.avif)
Financial institutions are facing increasing regulatory pressure to demonstrate operational resilience, particularly when relying on third-party technology providers. For firms regulated by the Prudential Regulation Authority (PRA), robust outsourcing and third-party risk management are no longer optional. They are an essential part of regulatory compliance.
Software Escrow can play an important role in helping regulated organisations meet these expectations and requirements. This blog explores the PRA's requirements, the challenges associated with third-party software dependencies, and how SES Secure’s Software Escrow services can help strengthen operational resilience and support regulatory compliance.
This blog refers various PRA Supervisory Statements (SS). These can all be found within the PRA Rulebook.
What is the PRA?
The Prudential Regulation Authority (PRA) is part of the Bank of England and is responsible for supervising banks, building societies, insurers, credit unions, and major investment firms operating in the UK. The PRA's overarching aim is to promote the safety and soundness of regulated firms and ensure the stability of the financial services sector.
As financial institutions increasingly rely on outsourced technology providers, cloud platforms, and specialist software developers/vendors, the PRA has introduced guidance designed to strengthen operational resilience and reduce third-party risk.
Understanding PRA Outsourcing and Third-Party Risk Requirements
The PRA's Supervisory Statement SS2/21: Outsourcing and Third-Party Risk Management outlines how regulated firms should manage outsourcing arrangements and critical third-party relationships. The guidance complements the PRA's wider operational resilience framework.
Key expectations include:
- Identifying critical and important business services.
- Assessing the risks associated with third-party suppliers.
- Maintaining effective governance and oversight.
- Implementing robust business continuity arrangements.
- Developing documented and tested exit strategies.
- Ensuring continued access to critical systems, services, and data during supplier disruption.
For organisations that depend on proprietary third-party software, meeting these requirements can present significant challenges.
Why Third-Party Software Creates Operational Risk?
Many organisations rely on software vendors to support essential operations, customer services, regulatory reporting, cybersecurity, payments processing, and other critical functions.
While these solutions deliver significant benefits, they can also introduce risk if the software provider experiences:
- Insolvency or bankruptcy
- Business failure
- Acquisition or ownership changes
- Service discontinuation
- Cyberattacks
- Failure to meet contractual obligations
- Withdrawal of support services
Without access to source code, technical documentation, deployment files, or other critical materials, organisations may struggle to maintain business continuity during such events.
This creates a potential resilience gap which regulators increasingly expect firms to address.
How Software Escrow Supports PRA Compliance?
Software Escrow provides an independent mechanism for protecting access to critical software assets if a supplier is unable to fulfil its obligations.
Under a Software Escrow agreement, essential materials such as source code, documentation, build instructions, databases, and deployment assets are securely deposited with an independent Escrow provider.
If a predefined release condition occurs, these materials can be released to the beneficiary, enabling continuity of operations.
- Strengthening Business Continuity Planning
The PRA expects firms to have robust business continuity arrangements for critical outsourced services. Software Escrow helps organisations prepare for vendor disruption by ensuring continued access to essential software assets when they are needed most.
For regulated firms, this can provide confidence that critical applications remain recoverable even if the software supplier experiences a significant business event.
- Supporting Exit Strategy Requirements
SS2/21 places considerable emphasis on documented and executable exit plans for material outsourcing arrangements. Firms must demonstrate that they can manage a stressed exit scenario and continue delivering important business services.
By providing access to source code and supporting materials, Software Escrow can form an important component of a broader exit strategy, reducing dependence on a single supplier and supporting transition planning.
- Reducing Supplier Dependency Risk
Where critical business services depend upon proprietary software, organisations often face concentration risk with a single vendor.
Software Escrow helps mitigate this risk by providing a contingency solution should the supplier become unable to support the software. This can strengthen third-party risk management frameworks and support regulatory expectations around resilience.
- Enhancing Governance and Risk Management
The PRA expects firms to understand and manage risks associated with material outsourcing arrangements. Software Escrow demonstrates a proactive approach to supplier risk management and can provide valuable evidence as part of governance, audit, and compliance reviews.
How SES Secure Supports PRA-Regulated Organisations
SES Secure helps organisations strengthen operational resilience through independent Software Escrow, SaaS Escrow and SaaS Continuity solutions designed to protect access to mission-critical software.
Key capabilities include:
Independent Software Escrow
Secure storage of source code, documentation, data, and other critical materials through legally robust Escrow agreements.
Validation/Verification Services
Regular validation/verification testing can help confirm that deposited materials are complete, usable, and capable of supporting recovery objectives if a release event occurs.
Multi-Site UK Sovereign Data Centres
Critical Escrow deposits can be securely stored across geographically separate UK sovereign data centres, helping organisations enhance data security, resilience, and availability.
Business Continuity Support
SES Secure solutions can be integrated into wider business continuity, supplier risk management, and operational resilience frameworks to support regulatory expectations.
Practical Steps Towards PRA Compliance
Organisations seeking to strengthen alignment with PRA expectations should consider:
- Identifying critical and important business services.
- Mapping key third-party technology dependencies.
- Assessing software supplier concentration and continuity risks.
- Reviewing exit and recovery arrangements.
- Implementing software escrow where proprietary software supports essential operations.
- Regularly testing resilience and recovery capabilities.
By taking these steps, firms can better demonstrate that they have considered and mitigated risks associated with critical third-party software providers.
Working with SES Secure
As PRA expectations around operational resilience continue to evolve, organisations must look beyond traditional risk management practices and address potential vulnerabilities within their software supply chain. This is something that SES Secure’s team of experts can assist with.
SES Secure’s Software Escrow services provide an effective safeguard against supplier disruption, helping organisations maintain access to critical systems, support business continuity planning, and strengthen compliance with PRA outsourcing and third-party risk management requirements.
For firms seeking to enhance operational resilience, SES Secure's Software Escrow solutions provide an additional layer of protection that helps ensure critical software remains available when it matters most.
Don’t just take our word for it – here’s what our clients have said about their experiences with us.
To arrange a chat with a member of our team, please get in touch.