Plan the exit before you sign. The 2023 interagency guidance asks banks to consider alternate providers, the time and capacity to transition or bring work in-house, termination costs, data return or destruction, lingering system access, shared intellectual property and customer impact.
This is general information, not legal advice. For EU rules see the DORA exit strategy post.
The considerations in the guidance
| Consideration | Question to answer |
|---|---|
| Transition options | Are alternate third parties available? |
| Capacity and timing | What resources and time would a move or in-house build take? |
| Costs | What fees and costs come with termination? |
| Data and access | How is data retained or destroyed, and which connections and access controls need watching after exit? |
| Intellectual property | Who owns anything jointly built? |
| Customer impact | What happens to customers if the vendor fails? |
Contract provisions the guidance mentions include timely return or destruction of the bank's data, cost allocation for transition, and continuity procedures with recovery time and recovery point objectives.
A checklist for the buyer
- Record what the software does and which other systems depend on it.
- Identify at least one realistic alternative, even if you never use it.
- Estimate migration time honestly, including data conversion and testing.
- Confirm you can export your data in a usable format, and test an export now.
- List every credential, API key and network path that must be revoked at exit.
- Agree who pays for transition help.
- Rehearse the failure case, not just the planned exit.
A checklist for the vendor
Be the vendor who makes exit easy to describe. Offer documented export formats, a defined data deletion process with confirmation, and a clear list of what happens to backups. A confident exit story often helps a deal move faster because it removes a blocker.
Keep a current inventory of your own components and subcontractors too. If you rely on a fourth party that fails, your customer will ask for your plan.
Where Safeguard fits
Safeguard's SBOM and dependency scanning and asset discovery help document what a system contains and connects to, which supports transition planning. A free scan is at gold.safeguard.sh/scan.
Quick check
When should exit planning start?
At selection and contracting. The guidance treats termination as one stage of a continuous lifecycle, with contract terms that support it.
Is a tested data export really necessary?
It is the cheapest way to learn whether the exit promise is real. Test it while the relationship is healthy.
Sources
Last reviewed: 19 October 2026.
