It's not an altogether unreasonable approach to security. It doesn't sit particularly well with geeks, but for complex systems with a high risk of fraud there's a great deal of damage-limitation to be found in only processing transactions when they can be manually monitored. Heuristic intrusion detection is still relatively poor.

For a government-to-business service, the overwhelming majority of legitimate transactions will occur during office hours and few people will be significantly inconvenienced by closing overnight. The risk of an attacker gaining even a few hours of brute-force insight is great, but the rewards from operating 24/7 slight.

While I'd like to be able to do my Companies House filings at 4am, I'm more keen to see my data protected.