The FCA's TSB final notice says the bank did not carry out a formal, comprehensive due diligence exercise on its main outsourced provider's ability to deliver and operate the new platform, and had limited visibility of the 85 third parties that provider relied on. A supplier's letter of readiness, the notice adds, is not the same as evidence.
What the notice says about the supplier
TSB's principal outsourced provider for the migration was SABIS, a Sabadell subsidiary. The services were critical to TSB's regulated activities. The FCA states TSB did not at the outset conduct a formal, comprehensive due diligence exercise on capability, although it had identified the issue, and that it never sufficiently understood SABIS's ability to operate the platform.
It also says certain risks, such as whether the provider could deliver within a two year period, were not formally identified or assessed.
Fourth parties
SABIS relied on 85 third parties, which are TSB's fourth parties. By February 2018 TSB had not ensured that SABIS's supplier management model was fully developed and compliant with TSB's own outsourcing policy, and lacked visibility of the risks from those subcontractors.
Documents and letters are not proof
TSB agreed to accept configuration documents instead of design documents, and in February 2018 decided not to require the full set. The FCA says configuration documents could not verify the infrastructure was built to the original design.
A readiness letter from the provider confirmed non functional readiness, but the FCA describes it and the fourth party confirmations as partly forward looking statements of expectation, most with outstanding tasks.
A supplier readiness review
Ask for evidence, not assurances:
- Has the supplier run a system like this at this scale, and can you speak with another customer?
- Which subcontractors does it depend on for critical services, and how does it oversee them?
- What design documentation will you receive, and can you verify the build against it?
- What test results can you see directly, rather than summarised in a letter?
- What happens to you if the supplier misses a milestone?
Re-assess when facts change
The notice criticises TSB for not re-assessing the supplier after problems on the small services already live. Limited early success does not prove readiness for the complex part.
Safeguard's vendor and asset records, and its compliance and evidence automation, can keep supplier evidence in one place. Judging a supplier's capability is a human decision.
Questions for your own contracts
Read one critical outsourcing contract today. Does it let you see test results, audit the supplier, and learn who its key subcontractors are? Does it set a deadline for incident notice? If any answer is no, add it to the next renewal. Suppliers often accept these terms when asked early, and much harder after a problem has started.
Quick check
What is a fourth party?
A subcontractor of your direct supplier. In the TSB notice, the third party was SABIS and the fourth parties were the 85 companies it relied on.
Is a supplier's readiness letter enough?
The notice suggests not. Letters can express intent. Ask for test results and design evidence you can check yourself.
Sources
Last reviewed: 19 October 2026.
