I. Regulatory Mandate – Why Exit Strategy is Law

RBI Definition of Critical/Material (2023): If outsourcing relates to – Core banking, KYC, credit appraisal, risk management, customer data, cloud infrastructure = Critical.

II. Anatomy of a Compliant Exit Strategy – 12 Elements

Use this as template – regulators check for each:

1. Trigger Events – When to Exit:

• Contractual: Breach, insolvency, change of control, regulatory disapproval, failure to meet SLA 3 consecutive months
• Non-contractual: Concentration risk, geopolitical risk, loss of audit rights, 4th party failure

2. Exit Types:

• Convenience: For any reason, 6-12 months notice, no penalty (RBI mandates)
• Cause: Immediate, for material breach, insolvency
• Regulatory: RBI / ECB orders exit

3. Transition Period:

• Minimum 6-12 months for critical (RBI: not less than 6 months), 18 months for core banking
• Obligation of provider to continue service during transition – "Transition Assistance Services" at same rates

4. Data Portability & Deletion:

• Right to get all data in machine-readable, interoperable format (JSON, API) within 30 days
• Certification of deletion from provider and sub-contractors
• RBI: Data must be stored in India, exit must include return of India copy

5. Knowledge Transfer:

• Documentation, runbooks, source code escrow for customized solution
• Key personnel retention clause

6. Sub-contractor / Fourth Party Map:

• List of all sub-contractors, right to exit if sub-contractor fails (SolarWinds case)

7. Costs – Exit Costs Pre-Agreed:

• No exit fee for cause / regulatory exit (RBI mandatory). For convenience, capped fee.

8. Alternative Provider / In-House:

• Name of alternative provider or plan to insource – with feasibility analysis

9. Testing:

• Tabletop exercise annually, full exit test every 2 years

10. Continuity in Stressed Exit:

• If provider goes insolvent – step-in rights, access to escrow

11. IP & Licenses:

• Right to use IP during transition, assignment of licenses

12. Regulatory Notification:

• Inform RBI / ECB within 3 days of invoking exit for critical

III. Case Laws – When Exit Strategy Failed – And Bank/Executive Liable

A. GLOBAL – OUTSOURCING FAILURE = REGULATORY FINE

1. TSB Bank – UK – IT Migration Outsourcing to Sabis (Banco Sabadell) – April 2018 – £48.65m Fine + Personal Censure – The Leading Case on Exit Failure

• Facts: TSB outsourced core banking platform to parent Sabadell's IT provider Sabis. Migration from Lloyds platform. No proper exit strategy back to Lloyds. Migration failed – 1.9m customers locked out, 10,000 fraud cases.
• FCA/PRA Final Notice – Dec 2022:
• Findings:
  • No documented exit plan if migration failed – violation of PRA SS2/21 predecessor SYSC 8.1
  • No ability to rollback – old platform decommissioned before new stable
  • CRO and CIO failed reasonable steps under SM&CR
• Penalty: TSB fined £48.65m (PRA £29m + FCA £19m). CIO Carlos Abarca banned. Board malus 100% bonus.
• Ratio: Having outsourcing is not defence – must have tested exit. TSB could not exit because old system gone.

2. Capital One – AWS Cloud Outsourcing – 2019 – 106m Customers Data Breach – $80m OCC Fine – 2020

• Facts: Capital One outsourced to AWS, misconfigured WAF by insider Paige Thompson. Data breach.
• OCC Consent Order 2020:
• Bank failed to have exit strategy for cloud – could not quickly remove data from AWS, no audit of AWS IAM roles. Board failed to oversee critical outsourcing.
• Penalty: $80m fine, requirement to implement exit strategy for cloud within 6 months.
• Ratio: Cloud is critical outsourcing – exit means data portability and deletion, not just contract termination.

3. Robinhood – Trading Outage – March 2020 – Outsourcing to Cloud & Market Makers – FINRA $70m Fine

• Outsourced trading infrastructure to AWS + market makers. During volatility, infrastructure failed, no manual fallback (in-house).
• FINRA: No exit / business continuity for critical outsourcing.

4. SolarWinds – Orion Software – Supply Chain Hack – 2020 – SEC Action Against SolarWinds & Banks Who Outsourced

• Banks outsourced monitoring to SolarWinds. SolarWinds hacked via 4th party.
• SEC 2023 sued SolarWinds for failing to disclose 4th party risk. Banks using SolarWinds (e.g., BBVA, Santander) received ECB Dear CEO letter – must have exit strategy for 4th party.

