Business Continuity Clauses for a Key IT or BPO Vendor Insolvency

Vikrant D. Shetty

Sep 15

13 min read

Updated: Sep 25

Business Continuity Clauses for a Key IT or BPO Vendor's Insolvency: What Corporate Contracts Should Require

The moratorium under section 14 of the Insolvency and Bankruptcy Code, 2016 protects a corporate debtor from suits and enforcement action; it does not compel an insolvent information technology or business process outsourcing vendor to keep performing services, because section 14(2) runs towards supplies received by the corporate debtor, not away from it. A customer with no continuity built in is left with a damages claim against an estate with little left to pay it. The clauses that work convert continuity into an operational right: an escrow with behavioural triggers, a standing data export right, and a current exit plan. This post sets out what each clause needs to contain.

Why Section 14 Does Not Help the Customer of an Insolvent Vendor

The most common misconception in technology sourcing is that the moratorium keeps the vendor working. It does not, and the reason is one of direction.

Essential and Critical Supplies Run Towards the Corporate Debtor, Not Away From It

Section 14(2) of the Code prohibits termination, suspension or interruption of the supply of essential goods or services to the corporate debtor during the moratorium. Regulation 32 of the IBBI (Insolvency Resolution Process for Corporate Persons) Regulations, 2016 defines essential supplies as electricity, water, telecommunication services and information technology services, to the extent that these are not a direct input to the output produced or supplied by the corporate debtor. Section 14(2A), inserted in 2020, extends comparable protection to supplies the resolution professional considers critical to preserving value and running the company as a going concern, but permits discontinuance where dues arising during the moratorium go unpaid.

Information technology services are therefore named in the regulation, which is precisely why the point is so often got wrong. The protection attaches to supplies received by the corporate debtor. Where the corporate debtor is itself the IT vendor, section 14(2) gives the customer nothing at all. It protects the vendor's own connectivity, hosting and utilities. It does not compel the vendor to keep serving anybody.

The distinction was worked through in Maharashtra State Electricity Distribution Co. Ltd. v. Ravi Sethia, Resolution Professional of Morarjee Textiles Ltd. [2025 SCC OnLine NCLAT 382], where the National Company Law Appellate Tribunal held that electricity supplied to a corporate debtor was an essential service under section 14(2) read with Regulation 32 and could not be disconnected during CIRP even though dues were unpaid, while section 14(2A) covers a different category of critical supplies where non-payment during the moratorium does permit discontinuance. The tribunal also noted that electricity qualified as essential because it was not a direct input to the textile output, which is the carve-out most drafters overlook. The reasoning is useful to a customer only in reverse: it confirms that the statutory shield sits on the corporate debtor's inbound supply lines.

Where Does the Customer's Leverage Actually Sit?

The lever that works is money and priority. Insolvency resolution process costs under section 5(13) include the costs incurred by the resolution professional in running the business of the corporate debtor as a going concern, and those costs rank first in the section 53 waterfall and must be paid in priority under any resolution plan.

That cuts two ways for a customer. Amounts the customer owes the vendor for services rendered after admission are receivables of the estate, which gives the resolution professional a direct commercial interest in continuing to serve a paying customer. Where the customer supplies something to the vendor after admission, whether licences, hosted capacity or seconded staff, the consideration is a CIRP cost with first-ranking priority rather than an ordinary claim. A customer that wants a transition delivered should therefore approach the resolution professional with a funded, priced scope of work rather than a demand letter citing the contract.

Source Code and Data Escrow That Actually Releases

Escrow is the clause most often bought and least often tested. A deposit containing a zip of source code and nothing else is close to worthless.

What the Deposit Has to Contain

A usable deposit contains the source code, the build scripts and the specific toolchain and compiler versions that reproduce a working binary, environment and configuration specifications, database schemas and data dictionaries, deployment runbooks and operational documentation, encryption keys and certificates or the means to regenerate them, and a manifest of every third party and open source dependency with its licence terms and version. It also needs a verification regime: periodic confirmation that the deposit is current, and at least one independent build test conducted by the escrow agent or a nominated engineer.

