Re: They still use XP
Sainsbury's Bank does not necessarily mean Sainsbury's Store. Just because the Supermarket uses XP (which is perfectly valid for some use cases) does not necessarily mean their Bank uses XP.
If Sainsburys have followed FCA and PCI guidelines then the Bank network will be separate from the rest of the group, treating the group as a third party. (I don't know if it is or not, but I know several of the other players in the same situation have entirely separate networks).