From Optimism to Crisis: NS&I's Digital Transformation is £1.3 Billion Over Budget, Four Years Behind

fahd.zafar • November 14, 2025

The UK's National Savings & Investments bank has spectacularly exceeded its digital transformation budget by £1.3 billion whilst running four years behind schedule, according to a damning National Audit Office report. The programme's failures illustrate how ambitious technology projects collapse under procurement weaknesses, underestimated complexity, and insufficient expertise.

The Programme Scope

In 2020, NS&I launched Project Rainbow—a business transformation programme aiming to reduce running costs, transform the bank into a self-service digital business, and replace its 20-year outsourcing arrangement with Atos by dividing the work across five separate contracts.

The state-owned savings bank, which manages £240 billion in customer investments and brings in government funding through retail savings markets, set itself what the NAO describes as an "overly optimistic timetable" for this transformation.

Total programme costs are now expected to reach £3.0 billion through 2030-31, including the Atos contract and other operational expenses—£1.3 billion more than the 2020 business case projected.

What Went Wrong

The NAO report identifies multiple fundamental failures. NS&I set an ambitious scope and timetable despite limited experience delivering programmes of this scale and complexity. The timetable failed to factor in contingency for delays, allowed no time for understanding technical infrastructure and testing solutions, and didn't define how interdependencies would be resolved or systems integration managed.

According to the NAO, "Decoupling a highly integrated operation, splitting it into smaller parts and then integrating these systems together is highly complex." NS&I's weak understanding of the complexity and interdependencies within the system it sought to replace led directly to delivery problems and delayed timescales. The bank lacked a systems integrator function to improve this understanding.

Beyond technical underestimation, NS&I lacked the commercial skills necessary to manage such ambitious procurement. The NAO found that NS&I "encountered significant problems in procuring and awarding the new contracts." Of the five planned contracts, only two were awarded as intended. One procurement initially failed but was subsequently re-run with a contract eventually awarded. Another procurement resulted in an award that NS&I later terminated. One procurement was abandoned entirely because NS&I and the preferred bidder couldn't agree terms.

The report notes that NS&I "had no prior experience of undertaking such programs, and for much of the program it has had insufficient digital, commercial and program management expertise."


Additionally, NS&I lacked an integrated plan or end-to-end solution, making it difficult to track performance, spending, and risk throughout the programme.



The Atos Extensions

In 2014, NS&I awarded Atos a new contract to run until 2021. Rather than transitioning away as originally planned, NS&I extended this contract until 2024, then again until 2028—all without competition—handing the French outsourcer an additional £474.4 million.


These extensions without competitive procurement highlight how transformation failures can lock organisations into expensive legacy arrangements. When ambitious replacement programmes falter, organisations find themselves captive to existing suppliers with limited negotiating leverage.



The Recovery Attempt

NS&I initiated a programme reset in July 2024, commissioning a "Recovery Plan" from PA Consulting. Programme resets can involve fundamental changes to outputs, timing, and approach, or significant revision of cost and time estimates—essentially acknowledging that the original plan has failed and requires complete rethinking.


Other suppliers involved in the programme include Capgemini, EY, PA Consulting, Actica, IBM, and Sopra Steria—a lengthy roster suggesting the programme's complexity exceeded any single vendor's capability.



Lessons for Digital Transformation

NS&I's experience provides stark lessons for organisations undertaking major digital transformations:

Don't underestimate complexity. Decoupling highly integrated systems and replacing them with multiple new solutions involves complexity that organisations without prior experience consistently underestimate. What appears straightforward in business cases becomes extraordinarily challenging in implementation.

Build appropriate expertise first. Attempting major transformations without sufficient digital, commercial, and programme management expertise virtually guarantees problems. NS&I lacked the skills necessary to manage ambitious procurement and complex systems integration—a gap that cost over a billion pounds.

Factor in realistic contingency. Timetables that don't include contingency for delays, time for understanding technical infrastructure, testing solutions, or managing interdependencies are optimistic fantasies, not realistic plans.

Understand what you're replacing. Weak understanding of the complexity and interdependencies in existing systems leads directly to delivery problems. Systems integrator functions aren't optional extras—they're essential for understanding what you're actually trying to achieve.

