Exit strategy
Also called exit plan, exit planning
An exit strategy is a documented plan for leaving an outsourcing or third-party arrangement without disrupting services, breaching rules or harming customers. It sets out how a firm would move a service to another provider or back in-house, whether the exit is planned or forced by a provider failure.
How it works
Firms write exit plans for each critical or important outsourcing arrangement. A plan names the triggers for exit, such as provider insolvency, a serious breach or a change in law. It sets out alternative providers, data return and transition steps, with the time and cost needed. UK rules separate a planned exit from a stressed exit, where the provider fails suddenly and the firm must act fast.
Regulators treat exit planning as a test of real resilience. A firm that depends on one provider with no way out carries concentration risk it cannot control. Supervisors in the UK, EU and US expect exit plans to be tested and kept current. They also expect contract terms that cover termination, data access and transition support.
The rules
Requires exit strategies for ICT services supporting critical or important functions, covering provider failure, service deterioration and contract termination, with plans tested and reviewed periodically.
EU financial entities using ICT services for critical or important functionsExpects exit plans for material outsourcing covering both planned exits and stressed exits, with expectations applying from 31 March 2022.
PRA-regulated banks, building societies, insurers and designated investment firmsRequire documented and sufficiently tested exit strategies for outsourced critical or important functions, until the EBA's final 2026 third-party risk guidelines replace them.
Credit institutions, investment firms, payment and e-money institutionsExpects banks to plan for terminating third-party relationships, including moving activities to another provider or back in-house.
Banks supervised by the Federal Reserve, FDIC and OCCCommon questions
What is a stressed exit?
A stressed exit is an unplanned departure from an outsourcing arrangement, usually after the provider fails, becomes insolvent or suffers a severe disruption. The PRA expects firms to plan for this case as well as for a planned exit following a business decision.
Do rules require exit plans to be tested?
Yes. DORA requires exit plans for ICT services supporting critical or important functions to be documented, sufficiently tested and reviewed periodically. EBA guidelines and PRA SS2/21 also expect testing, scaled to the importance of the service.
What does an exit plan usually contain?
Typical content includes exit triggers, alternative providers and the return of data and assets. Plans also set roles, transition timelines and costs, and record dependencies such as subcontractors and the internal systems that rely on the service.
