Exit Planning For Cloud Service Providers

Exit Planning is now a regulatory obligation, not best practice. Under DORA, ECB, RBI, EBA, failure to have tested exit plan = supervisory breach.

1. Why Exit Planning?

Risks of Cloud Concentration:

• Vendor lock-in: technical (proprietary APIs, data formats) and commercial (egress fees $0.09/GB, long commitments)
• Single point of failure: IDCF cloud ransomware 2023-24 showed banks unable to exit because no tested plan
• Regulatory: Bank remains responsible for critical functions even if CSP fails

Definition: Exit Strategy = documented, tested plan to ensure business continuity during and after exit from cloud service, whether planned, stressed, or forced without cooperation of CSP.

2. Regulatory Framework

A. EU - DORA - Regulation EU 2022/2554 - In force 17 Jan 2025

Core articles:

• Art 12(6): Business continuity management must address worst-case scenario where some or all cloud services are not available and institution has to perform exit under stress or exit without cooperation from CSP
• Art 28(8): Exit strategies for ICT services supporting critical or important functions must be documented, sufficiently tested and reviewed periodically, with alternative solutions and transition plans identified
• Art 28 Register: Standardised under Implementing Regulation EU 2024/2956 - every cloud contract in register
• Art 29: Concentration risk assessment - avoid over-reliance on one CSP
• Art 30: Contractual provisions including audit rights and exit support: obligation of CSP to assist, turnaround times for returning data, data portability and secure deletion

Level 2 RTS: Regulations 2024/1773 and 2024/1774 detail ICT risk management and reporting.

B. ECB Guide on Outsourcing Cloud Services - 16 July 2025

Published by ECB Banking Supervision, clarifies DORA.

Expectations:

1. Exit strategies with clearly defined roles and responsibilities and estimated costs, put in place before systems go live
2. Must be tested periodically, demonstrate real ability to exit
3. Must cover:
   • Clear exit triggers (failure, insolvency of CSP, regulatory order, commercial exit)
   • Roles of parties, including CSP obligation to continue service during transition
   • Data retrieval: format, location, timeline
   • Transition to new provider or in-house
   • Cost estimation
   • Communication plan
4. For critical functions, must include exit under stress without cooperation - i.e., what if AWS/ Azure refuses to assist?

Applies to all credit institutions under direct ECB supervision, covers IaaS, PaaS, SaaS, public/private/community/hybrid.

Draft or refresh exit strategies is explicit supervisory expectation in 2025 guide.

C. EBA, EIOPA Guidelines

• EBA Guidelines on Outsourcing (2019) and Cloud (2020): When outsourcing concerns critical or important functions, specific contractual requirements apply, clear exit strategy should be in place
• EIOPA: Same - clear exit strategy for critical functions

D. RBI - India

• Master Direction on Outsourcing of IT Services 2023 - Para 22(1): IT outsourcing policy shall contain clear exit strategy ensuring business continuity during and after exit. Cloud annex adds turnaround times for returning data, data portability and security
• Payments Banks - Managing Risks in Outsourcing Directions 2025: These Directions apply to outsourcing of financial and IT services including cloud computing. Defines Exit Strategy Risk - may arise when bank becomes over reliant on one vendor. Para 83: IT outsourcing policy shall contain clear exit strategy
• Draft Directions Rural Co-op Banks Fraud Risk Management 2026: Same

E. EU Data Act - Regulation EU 2023/2854 - Cloud Switching Regime from 12 Sep 2025

Turns exit strategy into audit-ready operational control.

• Customers can initiate switch on 2 months' notice
• Switching activities must complete within 30-day transitional period, followed by 30-day retrieval period
• Termination after retrieval
• Mandatory switching rights, porting of exportable data and digital assets to different provider or multi-cloud
• Phased ban on switching fees: Egress charges capped at cost, no markup, eventually zero
• Obligation of source provider to assist, maintain functional equivalence during transition

CMA UK provisionally found egress fees and technical barriers harm competition, AWS and Microsoft each holding up to 40% of UK spend.

