A Replacement Plan Needs Stages Someone Can Check. Here Is the Benchmark We Would Set.

The board has asked when the old system will be replaced.

A paper is drafted. It says the system will be replaced by the end of March. The technology head is asked to confirm the date. It was chosen because it sounds reasonable. Nobody has yet looked at what the replacement involves.

The paper goes to the chief executive for signature. Everyone in the chain knows the date is a hope. Everyone signs.

What We Found

We went through the public record on banks whose IT drew regulatory action, both for standing still and for changing badly: the RBI’s published enforcement releases, and the UK regulators’ published findings on one failed migration, from 2018 to 2025.

Standing still has a price. On 24 April 2024 the RBI directed Kotak Mahindra Bank to “cease and desist, with immediate effect, from (i) onboarding of new customers through its online and mobile banking channels and (ii) issuing fresh credit cards”, citing “the continued failure on part of the bank to address these concerns in a comprehensive and timely manner”. The RBI lifted the restrictions on 12 February 2025, about ten months later.

Moving badly has a price too. TSB Bank in the UK migrated to a new IT platform in April 2018, and the migration failed. A significant proportion of its 5.2 million customers were affected, and business as usual returned only in December 2018. On 20 December 2022 its two regulators fined it £48.65 million in total. They found it had failed to manage the risks of its “IT outsourcing arrangements with its critical third-party supplier”.

Penalties reach co-operative banks. On 19 June 2023 the RBI announced a penalty of 65 lakh rupees on Andhra Pradesh Mahesh Co-operative Urban Bank, Hyderabad, by an order of 12 June 2023, for non-compliance with its cyber security framework directions. The RBI said its IT examination and an investigation of a cyber security incident showed the bank “had failed to put in place certain mandated controls which led to the cyber security incident”.

A single date gives the board nothing to check. A plan that says “replaced by March” shows nothing in December except that March has not arrived. If the date slips, the firm holds the old system and a missed commitment.

Between Too Slow and Too Fast

The record shows two risks side by side: a restriction where the RBI found concerns not addressed “in a comprehensive and timely manner”, and a fine where a UK migration failed.

The usual answer is a single completion date. It feels like a commitment, and the board gets something to wait for, not something to check. Under pressure the date pushes the work toward a single cutover, the kind of change that fails most publicly.

This is our reading. It is not a measured market figure.

Four Ways to Plan the Replacement, Weighed

Option	When it fits	What it risks
Promise one completion date	The fix is small and already understood	The date comes from the calendar, not the system. Missed, it becomes a second problem; rushed, it becomes an incident
Fix each known item one by one	The items are few and unconnected	Each fix waits on the others. There is no single plan to report against
Commission a compliance audit	The firm wants an independent view of where it stands against the rules	It confirms what is wrong, not how to replace it. This is not work we do
Read the system, then a staged plan with evidence at each stage	The weak parts sit inside an old, customised system	The assessment comes before the plan, and the stages run longer than the date the firm would like to give

Where You Are Now, and Where You Should Be

This is the benchmark we would set before the first module moves, and fill in as each one is accepted.

Measure	Typical starting point	Where it should be	How it is checked
An IT inventory of the system in scope	Partial, and assembled in a hurry	Complete, taken from the system itself	The record is compared with the servers, databases and code
Each area in the RBI’s 24 April 2024 release	Described from memory, team by team	What the system record shows on each, with the weak parts ranked	The risk register
A dated, staged plan	One completion date, chosen before the work was known	Stages of one module each, dated by the firm from the work	The staged plan with a fixed quote
Evidence for each stage	Nothing to show until the end	A record for every accepted module of what moved and how it was checked	The traceability matrix
Board reporting	”On track” until the date is missed	Each stage reported as accepted, open or next	Board papers, at every review

The starting points above are what we expect to find. In an engagement they are replaced by your own position, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a lender.

The areas are the ones the RBI listed in one bank’s case. Using them as headings is our choice, not a statement of what the RBI expects any firm to show.

A small part of a finished plan might look like this.

Stage	What it removes	Evidence
Stage 1: the module with the most exposure	The weak part ranked first in the risk register	Traceability matrix for the module; module accepted
Stage 2: the next module	The next weak part	Traceability matrix; due on the date the firm set
Stage 3: reporting	The last part on the old system	Not started

The rows above are an illustration, not taken from a real system.

How We Work With You, and What You Are Left With

1. We listen: a free Reliability Review. A first conversation about the system and what the board has asked. You leave with a short written note of what we found. You can start with a conversation about the system; we ask for read-only code access only when the assessment begins.
2. We research. We research your sector, the regulator’s position and what the public record says about firms in your situation.
3. We read the system and propose: the Legacy System Specification Assessment. It produces a map of the system as it stands, a written specification of what it does, a risk register, a cost comparison between keeping and replacing the system, and a staged plan with a fixed quote. AI does a first pass, our senior engineers review it and trace it to the code, and your own experts confirm it. Code access is read-only and logged, never used for training, and deleted within 30 days of the evaluation ending unless we engage.
4. If you approve, we build. We replace a system one module at a time while the old one keeps running. We never do a single cutover. A traceability matrix links every old function to its replacement. The work is billed by milestone, each milestone tied to a module you accept, and you can pause after any accepted module.
5. We review against the benchmark. Before work starts we set the benchmark above. As each module is accepted we show you where each measure stands, and the filled-in benchmark is yours at the end.

The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The assessment fee is credited in full against the first build stage if it starts within 90 days of the report.

This has a price. An assessment comes before the plan, so there is no date to give on day one. We do not secure, patch or maintain the old system meanwhile, or supply security controls. And a staged plan usually runs longer than the date the firm would have liked to give.

At the end you hold the specification, a traceability matrix for each module, and a plan with every stage dated and checked.

What changes for the business:

Role	What they gain
CEO	A plan to put in front of the board, with stages and visible progress.
CTO or CIO	A plan that can be delivered: one module at a time, with the old system still running.
CFO	Remediation priced stage by stage, each milestone tied to a stage the firm accepts.
CISO	Each stage closes named gaps, so the open list gets shorter.
Risk and compliance	Evidence of progress at every review, and commitments the firm can keep.

The cases in this article, and what IOanyT does about that kind of problem:

The case	What IOanyT does
TSB Bank was fined £48.65 million after a migration that failed.	We replace a system one module at a time while the old one keeps running, with a traceability matrix for each module. We never do a single cutover.
Kotak Mahindra Bank was restricted for about ten months.	Our assessment gives a firm the facts and a staged plan. What the firm tells its regulator is its own decision.
The RBI penalised Andhra Pradesh Mahesh Co-operative Urban Bank 65 lakh rupees in June 2023 over cyber security controls.	Our part is narrower: security controls are the firm’s own work. We give it a staged plan for the systems around its core.

IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. The next plan can carry stages the firm is able to keep, and evidence for each.

Book a free Reliability Review →

Get a fixed quote →

See the Legacy System Specification Assessment →