Paragraph 12(f) and the Unasked Question
RBI’s IT Governance Master Direction and source code escrow for critical applications
Paragraph 12(f) of the Reserve Bank of India’s Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, effective 1 April 2024) requires regulated entities to obtain source code for all critical applications. Where that is not possible, they must put in place source code escrow or other arrangements to “adequately mitigate the risk of default by the vendor”.
Who does paragraph 12(f) apply to?
The direction applies to the regulated entities it lists, including scheduled commercial banks and specified categories of NBFCs. Each entity should confirm its own applicability against the text of the direction. Within a covered entity, the obligation attaches to every application the entity classifies as critical, whoever supplies or hosts it.
What does “adequately mitigate” require in practice?
Adequate mitigation is best understood as an arrangement the entity could actually use on vendor default, not one that merely exists on paper. An examiner is likely to test four things:
Evidence an examiner may request | What satisfies it |
Inventory of critical applications | A board-approved list with the criticality rationale |
Source code or escrow for each | Code held in-house, or an executed tripartite agreement and deposit record |
Currency | Deposit dates aligned with production versions |
Usability | An independent verification report |
An entity holding an unverified deposit that cannot be built will find adequacy difficult to demonstrate.
How does the IT outsourcing direction interact with paragraph 12(f)?
The separate Master Direction on Outsourcing of Information Technology Services (10 April 2023, effective 1 October 2023) requires exit strategies and business continuity arrangements for outsourced IT. It does not itself mention escrow. An exit plan for a critical application is, however, difficult to execute without source code access, so the two directions are most efficiently addressed together.
Quick answers
Is escrow mandatory under paragraph 12(f)? No. Obtaining source code is the primary route; escrow or an equivalent arrangement applies where obtaining it is not possible.
Are SaaS applications covered? The text refers to all critical applications. Classification should follow criticality, not the delivery model.
Risk and compliance teams can request a regulatory alignment briefing from info@escrownxt.com.
EscrowNXT, India’s pure-play software escrow provider, supports banks, NBFCs and their technology licensors with verified escrow arrangements. Further information is available at www.escrownxt.com. This article is for general information only and is not legal advice.
