I. WHAT IS CRITICAL VENDOR?

Under EBA Guidelines on Outsourcing EBA/GL/2019/02 (25 Feb 2019), RBI Master Direction on Outsourcing of IT Services 2023, and OCC US:

Critical or Important Function: If failure would:

• Materially impair financial institution's ability to comply with license
• Affect financial performance
• Affect ability to manage risk
• Affect customer service continuity

Examples in Banks: Core Banking System (Infosys Finacle, TCS BaNCS), Cloud (AWS, Azure), Card network (Visa), KYC vendor, Collection agency.

Spain: Banco de España adopted EBA Outsourcing Guidelines as its own - all Spanish banks (Santander, BBVA, CaixaBank) must classify vendors as critical / non-critical.

II. REGULATORY REQUIREMENTS FOR EXIT PLAN

EBA/GL/2019/02 Para 95-100 + RBI Outsourcing Directions 2023 Para 10.2:

Every contract with critical vendor MUST contain:

1. Exit Strategy Document: Standalone document, reviewed annually, approved by Board.
2. Exit Triggers: Insolvency, breach, deterioration of service, regulatory order, change of ownership, country risk.
3. Transition Period: Minimum 6-12 months support after termination notice. Must be in contract.
4. Data Portability & Return: Vendor must return all data in readable format (JSON, CSV), delete copies, provide assistance for migration. No ransom.
5. Stranded Knowledge: Ensure know-how transfer - documentation, training.
6. Alternative Vendor / In-sourcing: Identified backup vendor or ability to bring in-house. Test it.
7. Costs: Estimated exit costs budgeted.

RBI adds: For cloud - must have multi-cloud or exit to on-prem, data must remain in India (data localization), must conduct exit drill every year.

III. EXIT PLANNING LIFECYCLE - 4 Phases

Phase 1 - Before Signing:

• Due diligence: Vendor financial health, sub-contractors
• Contract clause: Right to audit, right to terminate for convenience, step-in rights

Phase 2 - During Service:

• Monitor concentration risk
• Maintain escrow of source code for custom software
• Quarterly risk assessment

Phase 3 - Trigger Event:

• Invoke exit clause, issue termination notice
• Activate Transition Management Office

Phase 4 - Execution & Post-Exit:

• Parallel run 3 months, data migration, decommission
• Lessons learned

IV. CASE LAWS - WHERE NO EXIT PLAN = HUGE PENALTY

Case 1: LANDMARK - FCA vs TSB Bank - UK - £48.65 Million Fine - 2022

Facts: TSB migrated from Lloyds to Sabadell-owned PROTEO platform. Critical vendor was Sabis (Sabadell's IT arm). No exit plan. Migration failed April 2018 - 1.9 million customers locked out, 5 million customers data corrupted.
FCA/PRA Judgment:

• Breach of SYSC 8.1 - failure to ensure outsourcing did not impair operational resilience
• No documented exit plan from Sabis, no ability to roll back to Lloyds
• Board had no accountability map for vendor failure
  Fine: £48.65m (reduced from £72m). CEO resigned.
  Lesson: If you outsource core, you must have rollback/exit plan tested.

Case 2: RBI vs HDFC Bank - 2020-2021 - Internet Banking Outage

Facts: HDFC Bank outsourced data center to 2 vendors. Multiple outages Nov-Dec 2020 - netbanking down 3 times.
RBI Action under Sec 35A BR Act: Stopped all new digital launches, new credit cards.
RBI Audit Report cited: No exit plan for data center vendor, concentration on single vendor, no alternative data center. Bank could not exit quickly.
HDFC had to submit Board-approved exit plan for critical IT vendors before RBI lifted ban in Aug 2021.

Case 3: EBA Enforcement - BBVA / Santander - Spain - Banco de España 2022 Inspection

Facts: Banco de España inspected Spanish banks for compliance with EBA Outsourcing Guidelines EBA/GL/2019/02.
Finding: 60% banks had contracts without exit clause for cloud vendors (AWS/ Azure). No data portability clause.
Outcome: Banco de España required remediation under Circular 3/2020. No public fine but Pillar 2 capital add-on for operational risk.

Case 4: SEBI vs NSE - Colocation Scam + Critical Vendor - 2019-2022

Facts: NSE's critical vendor - trading technology provider - gave preferential access. No alternative vendor, no exit plan, vendor controlled market.
SEBI Order: NSE failed to ensure vendor independence, no exit. Banned from new products, forced to conduct independent audit of vendor management.

Case 5: US - OCC vs Citibank - 2020 - $400 Million Fine

Facts: Citi's critical vendor for risk management failed, Citi had no exit plan, risk data lost.
OCC: Violation of OCC Bulletin 2013-29 on Third Party Relationships. Ordered Board to create exit plans for all critical vendors.

Case 6: Australian - APRA vs CBA - 2018 Enforceable Undertaking - Outsourcing Failure

CBA outsourced AML transaction monitoring to vendor. Vendor failed to detect 53k breaches. CBA had no exit plan to bring monitoring in-house.
APRA: Required CBA to create accountability map showing who owns vendor failure.

Case 7: Contract Law - Data Return on Exit - British Waterways Board vs Severn Trent Water - UK - And Indian Cases

Indian: Dio Corporation vs Citi Financial - Delhi HC 2020
Facts: Citi outsourced collections to vendor, terminated. Vendor refused to return customer data, demanded pending payment.
Held: Under contract, data belongs to bank, not vendor. Vendor cannot hold data hostage. Bank can seek injunction for return. Court granted interim mandatory injunction - vendor must return data in 7 days.
Principle: Lien on data not allowed for critical vendor - must be explicit in contract.

Indian: Wipro vs Beckman Coulter - Arbitration 2021
Wipro terminated critical IT vendor, no transition support. Vendor claimed damages.
Arbitrator: Since exit clause required 6-month transition support at same price, vendor must provide. Failure to plan exit does not excuse.

V. WHAT REGULATORS CHECK DURING INSPECTION - CHECKLIST

From EBA/RBI inspection reports:

1. Do you have list of critical vendors with risk rating? Yes/No
2. Does each have signed exit plan dated within 12 months?
3. Does contract have: termination for convenience + 12 month transition + data return + deletion certificate?
4. Have you tested exit in last 12 months? (Table-top exercise)
5. Is exit cost estimated and budgeted?
6. Is there no concentration - not all critical functions with same vendor?

Failure of any = finding.

VI. MODEL EXIT CLAUSE - WHAT TO PUT IN CONTRACT

Code

Exit Management:a) Termination Assistance Period: Vendor shall provide support for 12 months post termination notice at same commercials.b) Data: Within 15 days of request, provide all data in encrypted format with schema, plus certificate of deletion after 30 days.c) Knowledge Transfer: 200 hours of training to new vendor.d) No Disruption: Vendor shall not degrade service during exit.

2 lines hidden

VII. FOR BANKS IN SPAIN / INDIA

Spain: Must file outsourcing register with Banco de España, including exit plan summary. Cloud outsourcing to non-EU requires notification 1 month before.

India: RBI Master Direction 2023 requires:

• Risk assessment before outsourcing
• Annual audit of critical vendor
• Exit plan testing annually, report to Board Risk Committee