Maintain integrated planning. Without integrated plans and end-to-end solutions, tracking performance, spending, and risk becomes impossible. Programmes fragment into disconnected initiatives that don't cohere into functional outcomes.

Competitive procurement isn't optional. Extending contracts repeatedly without competition creates expensive lock-in situations. When transformation programmes fail, organisations find themselves negotiating from positions of weakness with incumbent suppliers.



The Broader Context

NS&I's £1.3 billion overrun and four-year delay join a depressing list of UK public sector technology failures. From the abandoned NHS National Programme for IT to various Home Office immigration system disasters, the pattern repeats: ambitious scope, underestimated complexity, insufficient expertise, procurement problems, and eventual resets costing billions more than originally projected.


The question is whether lessons from these failures will be applied to future programmes, or whether the next major transformation will repeat the same mistakes with predictably expensive results.



Expert Programme Management for Complex Transformations

At Altiatech, we've seen too many digital transformation programmes fail through inadequate planning, underestimated complexity, and insufficient expertise. Our approach focuses on realistic assessment of technical challenges, appropriate contingency planning, and ensuring organisations have the commercial and technical skills necessary for successful delivery.


Whether you're planning major system replacements, managing complex procurements, or recovering troubled programmes, our team provides the programme management expertise, systems integration capabilities, and commercial skills that prevent billion-pound overruns.


Don't let your transformation become the next cautionary tale. Work with experts who understand the complexity of replacing integrated systems and have the experience to deliver successfully.


Get in touch today:

📧 Email: innovate@altiatech.com
📞 Phone (UK): +44 (0)330 332 5482

Realistic planning. Expert delivery. Successful outcomes.

November 17, 2025
Anthropic has disclosed the first documented case of a large-scale cyberattack executed with minimal human intervention, marking a significant escalation in AI-enabled cyber threats. The campaign, attributed with high confidence to a Chinese state-sponsored group, demonstrates how rapidly AI capabilities are being weaponised for espionage operations.
November 14, 2025
Microsoft has unveiled its first "AI superfactory" - a revolutionary approach to cloud infrastructure that connects multiple datacentres across vast distances to function as a single, unified AI training system. The innovation marks a significant shift in how hyperscale computing infrastructure can be architected.
November 7, 2025
For the first time in UK history, a cyberattack has caused sufficient damage to impact the nation's GDP growth. The Bank of England has cited the Jaguar Land Rover breach as a contributing factor to the country's slower-than-expected economic performance, marking a watershed moment in understanding cyber threats as macroeconomic risks.
November 6, 2025
Marks & Spencer has revealed the full financial impact of its April 2025 cyberattack, with total costs reaching £136 million and profits plummeting by more than half. The incident demonstrates how a single cyber breach can devastate even large retailers' financial performance and operational capabilities. 
November 5, 2025
Police forces in England and Wales spend approximately £2 billion annually on technology, with 97% dedicated solely to maintaining legacy systems. This leaves almost nothing for innovation, artificial intelligence, or the service transformation needed to improve policing productivity.
November 5, 2025
The UK's Department for Environment, Food & Rural Affairs has spent £312 million modernising its IT infrastructure, including replacing 31,500 Windows 7 laptops with Windows 10—an operating system that officially reached end of support in October 2024. The timing raises serious questions about IT planning and the mounting cost of technical debt in public sector organisations.
November 3, 2025
If your organisation relies on Exchange Server, SQL Server 2016, SharePoint Server, or specific Azure services, critical end-of-life dates are approaching. These aren't just calendar dates—they represent significant milestones affecting your security, compliance, and operations.
October 31, 2025
Zero trust has become one of the most discussed concepts in cybersecurity, yet widespread misconceptions make it difficult for organisations to understand what it actually involves. Vendor marketing hasn't helped, with many claiming their products deliver "zero trust" when in reality, it's neither a product nor a simple switch you can flip.  This guide cuts through the confusion to explain what zero trust genuinely means and when your organisation should consider adopting it.
October 30, 2025
A critical vulnerability in Chromium's Blink rendering engine remains unpatched despite being disclosed to Google over two months ago, leaving billions of users vulnerable to browser crashes and system freezes.
October 30, 2025
Microsoft's Azure cloud platform experienced a significant global outage on Wednesday, taking down major websites including Heathrow Airport, NatWest, Minecraft, and numerous retailers across several hours before services were restored.