UNITED KINGDOM · SOFTWARE ESCROW
Software Escrow for UK Financial Institutions
01
What UK regulators require
UK financial institutions face overlapping software escrow and recoverability expectations across several frameworks. PRA Supervisory Statement SS2/21 sets expectations for outsourcing and third-party risk management, including due diligence, business continuity, exit planning, testing, and oversight of material technology dependencies. Firms remain accountable for important business services even where delivery relies on an external provider.
The FCA operational resilience policy, including PS21/3, requires firms to identify important business services, set impact tolerances, map the people, processes, technology, facilities, and information needed to deliver them, and test whether they can remain within those tolerances during severe but plausible disruption. Vendor applications supporting those services therefore need an evidence-backed recovery path rather than a contractual assumption.
EU DORA applies directly to EU-regulated entities and can also shape the control environment of UK groups with EU operations. Its Article 30 contract provisions address ICT service descriptions, access, recovery, data return, assistance during incidents, audit rights, and exit arrangements for critical or important functions. The practical question across all three frameworks is whether the firm can produce current, examinable evidence for each critical dependency.
02
What Proof of Recovery means for UK compliance
Traditional software escrow deposits source code and supporting materials with a custodian. That protects access, but access alone does not demonstrate that the production release can be rebuilt, deployed, and operated without the vendor. Castler SRP extends custody into a controlled technical verification procedure.
Castler rebuilds and redeploys the vendor's application in a clean environment without the vendor present. The resulting signed Proof of Recovery includes a Build Report, Deployment Runbook, Replication Report, SBOM, recorded exceptions, and the seal of a named Castler verification engineer. Together, those outputs create a dated evidence pack for the exact release examined.
For operational resilience, vendor management, internal audit, and supervisory discussions, this turns a statement such as “the code is in escrow” into a more useful answer: which release was tested, what environment was recreated, what dependencies were required, what failed or needed reconciliation, and what procedure the institution would follow during a disruption.
03
Who Castler SRP is built for in the UK
Castler SRP is designed for UK-regulated banks, insurers, asset managers, payment firms, and fintechs managing critical vendor software under outsourcing, TPRM, and operational resilience programmes. Typical scopes include core banking platforms, payment processing systems, policy administration, trading and risk engines, regulatory reporting applications, and specialist SaaS products embedded in important business services.
A programme can begin with one material vendor or a prioritised cohort from the firm's software estate. Castler works with legal, technology, risk, procurement, and business-service owners to establish the agreement, identify the current production release, collect the required build and deployment materials, reconcile missing knowledge, and produce a repeatable verification procedure.
04
From escrow agreement to current recovery evidence
The engagement starts by mapping the vendor application, release cadence, hosting model, dependencies, existing contingency plans, and regulatory perimeter. The escrow agreement then defines deposit obligations, update frequency, access controls, release conditions, and the responsibilities of the vendor, beneficiary, and escrow agent.
Castler captures the agreed materials, checks completeness and integrity, and runs the application through an isolated rebuild-and-deploy workflow. Missing knowledge is reconciled into an Emergency Deployment Runbook so later verification cycles do not start from zero. Each new production release can then be linked to the custody record and verified against the established procedure.
A standard single-vendor engagement is commonly scoped over four to six weeks from agreement to the first Proof of Recovery, depending on application complexity, deposit quality, vendor responsiveness, and environment requirements. Multi-vendor estate programmes are prioritised and scheduled around criticality and regulatory commitments.
FREQUENTLY ASKED QUESTIONS
Software escrow in United Kingdom
Does software escrow satisfy PRA SS2/21 requirements?+
Software escrow can be an important control, but storage alone does not demonstrate operational recoverability. PRA SS2/21 expects proportionate assurance, business continuity, testing, and credible exit planning for material third-party arrangements. Castler's Proof of Recovery supplies technical evidence that the deposited release was rebuilt and run.
Is Castler SRP available to UK firms?+
Yes. Castler SRP supports UK-regulated financial institutions directly and works with legal, technology, risk, and vendor-management teams to scope critical software dependencies and the evidence required for each deposit.
How does Castler SRP support DORA-aligned UK groups?+
DORA Article 30 addresses contractual controls for ICT services supporting critical or important functions, including access, recovery, audit, incident assistance, and exit arrangements. Castler's custody record, verification outputs, and signed evidence pack support an institution's broader DORA control framework.
How long does setup take?+
A standard single-vendor engagement is typically scoped over four to six weeks from agreement to the first Proof of Recovery. Application complexity, deposit completeness, vendor participation, and environment requirements can change the timetable.
CASTLER SRP
Discuss your critical vendor software estate
Bring one critical application, its regulatory perimeter, and the recovery evidence you have today