Why Is an Insolvency-Only Escrow Trigger Weak?

An escrow keyed solely to the vendor's insolvency fails on timing and on law. On timing, service quality usually collapses months before an application under section 7 or section 9 is admitted, and a customer waiting for an admission order loses a quarter of operational capability before the trigger fires. On law, a release mechanism that operates only because insolvency has occurred is an ipso facto arrangement, and a resolution professional seeking to preserve the corporate debtor's principal asset can be expected to test it before the adjudicating authority under section 60(5)(c).

Workable triggers are behavioural and earlier: sustained failure against defined service levels over a stated window, failure to resolve a priority-one incident within a fixed period, cessation of maintenance or withdrawal of named support personnel, failure to certify currency of the deposit within the agreed cycle, and the filing rather than the admission of an insolvency application. Insolvency should appear as one trigger among several, not as the mechanism.

Whether the Escrowed Material Can Be Claimed for the Estate

The question in-house counsel should ask is what the escrow actually transfers. It does not transfer ownership. The vendor's copyright in the software remains an asset of the corporate debtor, which the resolution professional must take into custody under section 18 and preserve under section 25. What the customer receives is a licence.

That reframing decides the drafting. Section 14(1)(b) bars the corporate debtor from transferring, encumbering or disposing of its assets during the moratorium, so a release that operates as a fresh grant made after admission is exposed. A release that merely brings into effect a licence already granted before admission, conditional on a trigger, is on much firmer ground because no post-admission disposal is required. Draft the escrow deed so the licence is granted at execution with exercise suspended until release, and say so expressly.

Data Access, Return and the Compliance Overlay

Extracting data from a failing provider is an exercise in access rather than entitlement. Contractual return obligations are worth little once the operations team has left, and a resolution professional will not have the knowledge to reconstruct exports nobody documented.

The protection that works is a standing right, exercised routinely rather than in a crisis, to take a complete export in a documented and non-proprietary format at a defined frequency, together with the schema and reference data needed to make the export intelligible. Rehearse it. An export nobody has ever restored is a hypothesis.

Where personal data is involved, the compliance position does not move with the vendor's solvency. Under the Digital Personal Data Protection Act, 2023 the customer is ordinarily the Data Fiduciary and the vendor a Data Processor engaged under a valid contract, and the Act keeps the Data Fiduciary responsible for compliance in respect of processing undertaken on its behalf. Security safeguards, breach intimation and erasure obligations continue to bind the customer whatever state the processor is in. A vendor collapse that strands personal data in an inaccessible environment is the customer's regulatory problem, not the resolution professional's.

Continuity Risks and the Clauses That Answer Them

Continuity risk	Contractual protection	Drafting detail that makes it work	What happens if the vendor enters CIRP
Loss of access to source code	Source code and materials escrow with a nominated agent	Licence granted at execution with exercise suspended until release; verified deposits and an independent build test	Release needs no post-admission disposal, so it is defensible against section 14(1)(b)
Data trapped in the vendor's platform	Standing export and data return right	Documented non-proprietary format, defined frequency, schema and reference data included, restore rehearsed	The customer already holds a current copy and depends on nobody's cooperation
Service collapse before any insolvency filing	Behavioural release and termination triggers	Service level failure over a stated window, unresolved priority-one incidents, loss of named personnel, filing rather than admission	Triggers have usually fired already, so the customer is not resting on an insolvency clause
No capability to transition away	Standing exit management and reverse transition obligation	Exit plan refreshed at intervals, named transition manager, pre-agreed rates, survival on any termination	Performance is not specifically enforceable; fund a priced scope with the resolution professional as a CIRP cost
Customer assets stranded at the vendor	Ownership, custody and location controls	Cloud tenancy, domain and primary data store held in the customer's own name; no customer hardware at vendor sites	Section 14(1)(d) blocks recovery of property in the corporate debtor's possession
Loss of software rights	Perpetual grant with separately priced support	Irrevocable and binding on successors, assigns and any transferee under a resolution plan	The grant survives; support, updates and security patching stop
Single-vendor concentration	Multi-sourcing and portability rights	Documented standards-based interfaces, no exclusivity, right to appoint a second supplier per service tower	A second supplier can absorb the tower without waiting on the CIRP timetable

