A Migration Without a Rollback Path Is a Bet

The Decision in Front of You

Your organization will move something important in the next two years. It might be a data center exit, a cloud migration, a database engine change, an operating system upgrade across hundreds of servers, or a rewrite onto a new application framework. Each of these ends in a cutover: a window in which production work stops on the old platform and starts on the new one.

The decision is what you require before you approve that window. Most go/no-go meetings ask whether the new platform is ready. The more useful question is how the team returns to the old platform, how long that takes, and whether anyone has done it.

The stakes are measured in customers who cannot pay, ship or get paid. At TSB Bank, the cost of a failed cutover included £48.65 million in regulatory fines and £32.7 million in customer redress, a combined £81.35 million before counting the bank's own remediation costs ¹².

What's Happening

The reference case: TSB, 2018

Over the weekend of 20 to 22 April 2018, TSB moved five million customers' records to a new banking platform in a single migration event ³⁴. The data moved. The platform failed. Online, mobile, telephone and branch banking were disrupted across all 550 branches and a significant share of TSB's 5.2 million customers ²³. TSB did not return to business as usual until December 2018 ².

The Prudential Regulation Authority's final notice, published in December 2022, sets out what went wrong before the weekend. In the weeks before migration, TSB accepted a supplier proposal to run performance testing on only one of the two data centres, leaving a test environment that the regulator described as distinctly different from production ³. That decision was neither documented nor escalated ³. Non-functional testing, which covers performance and capacity, ran until the day before the go-live decision ³. TSB later said the two data centres, specified to be identical, had been configured inconsistently and that this was a key cause of the disruption ⁴.

On rollback, the notice is blunt. A roll-back plan was not possible in the circumstances, and once migration had occurred it was essentially impossible to roll back from the changes made ³. The board had asked for a fall-back plan in case migration could not go ahead ³.

The independent review commissioned by TSB's board, written by the law firm Slaughter and May and published in November 2019, criticized the choice to move five million customer records in a single weekend. It found that alternatives such as a phased migration were not seriously considered and that the board did not substantively discuss the approach ⁵. TSB had run nine dress rehearsals and a pilot with more than 1,600 staff before go-live ⁴. Its late performance testing still ran on one data centre, and the fault sat in the difference between the two ³⁴.

Recent cases show the pattern continuing

BNF Bank, Malta, 2025. In late March 2025, BNF replaced the core banking system it had run since its founding in 2008 with Temenos Transact, and switched its card network from Visa to Mastercard in the same transition ⁶⁷. Customers were locked out of accounts, and some reported missing funds and double transactions for nearly a month ⁸. In May the chief executive apologized and said the data migration, including accounts and balances, had been completed and fully reconciled ⁷. According to a commentator's summary of the chief executive's interview with the Times of Malta, the bank had run more than 3,500 tests over 18 months, spent more than €1 million stabilizing services, accepted that changing card provider at the same time was a mistake, and was asked by Malta's financial regulator to take corrective measures ⁹.

Reconciled balances proved the data arrived intact. Customers still could not use their accounts, and a second major change in the same weekend made faults harder to isolate.

GTBank, Nigeria, 2024. Guaranty Trust Bank began moving to the Finacle core banking platform on Friday, October 11, 2024, and told customers to expect completion by the following Monday ¹⁰. The migration overran. Some customers could not withdraw money, and the bank was still apologizing publicly in late November, more than six weeks after the start ¹⁰. The same coverage notes that Sterling Bank customers saw several days of disruption during a core migration in September 2024, and that Zenith Bank had an outage while preparing its own move ¹⁰. Public reporting does not describe the bank's rollback plan. The lesson for executives is that a cutover window needs a defined abort time; once it passes, the business is committed to fixing forward for as long as that takes.

Sonos, 2024. Sonos released a rebuilt mobile app on May 7, 2024 ¹¹. Complaints were widespread, and many customers asked for the old app back ¹². In August the chief executive explained why that was not possible: the company had updated the software running on its speakers and in its cloud since the launch, and after extensive testing it concluded that re-releasing the old app would make the problems worse ¹². Sonos estimated short-term remediation at $20 million to $30 million, cut about 100 jobs and postponed two product launches ¹¹. Its rollback path had decayed as the rest of the system moved on.

Google Cloud's June 2025 global outage traced to new code that had no feature flag, a switch that turns a change off without redeploying ¹³.