B. INDIA – RBI ENFORCEMENT

5. HDFC Bank – IT Outage – 2 Dec 2020 – RBI Ban on New Credit Cards & Digital Launches – Exit Failure

• Facts: HDFC Bank's primary data centre (outsourced to third-party) failed, secondary also failed, netbanking down 2 days. Repeated outages 2018-2020.
• RBI Order 3 Dec 2020:
• RBI found – No alternate data centre exit strategy, concentration risk on single vendor, no tested DR.
• Penalty: RBI barred HDFC from issuing new credit cards and launching new digital products for 9 months – first time RBI used business restriction for outsourcing failure.
• Later audit – HDFC forced to migrate to new data centre provider with exit clause.

6. SBI – Outsourcing of ATM Managed Services to Hitachi – Cash Shortage – RBI Penalty 2022

• SBI outsourced 30,000 ATMs to Hitachi Payment Services. Hitachi sub-contracted to 10 vendors. No mapping.
• Hitachi failed to replenish during COVID lockdown, no exit to other vendor.
• RBI penalized SBI Rs 1 Cr under Sec 47A – Failure to ensure continuity and exit for critical outsourcing (cash management is critical per RBI 2023 guidelines).

7. ICICI Bank – Outsourcing of KYC to 3rd Party – 2022 – RBI Fine Rs 30 Lakh

• KYC outsourced, vendor used unregulated sub-contractor for video KYC outside India – data leak.
• RBI held – No audit right, no data localisation exit strategy, no 4th party mapping. Breach of 2023 Master Direction predecessor guidelines.

C. CONTRACT LAW – ENFORCING EXIT RIGHTS

8. Deutsche Bank v EDS (Electronic Data Systems) – UK High Court – 2007 – Critical Outsourcing Exit

• Deutsche outsourced global IT to EDS. EDS failed SLA.
• Held: Bank invoked exit for cause. EDS claimed exit fee Rs 50m. Court: Exit for cause – no fee payable if provider material breach. Provider must provide transition assistance for 12 months at cost, per contract. Established that transition assistance is enforceable even after termination.

9. BSkyB v EDS – UK High Court – 2010 – £200m Damages – Failed Outsourcing

• EDS failed to deliver CRM system. BSkyB exited and insourced.
• Held: EDS liable for £200m wasted costs + cost of exit + cost of alternative provider. Court allowed recovery of exit strategy costs as direct loss. Key for drafting – include right to recover alternative provider costs.

10. Wipro Ltd v OBC (Oriental Bank of Commerce) – Delhi High Court – 2019 – Core Banking Outsourcing

• OBC outsourced CBS to Wipro, tried to exit for convenience.
• Wipro invoked lock-in and demanded 3 years fees as exit fee.
• Delhi HC Interim: RBI Master Direction overrides contract – exit for critical outsourcing cannot have penal exit fee. Allowed OBC to exit with 6 months notice, no penalty, Wipro to provide data portability.

11. Sneaker – Cloud Act – US CLOUD Act vs GDPR – Microsoft Ireland Case – 2018 – Data Exit Conflict

• US bank outsourced to Microsoft Ireland cloud, US DOJ demanded data, Microsoft refused citing GDPR. Bank could not exit data from Ireland.
• Supreme Court (US) – CLOUD Act 2018 settled: Now bank must have exit strategy that considers conflicting laws – data must be returnable despite GDPR.

IV. Drafting Exit Clause – Sample RBI-Compliant

Clause 14 – Exit Management
14.1 Exit for Convenience: Customer may terminate critical outsourcing for convenience with 6 months written notice without penalty or early termination fee, per RBI Master Direction 2023 Para 14.2.
14.2 Exit for Cause: Immediate termination if Provider – (a) breaches SLA for 3 consecutive months, (b) undergoes insolvency, (c) loses certification, (d) fails audit.
14.3 Transition Assistance: Provider shall for 12 months after termination continue services at same rates, provide knowledge transfer, return all Customer Data in JSON/CSV via SFTP within 30 days, and provide certificate of deletion from all systems including sub-contractors per Sec 22 RBI MD.
14.4 Sub-contractors: List in Schedule 4 – Provider shall not add sub-contractor without 30 days approval – Customer may exit if sub-contractor fails.
14.5 Escrow: Source code / scripts in escrow with Iron Mountain – released on exit for cause.
14.6 Costs: No data extraction fee – included in TCO. Alternative provider costs recoverable if exit for cause.
14.7 Testing: Joint exit test annually – tabletop + data portability test.

V. Board Checklist – Before Signing Critical Outsourcing

1. Is it critical? Use EBA criteria – if yes, need exit strategy document approved by Board.
2. Have we identified alternative provider / in-house capability with cost analysis?
3. Does contract give us 6 months exit for convenience, no penalty, and immediate exit for cause?
4. Does contract give audit right over provider and sub-contractors?
5. Is data portable within 30 days in interoperable format + deletion certificate?
6. Have we tested exit in last 12 months?
7. Have we notified RBI per 2023 MD – Form of outsourcing register includes exit plan summary?

Failure = Personal liability – See TSB and HDFC cases.