Exit Management, Step-In and the Limit of Specific Performance

Exit management should not be a schedule drafted once at signature and never opened. The obligation worth having is a standing one: maintain a current exit plan, refresh it at defined intervals, keep a named transition manager, and provide reverse transition services for a stated period at rates agreed in advance rather than negotiated in a crisis. These obligations must be expressed to survive termination for any reason, including termination by the customer for the vendor's insolvency.

Step-in rights need a reality check. During the moratorium, section 14(1)(d) prevents the recovery of property in the possession of the corporate debtor, which means customer-owned hardware sitting in the vendor's facility cannot simply be collected. The architectural answer beats the contractual one: hold the tenancy, the domain and the primary data store in the customer's own name so that step-in becomes a matter of revoking the vendor's credentials rather than recovering assets.

The harder constraint is that a court will not order the vendor to keep working. Section 14 of the Specific Relief Act, 1963 places outside specific enforcement contracts that are determinable in their nature and contracts involving the performance of a continuous duty which the court cannot supervise, which describes an outsourcing agreement precisely. The remedy for non-performance is damages, and damages against a company in CIRP are an unsecured claim.

Perpetual and Subscription Licences Behave Differently

A perpetual licence is a right already granted, and the licensor's insolvency does not revoke it. What stops is maintenance, support and the supply of updates, which for a security-sensitive product is a decay curve rather than a cliff. A subscription licence is the opposite: it expires by its own terms, and a resolution professional has no obligation to renew on the old commercials and may well decline to. For any system the business genuinely cannot run without, the negotiating position is a perpetual grant with separately priced support, expressed to be irrevocable and to bind successors and assigns, including a transferee under a resolution plan.

Why Does Concentration Risk Matter More in a Regulated Sector?

Concentration is the risk that converts an inconvenience into an incident. A single provider running the core platform, the integration layer and the service desk means one insolvency takes all three. Mitigation is architectural: keep interfaces documented and standards-based, avoid exclusivity, retain the contractual right to appoint a second supplier for any service tower, and test portability rather than assert it.

For banks and non-banking financial companies the position is not a matter of preference. The Reserve Bank of India's Master Direction on Outsourcing of Information Technology Services, issued on 10 April 2023 and effective from 1 October 2023, applies to scheduled commercial banks, co-operative banks, non-banking financial companies and other regulated entities, and requires the outsourcing policy to contain a clear exit strategy for outsourced IT activities that ensures business continuity during and after exit, with alternative arrangements, data removal procedures and cooperation obligations spelled out. For a regulated entity, an untested exit plan is a supervisory finding waiting to be written up, quite apart from what happens if the vendor fails.

Frequently Asked Questions

Does the moratorium force an insolvent IT vendor to keep providing services?

No. Sections 14(2) and 14(2A) protect supplies made to the corporate debtor, not supplies made by it. Where the vendor is the corporate debtor, those provisions protect its own electricity, connectivity and IT inputs. Continuity for the customer depends on the resolution professional's going-concern judgement and on the customer being commercially worth serving.

Can the customer compel performance during CIRP?

Realistically no. Section 14 of the Specific Relief Act, 1963 puts determinable contracts and contracts requiring continuous supervision outside specific enforcement, and damages against a company in CIRP rank as an unsecured claim. The workable route is to fund a scoped transition so the resolution professional treats it as a receivable worth earning.

Are transition services performed after admission payable as CIRP costs?

Where the customer supplies goods or services to the vendor after admission, the consideration is an insolvency resolution process cost under section 5(13) and ranks first under section 53. Where the vendor performs for the customer, the fee is a receivable of the estate. Agree the scope and rate in writing with the resolution professional before work starts.

Can the resolution professional claim escrowed source code for the estate?