Why the Usual Approach Fails

Rollback plans are written and never executed. A document that says "restore from backup and repoint DNS" is a hypothesis until someone runs it against production-sized data and times it. Without that timing, nobody can say when the decision to reverse has to be made.

Rehearsals use the wrong environment. TSB's rehearsals were real and numerous ⁴. Its performance testing ran against an environment that differed from production in the place that failed ³⁴. A rehearsal proves only what its environment shares with production.

Data checks stop at the database. Row counts and checksums confirm that records moved. A customer logging in or a card authorizing needs its own test. BNF's balances reconciled while customers were locked out ⁷⁸.

Schedules squeeze the safety work. When a program runs late, testing is compressed and run in parallel instead of in sequence. Commentary on the FCA's findings at TSB noted that testing finished only the day before migration ¹⁴. Go-live dates announced to customers or regulators become commitments that override what the test results say.

Cloud providers' own guidance anticipates these failures. Microsoft's Cloud Adoption Framework tells teams to retain the source environment as a fallback, keep the ability to revert DNS records and configuration, verify data with checksums and hashes instead of row counts alone, and watch the new platform closely for the first 24 to 48 hours. It warns against premature declarations of success ¹⁵. AWS guidance asks teams to document a rollback procedure in the cutover plan, include rollback time when sizing the downtime window, and rehearse the cutover ¹⁶.

The Framework: The Reversible Cutover

A cutover is ready when the team can show three things to the executive who approves it. A rollback has been rehearsed and timed. Old and new systems have processed the same work in a parallel run and produced the same results. Data has been verified by the people who own the business process. A written point of no return then tells everyone when reversal stops being an option.

flowchart LR
    A[Rehearse rollback<br/>on production-equivalent<br/>environment, timed] --> B[Parallel run<br/>same transactions<br/>outputs compared]
    B --> C[Verify data<br/>counts, checksums,<br/>business sign-off]
    C --> D[Go / no-go<br/>point of no return<br/>written down]
    D --> E[Cutover<br/>one change<br/>at a time]
    E --> F[Hold period<br/>old system kept<br/>ready to resume]
    F --> G[Decommission<br/>after criteria met]
    E --> H[Roll back<br/>if abort criteria hit]
    H --> A

Rehearse the rollback. Run the full reversal at least once on an environment that matches production in configuration, data volume and network layout. Time it. The measured time sets the latest moment in the cutover window when a rollback can still start.

Run in parallel. Push the same real transactions through old and new systems for a defined period and compare the outputs: balances, invoices, shipments, reports. Differences get explained before go-live. Where a full parallel run is impossible, compare a sample of real transactions replayed against the new system.

Verify data at two levels. Technical checks cover counts, checksums and hashes ¹⁵. Business checks cover the twenty or thirty transactions that matter most, performed by the people who own them, with written sign-off.

Write down the point of no return. Reversal becomes impractical at a known moment, usually when the new system accepts writes the old one cannot absorb. Name it, time it, and list the abort criteria checked before crossing it.

Change one thing at a time. BNF's chief executive called the simultaneous card switch a mistake ⁹. Two changes in one window give a fault more places to hide.

Hold before you decommission. Keep the old system ready to resume for a defined period, and keep anything that depends on it backward compatible. Sonos lost its rollback option because the systems around the old app changed while it was out of service ¹².

Costs, Risks, and Tradeoffs

Reversibility costs money and time. Some systems do not justify it.

How to Act

Questions to Ask Your Team

1. Have we ever executed this rollback, end to end, and how long did it take?
2. How does the rehearsal environment differ from production, item by item?
3. At what time during the cutover weekend does rollback stop being possible?
4. Which business transactions will we compare between old and new before we switch, and who signs off on each?
5. Are we changing anything else in the same window, and could that change go separately?
6. How long will the old system stay ready to take traffic back, and what keeps it compatible in the meantime?
7. If testing slips, what gives way: the go-live date or the test plan?
8. What would we tell customers and regulators on Monday morning if we had to roll back?

Closing

A cutover is a short window in which the whole business depends on one plan working. A rollback that has been rehearsed, a parallel run that matched, and data that business owners have signed off turn that window into a decision that can be reversed. Without them, the organization is betting its customers and its regulatory standing on the first attempt. Approve the cutover only when the team can show you the way back.