- The exposure: what the 2023 interagency guidance says about contingency plans, impaired third parties, escrow and changing providers, quoted from the Federal Register.
- The shift: from the vendor's own description of its continuity plan to proof the software runs without the vendor.
- The model and the proof: an evidence map from each stage of the guidance's life cycle to the documents that support it.
- The next step: book a demo, or get the sample evidence pack.
The vendor software your bank runs on. Proof it comes back.
US banking agencies expect a plan for when a critical third party can't perform, and their 2023 guidance names escrow for purchased software as a contract provision to consider. Codekeeper holds the code, rebuilds it without the vendor and gives you dated evidence for your third-party file.
Our guidance for critical activities: Escrow Pro or Resilience Pro, Continuity Pro where the service must stay on, plus an Exit Exercise. See the levels
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Evidence mapped to the 2023 interagency guidance
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- Production errors fixed. Production's timeline says the June 2023 guidance means "Institutions must establish clear oversight of escrow arrangements, including annual validation, updates, and recovery provisions". The guidance says it is "important to consider" escrow for purchased software; we found no annual validation requirement. Production dates it 7 June 2023 and credits it to the FFIEC; it was final as of 6 June 2023 and issued by three agencies.
- The FFIEC Business Continuity Management booklet isn't quoted. ithandbook.ffiec.gov blocks our fetch tool, so we couldn't read the booklet itself. The callout describes it from the FDIC's FIL-71-2019 (14 Nov 2019) and the Federal Reserve's SR 19-13, which list its topics. Legal or the web team should read the booklet before adding any quote from it.
- The CAT date comes from the Federal Reserve's SR 24-7, which carries the FFIEC sunset statement: the tool "will be removed from the FFIEC website on August 31, 2025". The card says that was the date set, not that it happened.
- Legal should review the quotes and the disclaimer before launch.
What US supervisors ask
Plan the exit before you need it.
The Interagency Guidance on Third-Party Relationships covers each stage of a vendor relationship, from planning to termination. Four passages bear directly on software you don't control.
“Outlining the banking organization's contingency plans in the event the banking organization needs to transition the activity to another third party or bring it in-house.”
“It is important to assess options to employ if the third party's ability to perform the activity is impaired…”
“When the banking organization purchases software, it is important to consider a provision to establish escrow agreements to provide for the banking organization's access to source code and programs under certain conditions (for example, insolvency of the third party).”
“Contracts can protect the ability of the banking organization to change third parties when appropriate without undue restrictions, limitations, or cost.”
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your examiner to decide.
Where vendor software fits
Your recovery plan covers your systems. Does it cover your vendor's?
A third-party file usually holds the contract, a risk rating and the vendor's own description of its continuity plan. Each says what should happen. None shows the software running without the vendor.
A third-party file today
- The vendor's continuity plan, as the vendor describes it
- A termination clause and a transition period
- A contingency plan that assumes the code would be usable
- No record of what the software depends on
With Codekeeper
- Source code and build materials held by a neutral party, synced daily
- Release terms agreed in an Escrow Agreement before anything goes wrong
- A rebuild with no help from the vendor, and a dated Recoverability Certificate
- An SBOM and an Exit workbook for the transition
Name the critical activities
Add the vendor applications behind them, on-premise or SaaS.
Attach the protection
Escrow Pro, Resilience Pro or Continuity Pro. The deposit syncs daily from the vendor's repositories.
Rebuild and file
Run up to four rebuilds a year. Each successful run issues a dated Recoverability Certificate.
Exercise the exit
Add an Exit Exercise to test the business functions you nominate, without the original developers.
- Production's evidence-pack claims are gone: "The recovery review closes on the first pass", "the finding never opens", "pass every exam, every time", "A Software Resilience Certificate … stating recovery was confirmed" (Certified tier, retired) and "Set up in a day … 24 hrs to go live" (not in the confirmed facts). The production pack page also had live template text ("Explain in one or two concise sentences how your solution transforms users' challenges…") and a mock labelled "Article 28 mapping", a DORA article, on an FFIEC page.
- NIST CSF 2.0 mapping is left out. Production mapped its pack to the CSF 2.0 Recover function. The FFIEC's CAT sunset statement names CSF 2.0 as one resource; it isn't an examination requirement we could verify, so we don't map to it.
- Confirm before launch: whether the live environment map is a document customers receive (open item, as on the DORA page).
