--- title: Software Escrow for PRA SS2/21 Readiness | Codekeeper description: Demonstrate operational self-sufficiency and meet PRA SS2/21 requirements with software escrow solutions that prove you can rebuild critical systems when third-party vendors fail. canonical_url: https://codekeeper.co/en-gb/solutions/pra-ss221 --- PRA SS2/21 # Secure PRA SS2/21 compliance with software resilience Satisfy PRA expectations for outsourcing risk management with Codekeeper's comprehensive software escrow solutions designed for UK financial services. [Book a free demo](https://codekeeper.co/book-a-demo) ![ss2_21_hero_2x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/ss2_21_hero_2x-1168x935.webp) ## When your critical software vendors fail under SS2/21, you face immediate operational shutdown and potential PRA enforcement actions that can restrict your business activities until you prove viable continuity capabilities. ## PRA SS2/21: What you need to know ### What is PRA SS2/21? Prudential Regulation Authority (PRA) Supervisory Statement 2/21 (SS2/21) is the regulatory framework that sets out expectations for how UK financial firms should manage outsourcing and third-party arrangements. ### Who needs to comply with PRA SS2/21? SS2/21 affects all PRA-regulated entities across the UK financial services sector, including: ![landmark](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Base%20Primary/landmark.svg) Banks and building societies ![trending-up](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Muted%20Foreground/trending-up.svg) Investment firms designated by the PRA ![shield-check](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Muted%20Foreground/shield-check.svg) Insurance and reinsurance firms ![building-2](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Muted%20Foreground/building-2.svg) Groups in scope of Solvency II ![globe](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Muted%20Foreground/globe.svg) UK branches of foreign financial institutions ![users-round-1](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Muted%20Foreground/users-round-1.svg) Credit unions and non-directive firms ## Key PRA SS2/21 requirements SS2/21 requires financial firms to implement comprehensive third-party risk management across four critical areas: 1 **Governance and oversight** — Establish board-approved policies with clear senior management accountability for all outsourcing decisions. 2 **Risk assessment and due diligence** — Identify which relationships are critical to operations and research potential providers thoroughly before signing contracts. 3 **Contractual protection** — Create detailed written agreements covering data security, performance standards, and audit rights. 4 **Business continuity planning** — Build and test practical backup plans for maintaining services when critical providers fail. ### The software escrow — SS2/21 connection Software escrow directly addresses SS2/21's core requirement by ensuring firms can sustain essential services when third-party software providers become unavailable or fail to deliver contractual obligations. 01 SS2/21 risk Vendors become insolvent without transition support Firms cannot access source code for system rebuilds Exit strategies remain theoretical until tested PRA finds inadequate evidence of self-sufficiency 02 Software escrow solution Secure repository stores source code and documentation Legal framework guarantees access when providers fail Verification testing proves materials restore functionality Regular updates ensure current system alignment 03 Compliance outcome Demonstrable capability to continue without providers Documented exit strategies satisfy PRA expectations Evidence of due diligence in risk management Reduced dependency on provider cooperation Software escrow provides the technical foundation that makes SS2/21's stressed exit requirements achievable when traditional planning reaches its limits. ## Let us help you with SS2/21 compliance Understanding SS2/21 requirements is one thing — implementing the actual technical capabilities to satisfy them is another challenge entirely. **We see what you're up against:** Extending risk management to SaaS and software purchases Proving you can restore systems independently Maintaining oversight across sub-outsourcing supply chains Satisfying PRA expectations for genuine exit capabilities _We've secured critical software assets for thousands of financial institutions globally. We can protect your operational resilience, too._ ![we_see_challenges_you_face](https://codekeeper.co/hubfs/Codekeeper%202025/we_see_challenges_you_face.webp) ## Codekeeper's complete solutions for SS2/21 requirements Our software escrow services help you meet SS2/21's requirements by ensuring you can recover critical systems when third-party vendors fail. Software Escrow ### Protection scope: On-premises software Stores your software source code and technical documentation safely so you can rebuild systems independently when vendors can't help. Enables stressed exit strategies that work without vendor cooperation Shows PRA you have genuine alternatives to vendor dependency Creates documented evidence of operational self-sufficiency for regulatory review [Learn more](https://codekeeper.co/software-escrow) ![how_it_works_software_escrow_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/how_it_works_software_escrow_3x-1344x1077.webp) SAAS escrow ### Protection scope: Cloud-based applications Captures everything needed to migrate cloud services, including configurations and deployment guides, when SaaS providers fail. Covers cloud arrangements that SS2/21 now includes in scope Provides working exit strategies for material SaaS dependencies Shows due diligence in managing third-party risks for PRA oversight [Learn more](https://codekeeper.co/saas-escrow) ![how_it_works_saas_escrow_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/how_it_works_saas_escrow_3x-1344x1076.webp) Continuity escrow ### Protection scope: Supporting services and infrastructure Takes over payments for critical supporting services to maintain operations when main vendor relationships are disrupted. Prevents sub-outsourcing failures that could disrupt your operations Gives you time to execute exit plans without immediate service loss Supports board governance and accountability for third-party arrangements [Learn more](https://codekeeper.co/continuity-escrow) ![continuity_escrow_1x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/continuity_escrow_1x-672x538.webp) Verification ### Protection scope: All escrowed materials Tests all stored materials to prove they actually work for recovering systems, providing the evidence SS2/21 compliance requires. Confirms your exit strategies function in practice, not just theory Establishes realistic timelines for system reconstruction during emergencies Provides Software Resilience Certificates for PRA audit evidence [Learn more](https://codekeeper.co/verification) ![how_it_works_continuity_escrow_3x-1](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/how_it_works_continuity_escrow_3x-1-1344x1076.webp) ## Prepare for SS2/21 compliance in 4 simple steps SS2/21 requires you to prove you can restore critical systems when vendors fail. Here’s how we help you establish that capability: 1 ### Book your SS2/21 assessment call We assess your current third-party dependencies and identify which arrangements need documented exit strategies under the regulation. 