Exit Strategy

An exit strategy in outsourcing is a documented plan for the orderly termination of a vendor relationship. It covers termination scenarios, transition timelines, data migration, knowledge transfer and the repatriation of services (re-insourcing) or switch to an alternative provider. Under DORA Article 28(8) and MaRisk AT 9, it is mandatory for every critical outsourcing arrangement at banks and financial institutions.

DORA Article 28(8) requires financial entities to develop comprehensive exit plans for critical ICT third-party service providers. These must include realistic transition periods, data transfer and deletion procedures, alternative sourcing options and test scenarios. Exit plans must be regularly updated and tested under realistic conditions, with documented evidence of testing.

A complete vendor exit plan includes: 1) Termination scenarios (ordinary, extraordinary, insolvency), 2) Transition timeline with milestones, 3) Data migration and deletion procedures, 4) Knowledge transfer framework, 5) Alternative sourcing or re-insourcing plan, 6) Resource and cost planning, 7) Stakeholder communication plan, 8) Test protocol for exit drills. Regulators expect the plan to be tested under realistic conditions.

Cloud exit strategies additionally require: data portability assessment, vendor lock-in analysis, migration testing between cloud providers, data locality verification and deletion confirmations. Traditional outsourcing exits focus on staff repatriation, asset handover and knowledge transfer. DORA tightens requirements for ICT cloud services with mandatory testing and documented scenarios.

Regulators expect exit strategies to be tested at least annually for critical outsourcing arrangements. Under DORA, exit plans for critical ICT providers must be tested under realistic conditions with documented results. Testing should include tabletop exercises, partial transition drills and full migration simulations depending on the criticality and complexity of the outsourced service.

Most financial institutions plan

90 to

180 days for critical outsourcing exits, depending on complexity. DORA Article

28 requires adequate transition periods based on data volume and service criticality. The timeline must cover parallel operations, data migration, knowledge transfer and validation testing before the old provider relationship ends.

ADVISORI advises banks and financial institutions on developing DORA and MaRisk-compliant exit strategies: from risk analysis through contract design with exit clauses to transition planning and exit drills. Our consultants bring experience from regulatory audits and ICT migrations and create practical exit plans that meet BaFin requirements and work in real-world scenarios.