From Optimism to Crisis: NS&I's Digital Transformation is £1.3 Billion Over Budget, Four Years Behind

fahd.zafar • November 14, 2025

The UK's National Savings & Investments bank has spectacularly exceeded its digital transformation budget by £1.3 billion whilst running four years behind schedule, according to a damning National Audit Office report. The programme's failures illustrate how ambitious technology projects collapse under procurement weaknesses, underestimated complexity, and insufficient expertise.

The Programme Scope

In 2020, NS&I launched Project Rainbow—a business transformation programme aiming to reduce running costs, transform the bank into a self-service digital business, and replace its 20-year outsourcing arrangement with Atos by dividing the work across five separate contracts.

The state-owned savings bank, which manages £240 billion in customer investments and brings in government funding through retail savings markets, set itself what the NAO describes as an "overly optimistic timetable" for this transformation.

Total programme costs are now expected to reach £3.0 billion through 2030-31, including the Atos contract and other operational expenses—£1.3 billion more than the 2020 business case projected.

What Went Wrong

The NAO report identifies multiple fundamental failures. NS&I set an ambitious scope and timetable despite limited experience delivering programmes of this scale and complexity. The timetable failed to factor in contingency for delays, allowed no time for understanding technical infrastructure and testing solutions, and didn't define how interdependencies would be resolved or systems integration managed.

According to the NAO, "Decoupling a highly integrated operation, splitting it into smaller parts and then integrating these systems together is highly complex." NS&I's weak understanding of the complexity and interdependencies within the system it sought to replace led directly to delivery problems and delayed timescales. The bank lacked a systems integrator function to improve this understanding.

Beyond technical underestimation, NS&I lacked the commercial skills necessary to manage such ambitious procurement. The NAO found that NS&I "encountered significant problems in procuring and awarding the new contracts." Of the five planned contracts, only two were awarded as intended. One procurement initially failed but was subsequently re-run with a contract eventually awarded. Another procurement resulted in an award that NS&I later terminated. One procurement was abandoned entirely because NS&I and the preferred bidder couldn't agree terms.

The report notes that NS&I "had no prior experience of undertaking such programs, and for much of the program it has had insufficient digital, commercial and program management expertise."


Additionally, NS&I lacked an integrated plan or end-to-end solution, making it difficult to track performance, spending, and risk throughout the programme.



The Atos Extensions

In 2014, NS&I awarded Atos a new contract to run until 2021. Rather than transitioning away as originally planned, NS&I extended this contract until 2024, then again until 2028—all without competition—handing the French outsourcer an additional £474.4 million.


These extensions without competitive procurement highlight how transformation failures can lock organisations into expensive legacy arrangements. When ambitious replacement programmes falter, organisations find themselves captive to existing suppliers with limited negotiating leverage.



The Recovery Attempt

NS&I initiated a programme reset in July 2024, commissioning a "Recovery Plan" from PA Consulting. Programme resets can involve fundamental changes to outputs, timing, and approach, or significant revision of cost and time estimates—essentially acknowledging that the original plan has failed and requires complete rethinking.


Other suppliers involved in the programme include Capgemini, EY, PA Consulting, Actica, IBM, and Sopra Steria—a lengthy roster suggesting the programme's complexity exceeded any single vendor's capability.



Lessons for Digital Transformation

NS&I's experience provides stark lessons for organisations undertaking major digital transformations:

Don't underestimate complexity. Decoupling highly integrated systems and replacing them with multiple new solutions involves complexity that organisations without prior experience consistently underestimate. What appears straightforward in business cases becomes extraordinarily challenging in implementation.

Build appropriate expertise first. Attempting major transformations without sufficient digital, commercial, and programme management expertise virtually guarantees problems. NS&I lacked the skills necessary to manage ambitious procurement and complex systems integration—a gap that cost over a billion pounds.

Factor in realistic contingency. Timetables that don't include contingency for delays, time for understanding technical infrastructure, testing solutions, or managing interdependencies are optimistic fantasies, not realistic plans.

Understand what you're replacing. Weak understanding of the complexity and interdependencies in existing systems leads directly to delivery problems. Systems integrator functions aren't optional extras—they're essential for understanding what you're actually trying to achieve.

Maintain integrated planning. Without integrated plans and end-to-end solutions, tracking performance, spending, and risk becomes impossible. Programmes fragment into disconnected initiatives that don't cohere into functional outcomes.

