Exact requirement
Each detail page names the article, section, scope and current status.
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
[INDIA] RBI, SEBI and IRDAI · Source-code escrow and continuity obligations for critical applications[EU DORA] ICT third-party risk testing required · In force Jan 2025[PRA] SS2/21 UK · Vendor recovery evidence required[MAS] Singapore TRM · Independent vendor recoverability expected[APRA] CPS 230 Australia · Third-party continuity obligations in force[FFIEC] United States · Source-code access and software escrow addressed in third-party contracts[ENTERPRISE] Mission-critical software procurement increasingly requires continuity evidence before contract
SOFTWARE ESCROW & RECOVERABILITY REGULATIONS
One signed Proof of Recovery. Every rulebook that matters
Financial regulators are converging on the same expectation: critical third-party software must remain recoverable when the provider fails. Castler maps software escrow, current custody and signed recovery evidence to the exact framework that governs your institution.
RBISEBIIRDAIDORAFCAMASAPRA
GLOBAL COVERAGE
Nine jurisdictions. Seventeen evidence maps
Select a jurisdiction to open the regulation, deadline and evidence mapping behind it.
● IN FORCE● DEADLINE PENDING● STANDARD
REGULATORY EVIDENCE NETWORK
Live jurisdiction index
09
COVERED
SELECT A NODE TO EXPLORE
THE GLOBAL REGULATORY MANDATE
The regulator stopped asking “Do you have escrow?” It now asks “Can you prove recovery?”
Across financial regulation, cyber-resilience rules and global assurance standards, the direction is converging: critical third-party software must remain current, testable and recoverable when its provider fails.
17
MANDATES
9
JURISDICTIONS
European UnionUnited KingdomUnited StatesAustraliaSingaporeSaudi ArabiaUnited Arab EmiratesGlobal StandardsIndia
Explore every mandate and evidence map
17
Regulation and standard mappings
9
Regions and framework groups
Per release
Current recoverability evidence
Signed
Board-examinable artefact
THE STRUCTURAL SHIFT
The agreement was a proxy. Regulators now want the evidence
Software escrow regulation began with a custody problem: a regulated institution depended on software it did not own and needed continuing access if the vendor failed. The contract and source-code deposit created a legal path to those materials. Modern frameworks now examine whether the institution can actually maintain the critical function through disruption.
That change is visible across RBI IT Directions §12(f), RBI PSO §17(c), SEBI CSCRF and IRDAI’s Information and Cyber Security Guidelines in India; DORA Articles 9, 28 and 30 in Europe; PRA SS2/21 and the UK operational-resilience regime; MAS technology-risk expectations; and APRA CPS 230. The language differs, but the operational question is consistent: is the third-party dependency understood, current, testable and recoverable?
Castler separates the two layers. Cloud Custody establishes software escrow, current deposit capture, agreement management and an audit trail from vendor onboarding. Software Recoverability independently rebuilds, deploys and replicates the application, then seals the evidence as a signed Proof of Recovery.
Artefact mapping
Every regulatory expectation is paired with a specific custody or Proof of Recovery artefact.
Onboarding-first
The control begins when the vendor contract starts, not when an audit finding appears.
THE DIRECTORY
Pick your jurisdiction. Read the exact evidence mapping
Each page explains the issuing body, requirement reference, entity scope, compliance timeline, consequences, Castler mapping, frequently asked questions, and related regulations. The summaries support orientation and should be read alongside official texts and professional advice.
India — RBI · SEBI · IRDAI
Source-code escrow, current deposits, third-party cyber resilience, and recovery evidence across banking, payments, capital markets, and insurance.
United Kingdom
PRA and FCA expectations require credible stressed exit, material-provider continuity, impact tolerances and demonstrable operational resilience.
United States
Third-party technology, continuity and recoverability requirements for the jurisdiction or standard.
Australia
APRA CPS 230 requires operational-risk management, material-service-provider controls and continuity of critical operations within tolerance.
Singapore
MAS technology-risk guidance covers outsourced software, third-party governance, secure delivery and tested IT continuity.
Saudi Arabia
Third-party technology, continuity and recoverability requirements for the jurisdiction or standard.
United Arab Emirates
Third-party technology, continuity and recoverability requirements for the jurisdiction or standard.
REGULATORY MAPPING
Show your regulator recovery is a procedure
Bring your perimeter. We’ll map the current custody, critical applications, article language and signed recovery evidence your institution needs.
Book a 15-min briefingISO 27001SOC 2 Type IIPCI DSS