Every material outsourcing contract has a termination clause. Few institutions could use theirs next month.
The clause gives the right to leave. It does not give the data back in a usable form, a second provider ready to run the service, staff who know how, or a budget for the transition. Those are what decide whether a critical service survives the end of a relationship. Most third-party files never test them.
The right to leave is not the ability to leave
This guide’s position: for every provider of a critical service, the exit is tested at least once a year, and the test covers the unplanned exit as well as the orderly one. An exit plan that has only been written is a clause, not a plan.
The unplanned case matters most because it is the one nobody rehearses. Contracts are drafted for the planned exit: notice, handover, migration. The exits that hurt come without notice: the provider is breached, fails, loses its licence or simply stops. That leaves no notice period and no cooperative handover, and the data may sit on a platform you cannot reach.
| Planned exit | Unplanned exit | |
|---|---|---|
| Trigger | Contract expiry, breach, strategic decision to move or bring in-house | Provider insolvency, cyber incident, regulatory action, abrupt withdrawal |
| What you can count on | Notice period, provider cooperation, time to migrate | Nothing from the provider |
| What the test must prove | Data, systems and knowledge transfer within the notice period; secure return or destruction of data | Critical service restored from your own fallback within your recovery time; last good copy of the data in your hands |
| Common gap | Migration timeline longer than the notice period | No fallback at all for services that have no substitute |
Where Kenyan rules stand
The rules in force set the principle. The September 2026 drafts make testing explicit.
| Source | Status | What it requires |
|---|---|---|
| CBK Risk Management Guidelines (January 2013), 6.3.1 | In force, Banking Act institutions | Outsourcing policies cover termination rights, ownership of data and “development of viable contingency plans” |
| National Payment System Regulations 2014, reg 23 | In force, payment service providers | Notify CBK at least 30 days before outsourcing; a material function cannot be outsourced so as to impair internal control or CBK’s ability to supervise; senior management keeps responsibility |
| Draft Prudential Guideline on Third-Party Service Providers, CBK/PG/16, 4.5.2.5(d) and 4.5.3(g) | Draft, issued 10 Sep 2026 for comment | Board strategy sets the conditions that trigger an exit; senior management keeps contingency plans, including alternative providers, built on realistic disruption scenarios, “in place and tested” |
| Draft Guidance Note on Third-Party Technology Service Providers (August 2026), 4.4.7 | Draft, issued 10 Sep 2026 for comment; Banking Act and Microfinance Act institutions | Exit plans with timelines, owners and resources; tested at least once a year for every critical technology provider; internal fallback options for critical services without substitutes; CBK may direct termination or replacement |
The drafts may change before they are final. The direction will not: CBK expects an institution to show the exit works, not that the contract allows it. Forex bureaus, money remittance providers and other licensees outside these texts face the same dependency, and the drafts are the sensible benchmark for them.
Six questions that decide whether you can leave
- Data. Can you produce a complete, current copy of your data in a format you can load elsewhere? When did you last restore it, not just export it?
- Capacity. Who would run the service tomorrow: another provider, an in-house team, a manual workaround? Has anyone confirmed they can?
- Time. How long does the migration take, end to end? Is that shorter than the notice period and, for the unplanned case, than the service’s maximum tolerable downtime?
- Continuity. Which customer-facing services stop during the transition, and for how long?
- Obligations. Which regulatory duties depend on the provider: returns, STR filing, screening, record retention? Who performs them during the gap?
- Cost. What does leaving cost, including parallel running, data extraction fees and early-termination charges? Is it budgeted, or will it decide the exit for you?
An exit plan that cannot answer all six for a critical service is incomplete, however good the contract is.
A test that tells you something
An illustrative example, not a real case. A microfinance bank runs core banking on a vendor-hosted platform outside Kenya. The contract allows exit on 90 days’ notice, and the exit plan is two pages.
The bank runs a half-day tabletop on one scenario: the vendor goes offline without warning. Within the first hour, three facts surface. The last full data export was never restored anywhere. The export format is proprietary, and no alternative vendor has been asked whether it can read it. The only fallback for loan repayments is manual receipting, and branches have no current procedure for it.
None of this appeared in the due diligence file, which was complete. The test produced three dated actions: a quarterly restore test into a sandbox, a data-format confirmation from two alternative vendors, and a written manual-receipting procedure with a drill.
Run yours the same way:
- Pick one critical provider and one scenario: abrupt failure is the hardest and the most useful.
- Put the business owner, IT, risk, compliance and finance in the room. The provider is not invited.
- Walk the first hour, the first day and the first week. At each point, ask what the institution can do with what it holds today.
- Record every assumption the plan makes and whether anyone has evidence for it.
- Close with dated actions, an owner each, and the next test date. Report the result to the board risk committee.
Lessons from outsourcing reviews
Writing an exit strategy into an outsourcing contract has been the easy part; showing that it works has been much harder. In third-party and outsourcing reviews, I have met the practical problems that follow once critical operations depend on a provider’s systems, specialist skills, subcontractors or control of essential data. Due diligence, service levels and termination clauses are necessary, but they have not always answered the question that matters: what does the institution do if the provider cannot or will not continue? The hard questions are data recovery, alternative capacity, transition time, service continuity, regulatory obligations and the cost of leaving. An exit plan becomes credible when those dependencies have been examined, a realistic alternative identified and the key assumptions tested. Exit readiness is not the right to leave. It is the demonstrated ability to keep critical services running, recover the data and take back control when that right has to be used.
Exit readiness is a capability
Registers, due diligence questionnaires and contract reviews remain necessary. They show a provider was chosen carefully. They do not show the institution can survive without it. Only a tested exit does that, and the first test usually shows the plan was thinner than anyone thought.
Riskill’s Third-Party & Technology Risk Assessment Pack includes a risk assessment template, a control evidence matrix, an approval checklist, the regulatory considerations for Kenyan licensees and an action tracker: riskilled.com/toolkits. To have a critical provider’s exit plan tested independently, talk to the advisory desk: riskilled.com/engage.