SINGAPORE · SOFTWARE ESCROW
Software Escrow for Singapore Financial Institutions
01
What MAS requires
The Monetary Authority of Singapore's Technology Risk Management Guidelines establish expectations for governance, technology-risk management, third-party services, system resilience, acquisition, business continuity, and recovery testing. Financial institutions should understand external dependencies and apply controls proportionate to the criticality of the system and the risks of vendor failure or service disruption.
MAS TRM §5.3.4 states that an institution should assess whether a source-code escrow agreement should be in place based on the criticality of acquired software, so it can access the source code if the vendor is unable to support it. Where escrow cannot be implemented, the guideline says suitable replacement alternatives should be identified.
Escrow is therefore one part of a wider resilience model. Institutions also need current materials, credible release conditions, mapped dependencies, tested recovery arrangements, and evidence that controls remain effective as applications and third-party environments change.
02
What Proof of Recovery means for MAS TRM compliance
Castler SRP goes beyond storage by rebuilding and redeploying the vendor's application in a clean environment without the vendor present. The procedure tests whether the deposited source code, build scripts, dependencies, configuration, and documentation are sufficient to recreate and operate the release.
The resulting signed Proof of Recovery contains a Build Report, Deployment Runbook, Replication Report, SBOM, exceptions, and the seal of a named verification engineer. This gives technology risk, vendor management, internal audit, and business continuity teams a structured, dated record of what was verified.
For MAS-aligned oversight, the evidence helps distinguish a current and operational recovery control from an untested contract or ageing deposit. It also gives stakeholders a repeatable baseline for later releases and a clear record of issues that require remediation.
03
Who Castler SRP is built for in Singapore
Castler SRP is designed for Singapore-regulated banks, insurers, capital-markets firms, payment institutions, asset managers, and fintechs managing critical vendor software under MAS TRM. Typical engagements cover core banking platforms, trading and risk systems, payment processing engines, regulatory reporting, policy administration, and specialised applications supporting important services.
A programme can start with one designated critical vendor or a prioritised group from the software estate. Castler works with technology risk, vendor management, legal, information security, business continuity, and application owners to define the agreement and produce the technical evidence required for each verified release.
04
From source-code access to tested recovery
The engagement starts by confirming application criticality, vendor obligations, release cadence, hosting model, dependencies, data location, and existing recovery controls. The escrow agreement defines the materials to be deposited, update requirements, access controls, release conditions, and the responsibilities of each party.
Castler captures and checks the deposit, reconstructs the build and deployment process, and records missing knowledge through structured reconciliation. The Emergency Deployment Runbook turns that knowledge into an operational procedure. A signed evidence pack is then produced for the exact release verified.
Later production releases can be captured against the same custody record and tested using the established verification foundation. This lets the institution track recovery evidence over time instead of treating escrow as a one-off procurement document.
FREQUENTLY ASKED QUESTIONS
Software escrow in Singapore
Does software escrow satisfy MAS TRM expectations?+
MAS TRM §5.3.4 says financial institutions should assess whether source-code escrow is appropriate based on software criticality. Castler combines escrow with active verification, giving the institution evidence that the deposited release was rebuilt and run.
Is Castler SRP available to Singapore-regulated institutions?+
Yes. Castler SRP supports Singapore financial institutions directly and works with technology-risk, vendor-management, legal, security, and continuity teams to scope critical vendor applications.
How does Proof of Recovery support MAS audits?+
Proof of Recovery is a structured, signed evidence pack containing the Build Report, Deployment Runbook, Replication Report, SBOM, exceptions, and the named verification engineer's seal for the verified release.
How is verified escrow kept current?+
The agreement defines a release and deposit cadence. Each later production release can be captured against the same custody record and run through the established verification procedure, creating a new dated evidence pack.
CASTLER SRP
Discuss your critical vendor software estate
Bring one critical application, its regulatory perimeter, and the recovery evidence you have today