- 16 Oct: Continuity Pro added. Rebuild evidence, the deployable copy and change flags now name Continuity Pro or the Pro levels, since base Continuity no longer includes Agentic Verification; the live environment map comes with both Continuity levels.
Evidence map
What each document adds to your third-party file.
Every document is dated and tied to one application, so the file shows what was tested, how and when.
| Interagency guidance and FFIEC handbook | Codekeeper evidence |
|---|---|
| IV.C.1 Planning Contingency plans for a transition | The recovery process step by step, and the components the application needs to run somewhere else. Exit workbookBuild stepsSBOMEscrow Pro · Resilience Pro · Continuity Pro |
| IV.C.2.i Operational resilience If the third party can't perform | Proof the application rebuilds from its deposit in the Codekeeper AI Verification Lab, with no help from the vendor, in hours. Recoverability CertificateRun reportDeployable copyEscrow Pro · Resilience Pro · Continuity Pro |
| IV.C.3.g Ownership and license Escrow for purchased software | The deposit held by a neutral party and released to you when a condition in the agreement is met, with an automated check of what's deposited. Escrow AgreementSoftware Resilience CertificateVault reportEscrow · Escrow Pro |
| IV.C.3.i Operational resilience and business continuity Testing plans together | A clean-room rebuild by our specialists, tested against the business functions you nominate. Either party to the agreement can request one. Tested Exit ReportFramework annexExit Exercise, an add-on to any plan |
| IV.C.3.p Default and termination Changing third parties | A deployable copy, held by the depositor, that you gain access to on a release event. With Resilience, we run the recovery for you. Deployable copyResilience ArrangementEscrow Pro · Resilience · Resilience Pro · Continuity · Continuity Pro |
| IV.C.4 Ongoing monitoring Keeping evidence current | Deposits sync daily through integrations. Between rebuilds, we compare the deposit with the live repositories and flag what changed, so you know when to rebuild. Vault reportRun reportEvery protection · change flags with the Pro levels |
| BCM booklet Exercises, tests and board reporting | Four rebuilds a year, run when you choose, each with a dated certificate. Add an Exit Exercise when the plan needs exercising, not just a rebuild. Dated Recoverability CertificatesTested Exit ReportEscrow Pro · Resilience Pro · Continuity Pro · Exit Exercise as an add-on |
| A service that must stay on While the recovery runs | We map where the application runs at setup and keep the map current. If the vendor stops, we keep the live environment paid and switched on for an agreed period while we recover. Live environment mapContinuity · Continuity Pro |
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your examiner to decide.
- Confirm before launch: the unit for the Exit Exercise "from $12,000", and whether "12 rebuilds a year, $299 a month more" is per application. Both are open items in to-confirm.md.
- Production's four cards (Software Escrow, SaaS Escrow, Continuity Escrow, Verification) promised "Guarantees access to mission-critical systems" and "Confirms recovery time objectives (RTOs)". Neither is a confirmed fact.
- 16 Oct: Continuity Pro added. The third card is now Continuity Pro (from $1,699, Danny 11 Oct), because the guidance is the tested-in-advance levels and base Continuity no longer includes Agentic Verification; base Continuity (from $1,449) is named in the note, and the price logic gains its closing sentence. Continuity Pro's level line "Full continuity, proven in advance." was confirmed by Danny on 16 Oct.
Our guidance
Which protection fits a critical activity.
Choose by who runs the recovery and whether the service has to stay on. Add the Exit Exercise when your contingency plan needs exercising, not just a rebuild.
Escrow Pro
From$449per application per month
Everything you need to recover.
- The deposit released to you under the Escrow Agreement
- Agentic Verification: 4 rebuilds a year, on supported technology stacks
- Recoverability Certificate, run report, SBOM and Exit workbook
- A deployable copy
Resilience Pro
From$649per application per month
Proven before we need it.
- The deposit comes to Codekeeper and we run the recovery
- Agentic Verification: 4 rebuilds a year, on supported technology stacks
- Recoverability Certificate, run report, SBOM and Exit workbook
- A deployable copy
Continuity Pro
From$1,699per application per month
Full continuity, proven in advance.
- Everything in Resilience Pro
- The live environment mapped at setup and kept current
- Kept paid and switched on for an agreed period while we recover
- Bills recharged at cost
Exit Exercise
From $12,000Our specialists rebuild by hand in a clean room, from the deposit alone, and test the business functions you nominate. You get a Tested Exit Report with an annex mapped to your framework. Explore the Exit Exercise
12 rebuilds a year
$299 a month moreTwelve rebuilds a year instead of the four included in the Pro levels, for applications that change often.
