Understanding the Latest FFIEC Software Escrow Requirements: A Guide for US Financial Institutions


In September, the Federal Financial Institutions Examination Council (FFIEC) released updated guidance on software escrow for financial institutions in the United States. This new guidance aims to ensure financial institutions can continue their operations, even if a third-party software vendor experiences an unexpected disruption. For financial institutions that rely heavily on software to support their operations, this update is crucial for managing risks effectively and maintaining business continuity.

What is Software Escrow?

Software escrow, also known as source code escrow, is a three-party agreement between a software company (the depositor), the end user company (beneficiary) and the software escrow agent. The objective of a software escrow agreement is to provide comfort to the beneficiary or in this case a financial institution specifically, that if the software vendor is unable or unwilling to support the software, critical software assets such as code, data or a production cloud environment can be released to them and business can continue operations.

Key Takeaways from the FFIEC Guidance

The updated FFIEC guidance emphasises several important aspects of software escrow for financial institutions, including:

  1. Risk Assessment and Vendor Due Diligence
    • The FFIEC highlights the importance of thorough risk assessment and vendor due diligence. Financial institutions are encouraged to evaluate the stability of their software vendors and the criticality of the software they rely on.

    • Institutions should review the vendor’s financial health, historical performance and contingency plans. The guidance suggests that institutions should also consider the vendor’s compliance with cybersecurity standards and resilience measures. Business continuity strategies are then to be developed following the risk assessment process covering areas such as supplier or software failure.

  2. Contractual Requirements for Software Escrow Agreements
    • The new guidance stresses that software escrow agreements should be robust and detailed. They should clearly define the conditions under which the source code will be released, the process for code verification and the ongoing maintenance of the software escrow account.

    • Financial institutions should negotiate agreements that include regular updates to the software escrow account, especially when the software undergoes significant changes or updates.

  3. Monitoring and Testing Software Escrow Materials
    • Financial institutions should make sure that regular monitoring and testing is done on the escrowed materials. This involves verifying that the source code held in escrow matches the current version used by the financial institution.

    • The FFIEC also recommends performing testing to validate that the software can be recompiled and implemented as needed. This helps ensure that the source code is usable if a release event occurs.

  4. Business Continuity Planning
    • The guidance reinforces the role of software escrow in business continuity planning. Financial institutions should consider the potential impact of a software vendor’s failure on their operations and include software escrow arrangements in their continuity strategies.

The updated FFIEC software escrow guidance underscores the need for US financial institutions to be proactive in managing their third-party software risks. By understanding the requirements and taking the necessary steps to implement effective software escrow agreements, institutions can better protect their operations and ensure long-term resilience.

How The Escrow Company Can Help

The Escrow Company specialises in providing innovative software escrow and SaaS escrow solutions tailored for financial institutions. With a deep understanding of the new FFIEC guidelines, The Escrow Company can help your financial institution design and implement a robust software escrow strategy that meets regulatory requirements and supports your business continuity objectives. When consuming software under a SaaS model over traditional on-premise software, this provides different challenges when considering business continuity management. We can provide guidance on how best to utilise escrow for cloud hosted solutions as well as advise on the latest variety of SaaS escrow solutions in the market. Our innovative services include:

  • Customisable Software Escrow & SaaS Escrow Agreements that define clear terms for source code release, cloud environment access or ongoing support services.
  • Automated Software Escrow Services that keep your escrow account up-to-date with the latest software versions and changes.
  • Verification Services to ensure exit strategies are tested, ensuring that the event of supplier failure, the source code and deposit materials are complete, accessible and usable.
  • Expert Guidance to help you navigate compliance and regulatory requirements, and best fit solution to meet objectives, so you can focus on your core business.

Reach out to us today to learn how we can support your software escrow needs and ensure compliance with the latest FFIEC guidelines.

##

About The Escrow Company

The Escrow Company, based in Atlanta, USA is the US division of Escrow London, a global software escrow and SaaS escrow company with offices also in London, UK, and Sydney, Australia.

We have invested considerable resources into innovation to reinvent software escrow for a SaaS world. The Escrow Company provides a range of SaaS Continuity escrow solutions suitable for AWS, Microsoft Azure and Google Cloud hosted SaaS applications. We support a wide range of clients includes major law firms, banks, central banks, insurance companies, technology companies and government organizations.

To find out more about our software escrow and SaaS escrow solutions, visit our  YouTube channel.