Competitive procurement isn't optional. Extending contracts repeatedly without competition creates expensive lock-in situations. When transformation programmes fail, organisations find themselves negotiating from positions of weakness with incumbent suppliers.



The Broader Context

NS&I's £1.3 billion overrun and four-year delay join a depressing list of UK public sector technology failures. From the abandoned NHS National Programme for IT to various Home Office immigration system disasters, the pattern repeats: ambitious scope, underestimated complexity, insufficient expertise, procurement problems, and eventual resets costing billions more than originally projected.


The question is whether lessons from these failures will be applied to future programmes, or whether the next major transformation will repeat the same mistakes with predictably expensive results.



Expert Programme Management for Complex Transformations

At Altiatech, we've seen too many digital transformation programmes fail through inadequate planning, underestimated complexity, and insufficient expertise. Our approach focuses on realistic assessment of technical challenges, appropriate contingency planning, and ensuring organisations have the commercial and technical skills necessary for successful delivery.


Whether you're planning major system replacements, managing complex procurements, or recovering troubled programmes, our team provides the programme management expertise, systems integration capabilities, and commercial skills that prevent billion-pound overruns.


Don't let your transformation become the next cautionary tale. Work with experts who understand the complexity of replacing integrated systems and have the experience to deliver successfully.


Get in touch today:

📧 Email: innovate@altiatech.com
📞 Phone (UK): +44 (0)330 332 5482

Realistic planning. Expert delivery. Successful outcomes.

Ready to move from ideas to delivery?


Whether you’re planning a cloud change, security uplift, cost governance initiative or a digital delivery programme, we can help you shape the scope and the right route to market.


Email:
innovate@altiatech.com or call 0330 332 5842 (Mon–Fri, 9am–5:30pm).


Main contact page: https://www.altiatech.com/contact

Hand holding a phone displaying the Microsoft Copilot logo with the Microsoft logo blurred in the background.
By Simon Poole February 18, 2026
A practical governance checklist for Microsoft Copilot in 2026, using the Copilot Control System to manage risk, security, compliance, and oversight.
Route to market diagram: Bank to delivery platform, with steps like product mgmt and customer support.
By Simon Poole February 12, 2026
Explains what the Technology Services 4 (TS4) framework means for public sector buyers and how to procure Altiatech services through compliant routes.
Two people shaking hands between cloud data and data analytics dashboards.
By Simon Poole February 10, 2026
Explores where IT waste really comes from and how FinOps helps organisations regain control of cloud spend, improve efficiency, and turn cost visibility into advantage.
People discussing data and cloud infrastructure, near a government building.
By Simon Poole February 9, 2026
An overview of CCS Digital Outcomes 7 explaining Altiatech’s routes to market and how public sector organisations can procure services.
January 26, 2026
Cyberattacks, system failures, natural disasters, and human errors will occur—the question isn't if but when. Cyber resilience planning ensures organisations can withstand incidents, maintain critical operations during disruptions, and recover quickly when systems fail. It's not just about preventing attacks; it's about ensuring business continuity regardless of what goes wrong.
January 19, 2026
Manual user provisioning - the process of creating accounts and granting access through email requests and IT tickets - seems manageable for small organisations. As organisations grow, this approach creates mounting security risks, operational inefficiencies, and frustrated users waiting days for access they need immediately.
January 12, 2026
Multi-cloud strategies deliver flexibility, redundancy, and the ability to select the best platform for each workload. They also create complex security challenges, particularly around identity and access management. Each cloud provider offers different security models, tools, and terminology, making unified security difficult to achieve.
January 5, 2026
Privileged accounts—those with administrative rights to critical systems—represent the most attractive target for attackers. A single compromised privileged credential gives attackers complete control over infrastructure, data, and operations. Yet many organisations manage privileged access inadequately, creating unnecessary risk.
December 22, 2025
Identity and access management represents a critical security capability, yet many organisations struggle to assess whether their IAM implementation is truly effective. Identity governance maturity models provide a framework for evaluation, revealing gaps and priorities for improvement.
December 15, 2025
Traditional security models assumed everything inside the corporate network was trustworthy, focusing defensive efforts on the perimeter. This approach fails catastrophically in today's hybrid work environment where employees access resources from homes, coffee shops, and co-working spaces whilst applications reside across multiple clouds.