This is our guidance, not a compliance promise: your risk assessment decides. Prices shown are for software applications; SaaS and AI applications have their own rows. Continuity, the same environment care without Agentic Verification, is from $1,449. Setup is $499 per arrangement for Escrow and Resilience, and $999 for Continuity and Continuity Pro. Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on. At every protection, Pro adds Agentic Verification. See full pricing
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
- What the FFIEC is: ffiec.gov/about/mission ("Congress established the Federal Financial Institutions Examination Council in March 1979"; members listed there). Fact-check, 7 Oct: the answer used to list five members as the whole Council; the mission page names five federal member agencies and says the chair of the State Liaison Committee "serves as the sixth member", so the answer now says both.
- Does it require escrow: the guidance's own words, quoted. Production's FAQ said "escrow helps meet FFIEC expectations" and "we … have helped thousands of institutions stay compliant"; both are gone.
- Scope: footnote 1 of section IV.A says the guidance "is relevant to all banking organizations supervised by the agencies" (88 FR 37927). Production said "US banks, credit unions, savings associations, and fintech providers serving them must adhere to FFIEC standards"; that overstates it.
- Testing frequency: production's evidence pack said "FFIEC guidance expects recovery to be tested at least annually". We couldn't find that in the guidance; the answer quotes what it does say about joint testing (section IV.C.3.i, 88 FR 37933).
- The CAT: Federal Reserve SR 24-7, the FFIEC sunset statement. It names NIST CSF 2.0 and CISA's Cybersecurity Performance Goals; it doesn't mention the IT Examination Handbook, which production's pack page implied.
- 16 Oct: Continuity Pro added; the testing answer now credits the four rebuilds to the Pro levels, since base Continuity no longer includes Agentic Verification.
Questions
Before your next examination.
What is the FFIEC?
The Federal Financial Institutions Examination Council, an interagency body Congress established in March 1979. Its five federal member agencies are the Federal Reserve Board, the FDIC, the NCUA, the OCC and the CFPB, and the chair of its State Liaison Committee also sits on the Council. It publishes the IT Examination Handbook, including the Business Continuity Management booklet examiners use.
Does the FFIEC require software escrow?
The 2023 interagency guidance doesn't make escrow mandatory. It says that when a bank purchases software, “it is important to consider a provision to establish escrow agreements to provide for the banking organization's access to source code and programs under certain conditions (for example, insolvency of the third party).” Whether escrow fits a given relationship is for your risk assessment.
Who does the 2023 guidance apply to?
It was issued by the Federal Reserve, the FDIC and the OCC, and says it “is relevant to all banking organizations supervised by the agencies.” Federal credit unions are supervised by the NCUA, which wasn't one of the issuing agencies.
How often should we test recovery?
The guidance leaves much of this to the contract: it says contracts may stipulate “whether and how often the banking organization and the third party will jointly test business continuity plans.” Your risk assessment sets the frequency. The Pro levels include four rebuilds a year, run when you choose, and either party to the agreement can request an Exit Exercise.
Will this make us pass an examination?
No product can promise that. Codekeeper gives you evidence for your third-party file: certificates, run reports, SBOMs, Exit workbooks and, with an Exit Exercise, a Tested Exit Report. Whether it meets a specific requirement is for you and your examiner to decide.
Our critical vendor is a SaaS provider. Does this still work?
Yes. SaaS applications have their own price row. We hold the code, infrastructure, data exports and the access needed to bring the service back, and rebuilds run on supported technology stacks. If the service has to stay on while we recover, that's Continuity.
We sell software to US banks. How does this help us?
Your customers have to plan for the day you can't perform. With Escrow Pro you can give them release terms, a Software Resilience Certificate and a Recoverability Certificate showing your application rebuilds without your team, before their due diligence asks.
What happened to the Cybersecurity Assessment Tool?
The FFIEC said it would remove the CAT from its website on 31 August 2025. Its sunset statement named the NIST Cybersecurity Framework 2.0 and CISA's Cybersecurity Performance Goals among the government resources available instead.
What happened to the FFIEC evidence pack?
It's part of this page now. The sample evidence pack shows the documents an Agentic Verification run produces, and an Exit Exercise adds a Tested Exit Report with an annex mapped to your framework.
Want the background first? Our FFIEC guide is in Resources.
Show your examiner it comes back.
We'll take the vendor applications behind your critical activities and show you the evidence each protection puts in your file.