3. What Must Exit Plan Contain? - Practical Checklist

Under ECB Guide + DORA Art 28(8):

Trigger Inventory:

• Planned exit (commercial decision)
• Triggered exit (breach, SLA failure, security incident)
• Stressed exit (CSP insolvency, DORA Art 12(6) worst-case)
• Regulatory forced exit (supervisor deems concentration risk)

Service Mapping: Which critical or important function supported by which cloud service, which data classification

Exit Options:

• Re-migration to on-premise
• Switch to alternative CSP (must have alternative identified in advance)
• Multiple providers (multi-cloud strategy)

Data Portability:

• Format (open standards, avoid proprietary)
• Location and retrieval method
• Integrity verification, chain of custody
• Secure deletion certification from old CSP

Timeline & RTO/RPO: ECB expects estimated costs and timelines defined before go-live, not after incident

Testing: DORA requires sufficiently tested and reviewed periodically. ECB expects tabletop + live test annually for critical functions. Must demonstrate ability to operate without CSP for defined period.

Contractual Safeguards:

• Exit assistance period (typically 12 months)
• Continued service obligation
• Audit rights during exit
• No data hostage clause

4. Case Laws and Enforcement

Case 1: Blade Motor Group v Reynolds & Reynolds - England - High Court - Lock-out as Failure of Exit Planning

Facts: Motor dealership used SaaS to record customer information. Supplier Reynolds & Reynolds applied remote lock on software to prevent login following payment dispute.

High Court ruling left dealership without access to its own customer data.

Lesson: Without exit plan including local data copy and contractual prohibition of remote lock-out without court order, customer loses data. Similar end-result arises where supplier disables licence key, password or login to SaaS/cloud following dispute.

Drafting response: Must have clause prohibiting supplier lock-out, requiring data return in 30 days.

Case 2: DORA Enforcement - Expected 2025-26 - ECB Supervisory Actions

ECB Guide notes supervisory experience: Several Significant Institutions received findings in 2024 SREP for inadequate exit plans - e.g., bank outsourced core banking to single hyperscaler without alternative identified, no tested exit. Required to remediate within 12 months or face capital add-on under Pillar 2.

Although not public court case yet, DORA Art 50 provides for administrative penalties up to 2% annual turnover.

Case 3: UK CMA Cloud Market Investigation 2023-2025

CMA provisionally found egress fees and technical barriers are features harming competition. AWS charges nothing for data in, but $0.09/GB out after 100GB free. For petabyte-scale bank data migration, cost multi-million.

Result: EU Data Act caps egress at cost. This directly supports exit planning - exit must be financially feasible.

Case 4: FTC & EU Commission Parallel Review - Antitrust Lock-in

FTC examining whether data egress fees, long-term spending commitments, bundled licensing make switching difficult. EC under DMA assessing whether Azure and AWS designated core platform services subject to interoperability and data portability obligations.

Google filed antitrust complaint 2024 alleging Microsoft cloud licensing practices lock customers into Azure through steep markups for running Windows workloads on rival clouds.

Implication for banks: If bank locked into Microsoft because Windows licences, exit plan fails competition law test; supervisor may deem concentration risk unacceptable.

Case 5: RBI Action on Paytm Payments Bank 2024 - Outsourcing Failure

While not pure cloud, RBI's action cited failure to have clear exit strategy and over-reliance on single group entity for IT services, violating Master Direction outsourcing. Business restricted.

5. Best Practice Template - Compliant with DORA + ECB + RBI

Exit Plan Document must have:

• Version, Owner (CIO + CRO), Last Test Date
• Classification: Critical / Important / Non-critical (per DORA)
• Dependency Map: Data, application, CSP region, sub-contractors
• Exit Triggers & Decision Matrix: Who decides exit, escalation to Board
• Target Architecture: Where service will move (on-prem / CSP B)
• Data Return Plan: Format JSON/Parquet, via Snowball / Direct Connect, encrypted, 30+30 days as per Data Act
• Continuity Plan: How to operate during transition, manual workarounds
• Cost Estimate: Egress fees, double-running costs, re-platforming
• Test Evidence: Last tabletop date, last live migration test, lessons learned
• Contract Reference: Clause numbers for exit assistance, audit, deletion