Is TOTSCO fit for purpose

I have explained many of the issues with TOTSCO - the company that does "One Touch Switching" for UK broadband and telephone services.

My main gripes have been over the unbelievably poor specifications and stupidly inadequate processes for accrediting CPs to connect to the One Touch Switching system. This is partly why I made a testing system (NOTSCO) free for CPs to use, and have actively helped many CPs as a "buddy CP" for what testing there is. I am trying to make this work for everyone.

But it gets worse.

TOTSCO are actively refusing to pass on a simple message to another CP that is failing to meet the OTS specification.

In this case it is such an egregious failure one has to wonder how even the inadequate TOTSCO process got this CP on the system. No I am not naming the CP. The error is as basic as they come - a residentialSwichMatchRequest getting a residentialSwitchMatchConfirmation but without an actual switchOrderReference (or implicationsSent). This is the most basic function of OTS and is broken beyond belief. The CP should be REMOVED from the platform until they can show they can actually comply with the spec, and more importantly TOTSCO should have always been testing CPs do, in fact, comply with the spec. Failing to do so is unbelievably irresponsible.

They cite "security", but they is ZERO security issue with passing on such a message. And no GDPR issue either. Their refusal is baffling.

What is crazy is they do operate a "CP to CP" communications system, but signing up for this is not mandatory. When CPs do sign up TOTSCO WILL pass on messages. This highlights that passing on messages is not a security issue. So why not pass one based on a simple email when a CP is not signed up to "CP to CP" communications. There is no justification for this.

If TOTSCO are absolving themselves of ANY RESPONSIBILITY for policing ANY compliance with the One Touch Switch specification, whose job is it? It is not my job as a CP.

So who do we turn to - perhaps OFCOM. Maybe OFCOM will decide TOTSCO are ignoring the most basic responsibility for addressing CPs not complying with the OTS specification.

Should OFCOM police this somehow?

Note this is not the first instance of TOSTCO being so stupid - we have another CP failing to meet the OTS specification that is likely a GDPR breach. They REFUSE to tell the other CP. I have now contacted the ICO (no reply yet). But why REFUSE to pass on such a basic message (not personal data in the message and no security issue).

This needs fixing - OFCOM you need to fix this.