[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract

DORA · FCA · MAS · APRA

Global Financial Institutions runs on vendor software. Prove the critical stack can recover

Identify the vendor-built systems inside regulated services, keep every release current, and produce independent recovery evidence before an incident.

GLOBAL FINANCIAL INSTITUTIONS SYSTEMS

The vendor-built systems inside the critical path

Cross-region core platform

CRITICAL

Payments and treasury

CRITICAL

Identity and financial crime

HIGH

Regulatory reporting

HIGH

WHAT THE REGULATOR ASKS

DORA · FCA · MAS · APRA

In summary

Material ICT dependencies need documented exit, tested continuity and evidence that critical functions can remain within tolerance when a provider fails.

Read the regulation evidence map

THE EVIDENCE PACK

The artefacts that make the obligation examinable

Build Report

Deployment Runbook

Replication Report

SBOM

Signed Proof of Recovery

Institutional proof

Approved institutions across Castler’s trust infrastructure

A growing network of banks, payment institutions and financial-services leaders relies on Castler’s trust infrastructure for controlled, accountable money movement.

Named institutions across banking, payments and lending
Castler trust networkApproved institutions
HDFC Bank
SBI
Canara Bank
HDFC Bank
SBI
Canara Bank
HDFC Bank
SBI
Canara Bank
Union Bank
Indian Bank
India Post Payments
Union Bank
Indian Bank
India Post Payments
Union Bank
Indian Bank
India Post Payments
NSDL Payments
Pine Labs
Mahindra Finance
NSDL Payments
Pine Labs
Mahindra Finance
NSDL Payments
Pine Labs
Mahindra Finance
BanksPayment institutionsNBFCsFintech

REGULATORY OBLIGATIONS

Global regulatory framework

Global financial institutions operating across jurisdictions face a convergent set of software escrow and recoverability obligations: EU DORA, UK PRA SS2/21, Singapore MAS TRM, Australia APRA CPS 230, Saudi Arabia CST, and UAE ADGM FSRA.

GLOBAL FINANCIAL INSTITUTIONS

Make the Global Financial Institutions Software Estate recoverable.

Bring the critical system stack and applicable rulebook. We’ll map custody, verification and signed evidence.

Book a 15-min briefing
ISO 27001SOC 2 Type IIPCI DSS

No spam · Reply within one business day