join Banco Sabadell as CTO. He left that post in January this year and is currently between roles.