2 ### Pick your software protection level Choose Software Escrow for on-premises systems, SaaS Escrow for cloud applications, or Continuity Escrow for supporting services. 3 ### We'll handle everything else — from setup to implementation Our experts manage vendor negotiations, legal agreements, and technical deposits without disrupting your operations. 4 ### Get your Software Resilience Certificate Receive formal evidence of your operational resilience capabilities, ready for PRA review and ongoing supervision. _One call. One solution. Complete software continuity for SS2/21._ [Book a free demo](https://codekeeper.co/book-a-demo) ## Codekeeper takes the complexity out of compliance Over the years, we've helped thousands of financial institutions protect their critical software while keeping the process simple. Our solutions make regulatory requirements straightforward and manageable. ![Airbus](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/Logo%20section%205/cta-sec-5-airbus.svg) ![Bayer](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/Logo%20section%205/cta-sec-5-bayer.svg) ![European parliament](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/Logo%20section%205/cta-sec-5-eu.svg) ![General Motors](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/Logo%20section%205/cta-sec-5-gm.svg) ![Intuit](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/Logo%20section%205/cta-sec-5-intuit.svg) ![Nestle](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/Logo%20section%205/cta-sec-5-nestle.svg) ![Pepsico](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/Logo%20section%205/cta-sec-5-pepsico.svg) ![Pfizer](https://codekeeper.co/hubfs/Codekeeper%202025/Logo/Logo%20section%205/cta-sec-5-pfizer.svg) ## SS2/21 compliance timeline * ![clipboard-check](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Muted%20Foreground/clipboard-check.svg) ### March 31, 2022 SS2/21 became effective for all PRA-regulated entities Legacy agreements should be updated at next renewal or revision * ![FileBadge2-1](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Base%20secondary/FileBadge2-1.svg) ### Ongoing from 2022 Continuous compliance with third-party risk management expectations Regular assessment of materiality and exit strategy effectiveness ## When SS2/21 expectations aren't met Poor preparation for SS2/21 creates a domino effect where regulatory problems compound operational vulnerabilities. Formal PRA intervention The PRA may issue directions, add new requirements, or restrict business activity if firms lack workable exit strategies. Operational dependency Without viable exit plans, vendor failures can stop critical services and leave firms unable to meet regulatory obligations. Authorization concerns Failure to prove self-sufficiency can jeopardize regulatory permissions and raise doubts about your firm’s ability to operate. Enhanced regulatory scrutiny Weak third-party risk management invites closer PRA supervision, extra monitoring, and more reporting. Senior management accountability Under SM&CR, senior managers remain personally responsible for ensuring outsourcing governance and vendor risk controls. Software vendor dependency is now a regulatory risk. Fortify your recovery capabilities before they become your crisis. ## How you benefit from SS2/21 readiness ### Avoid regulatory enforcement Meet PRA expectations for third-party risk management to prevent formal directions, additional requirements, or business restrictions that could limit your operations and growth. ### Protect operational continuity Ensure important business services continue during vendor disruptions through proven exit strategies that work when traditional contingency plans fail. ### Reinforce stakeholder confidence Demonstrate to customers, partners, and shareholders that your institution can maintain services independently of third-party providers during market stress. ### Strengthen board governance Provide your board and senior management with documented evidence of adequate third-party oversight that satisfies SM&CR accountability requirements. ![ss2_21_cta_2x](https://codekeeper.co/hubfs/Codekeeper%202025/ss2_21_cta_2x.webp) ### Build genuine exit capabilities before you need them Our advisors will show you exactly how our software resilience solutions meet SS2/21's third-party risk management expectations. Analysis of your current third-party dependencies Demo of how software escrow satisfies stressed exit requirements Practical implementation guidance without technical complexity Actionable steps you can take today [Book a free demo](https://codekeeper.co/book-a-demo) Frequently asked questions ## Good questions to ask first. What is the PRA SS2/21 regulation? SS2/21 is the Prudential Regulation Authority's framework requiring PRA-regulated firms to manage outsourcing and third-party arrangements. It mandates that firms demonstrate they can maintain operations when material service providers fail. What are the PRA fundamental rules? The PRA Fundamental Rules are 10 principles for regulated firms covering integrity, skill and diligence, prudent conduct, adequate financial resources, effective risk management, responsible organization, regulatory cooperation, resolution preparedness, operational resilience, and financial system risk management. When did SS2/21 come into effect? SS2/21 became effective March 31, 2022. New arrangements from March 31, 2021, onward must comply, while legacy agreements should be updated at the next contract renewal. What is a stressed exit plan? A stressed exit plan covers emergency scenarios where firms must exit outsourcing agreements due to vendor failure or insolvency. It ensures continued operations when vendors cannot cooperate, unlike planned commercial exits. Why is software escrow important for SS2/21 compliance? Software escrow enables firms to rebuild systems when vendors fail by securing source code and documentation. It transforms theoretical exit strategies into practical capabilities that satisfy SS2/21's operational resilience requirements. Can Codekeeper help with SS2/21 readiness? Yes. Codekeeper provides software resilience solutions that secure critical software assets, enable stressed exit strategies, and create documentation demonstrating operational self-sufficiency for PRA compliance. [More answers in the FAQ →](https://codekeeper.co/faq) ## Let's build bulletproof software resilience together. [Book a demo](https://codekeeper.co/book-a-demo)