[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications·[EU DORA] ICT third-party risk testing required · In force Jan 2025·[PRA] SS2/21 UK · Vendor recovery evidence required·[MAS] Singapore TRM · Independent vendor recoverability expected·[APRA] CPS 230 Australia · Third-party continuity obligations in force·[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts·[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract·
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications·[EU DORA] ICT third-party risk testing required · In force Jan 2025·[PRA] SS2/21 UK · Vendor recovery evidence required·[MAS] Singapore TRM · Independent vendor recoverability expected·[APRA] CPS 230 Australia · Third-party continuity obligations in force·[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts·[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract·
LEARNING HUB
The evidence layer behind software recoverability
Primers, regulation guides, glossary definitions and practical answers for risk, compliance and engineering teams moving from software escrow to current, signed recovery evidence.
What Is Payment Reconciliation A Guide For Growing Businesses
Every business that takes payments — online, offline, or both — eventually runs into the same problem. The number in your payment gateway does not match the number in your bank account. Not by a lot, but enough to matter. A missing settlement here, a duplicate charge there, a refund that processed on the wrong date. Chasing these differences is payment reconciliation, and for most growing businesses, it consumes far more time than it should.
Connected Banking in India: What's Driving Adoption in 2026
Connected banking adoption in India is accelerating due to RBI direction, digital public infrastructure, and the need to scale regulated financial ecosystems.
Connected Banking in India: What’s Driving Adoption in 2026
Connected banking adoption in India is accelerating due to RBI direction, digital public infrastructure, and the need to scale regulated financial ecosystems.
Lending escrow enables NBFCs and fintechs to ensure secure loan disbursement, regulatory compliance, and transparent fund control across lending operations.
Escrow arrangements help PPIs safeguard customer funds, maintain regulatory compliance, and ensure financial stability by separating user balances from operational risk.
Why Escrow Accounts Play a Critical Role in Dispute Cases
Escrow accounts provide secure, neutral fund handling in dispute cases, ensuring fairness, transparency, and legally compliant settlements for all involved parties.
Why Connected Banking Is the Future for Managing Multiple Current Accounts
Connected banking simplifies multi-bank current account management for businesses — delivering real-time cash visibility, faster reconciliation, and operational control without switching banks.
Each regulation guide names the article or section, entity scope, status, consequences and Castler artefacts that support the obligation. Orientation only; verify against official texts and professional advice.
RBI IT Directions §12(f)
Source-code escrow, updates and programme fixes for critical bank applications.
A legal and technical arrangement in which a software vendor deposits source code and supporting materials with a neutral third party for the benefit of a customer. The deposit may be released when a negotiated trigger event occurs. Modern software escrow should keep every production release current rather than preserve only the original filing.
Source Code Escrow
Source code escrow is the custody layer of software escrow. It normally includes source code, build scripts, technical documentation, dependencies and runtime configuration. The purpose is to preserve access to the materials required to maintain or transition critical software if the vendor is unavailable.
Proof of Recovery
A Proof of Recovery is a signed, numbered evidence pack showing that a specific vendor software release was independently rebuilt, deployed and verified. It connects the tested release to build logs, deployment instructions, architecture replication, an SBOM, a confidence score and a named engineer’s seal.
Emergency Deployment Runbook
An Emergency Deployment Runbook is the operational guide used to deploy recovered vendor software without the original vendor present. It documents environment setup, databases, configuration, health checks, operating dependencies and rollback procedures. Castler authors it during the reconciliation and authoring stages.
SBOM — Software Bill of Materials
An SBOM is an inventory of the libraries, packages, runtimes and components included in a software release. It supports supply-chain visibility, vulnerability management and reproducible builds. Castler generates the SBOM for the exact release included in each Proof of Recovery.
Agentic Verification
Agentic verification uses software agents to map dependencies, reconstruct build environments, compile applications, run checks and capture evidence. It reduces the time and consultant effort required for traditional verification while retaining a named human engineer for final review and accountability.
Escrow Trigger Event
A trigger event is a contractual condition that may permit the beneficiary to receive the escrow deposit. Common triggers include vendor insolvency, acquisition, product discontinuation, prolonged support failure or another negotiated breach. The executed agreement defines the evidence and release process.
Recoverability Score
A recoverability score is a numeric assessment of confidence that a specific release can be rebuilt and operated without the vendor. It reflects build completeness, dependency resolution, deployment success, replication fidelity and unresolved exceptions. The score should always be read with the underlying evidence.
Multi-party Escrow Agreement
A multi-party escrow agreement governs the vendor depositor, enterprise beneficiary and escrow agent. It defines deposit obligations, update frequency, access controls, trigger conditions, release procedures and responsibilities. Castler manages the agreement and audit trail alongside the technical deposit.
Verification Engineer
A verification engineer is the named professional who reviews the technical evidence produced during recovery testing. The engineer validates the build, deployment, replication, exceptions and confidence score before signing the Proof of Recovery. The seal creates accountable evidence rather than an anonymous automated output.
FREQUENTLY ASKED QUESTIONS
Questions from vendor-risk, compliance and technology teams
What is the difference between software escrow and software recoverability?
Software escrow is a custody arrangement: source code and supporting materials are deposited with a third party. Software recoverability is the demonstrated capability to rebuild and run that software without the vendor’s involvement. Escrow is the necessary first step; recoverability is the proof that the step was sufficient.
Do I need software escrow even if my vendor is large and well-funded?
Yes. Vendor size does not eliminate acquisition, discontinuation, faulty-update, key-person or cyber risk. The relevant question is whether the institution has current materials and tested evidence to recover if the vendor cannot provide support when it is needed.
How long does a Proof of Recovery take to produce?
A standard verification is designed to run in hours rather than the 14+ day cycle associated with consultant-led verification. The first verification may take longer because Castler maps dependencies, reconciles missing knowledge and authors the deployment runbook. Later release cycles reuse that foundation.
What does my vendor need to do?
The vendor deposits source code, build scripts, runtime configuration and documentation into Castler’s secure custody. The vendor participates in onboarding and structured reconciliation where knowledge is missing. Subsequent releases can be captured automatically and verification is designed to run without the vendor present.
Is a Proof of Recovery accepted by Indian regulators?
Castler’s artefacts are designed to map to RBI IT Directions §12(f), RBI PSO §17(c), SEBI CSCRF and IRDAI Information and Cyber Security Guidelines 2023. The full evidence pack should be presented with the relevant regulatory mapping and reviewed against the institution’s own supervisory perimeter.
What happens when the vendor releases a new version?
The release is captured through the repository integration and linked to the custody record. A new verification cycle can run against that version and produce a new Proof of Recovery, ensuring the evidence follows the software actually in production.
Can I start with custody and upgrade to full recoverability later?
Yes. Organisations can begin with Cloud Custody to establish the agreement and current deposit, then upgrade to Standard or Premium Software Recoverability. The existing deposit and vendor arrangement become the foundation for verification, so the vendor does not start again.
Turn the next regulatory question into a clear answer
Explore software escrow, Proof of Recovery and the rulebook that applies to your institution, then bring your specific perimeter to a Castler briefing.