The copyright remains an asset of the corporate debtor and the resolution professional will take it into custody. What escrow gives the customer is a licence, not ownership. Grant that licence at execution with exercise suspended until a release event, so the release does not depend on a post-admission disposal caught by section 14(1)(b).

What happens to a perpetual software licence if the vendor is liquidated?

The grant itself survives, because it is a right already conferred. Support, updates and patches stop. Confirm that the grant is expressed as irrevocable and binding on successors, assigns and any transferee under a resolution plan, and treat the absence of security patching as the real operational risk.

Does the customer stay liable under the DPDP Act if the vendor collapses?

Yes. The customer is generally the Data Fiduciary and the vendor a processor engaged under contract, and responsibility for compliance stays with the Data Fiduciary. Maintain an independent, current copy of the data and rehearse the restore, because the obligation to secure, notify and erase does not pause for the processor's insolvency.

Can the customer terminate the contract immediately once the vendor is admitted into CIRP?

Termination clauses that trigger automatically on the vendor's insolvency, sometimes called ipso facto clauses, are commonly drafted into technology contracts, but their enforceability against the resolution professional is uncertain where termination would strip the corporate debtor of an asset or contract needed to keep it a going concern. In practice the customer should still be able to terminate for the vendor's actual non-performance under the contract's ordinary breach provisions, since a right founded on breach rather than solely on the insolvency filing stands on firmer ground.

Who owns the intellectual property in customisations built for the customer during the engagement?

Ownership depends entirely on the contract's intellectual property clause and is not affected by the vendor's insolvency; a customisation assigned to the customer at the time it was created remains the customer's property and does not form part of the vendor's insolvency estate. Where the contract is silent or grants only a licence, the customisation remains the vendor's asset, and the customer's right to continue using it after insolvency depends on the licence terms surviving termination or assignment of the contract.

Should the customer insist on a right to hire the vendor's key personnel if the engagement fails?

A negotiated right to approach and hire named transition personnel, subject to reasonable restrictions on solicitation of the vendor's wider workforce, is a practical continuity measure because institutional knowledge of the customer's systems often resides with specific individuals rather than in documentation. This right is separate from and does not depend on the vendor's insolvency; it should be drafted as a standing option exercisable on any prolonged service failure, not only on a formal insolvency filing.

Does a step-in right allow the customer to operate the vendor's systems directly?

A contractual step-in right allows the customer, or a substitute provider it appoints, to take over performance of the services, but its practical value depends on the customer or substitute actually having access to the vendor's infrastructure, credentials and documentation at the point it needs to step in. Section 14(1)(d) of the Insolvency and Bankruptcy Code, 2016 restrains recovery of property in the corporate debtor's possession during the moratorium, which can prevent the customer from physically taking control of vendor-owned hardware even where the contract purports to allow it.

What happens to a service level credit regime once the vendor enters CIRP?

Service level credits accrued before insolvency commencement become claims against the estate and rank with the customer's other unsecured claims unless the contract creates a right of set-off against amounts the customer separately owes the vendor. Credits that would accrue for service failures after admission are a live operational issue rather than a claims question, and the resolution professional, who is running the business as a going concern, has a commercial interest in avoiding fresh service failures that reduce the value of the customer relationship being preserved for the estate.

Should the exit plan differ for a vendor providing regulated data processing under the DPDP Act?

Yes. Where the vendor processes personal data as a Data Processor under the Digital Personal Data Protection Act, 2023, the exit plan should specifically address secure return or deletion of personal data, confirmation of deletion from backups and disaster recovery copies, and continuity of any consent or notice obligations the customer as Data Fiduciary owes to data principals, none of which is addressed by a generic technology exit plan built around source code and infrastructure alone.

Can the customer recover the cost of an emergency transition to a replacement vendor from the insolvency estate?

The cost of an emergency transition is a loss the customer has suffered and can be claimed against the estate as an unsecured creditor, in the same way as any other damages claim arising from the vendor's breach, but it ranks behind the costs of the corporate insolvency resolution process itself and behind secured creditors in any distribution. A customer should not expect to recover transition costs from the estate in practice and should treat contractual continuity measures, not a damages claim, as the real protection.