CMA Small Systems AB

Use case

Operational Resilience, Regulatory Compliance, Continuity 

Industry

Financial services and financial market infrastructure

Services

Software Escrow 
Verification Services

Background

CMA Small Systems is a global provider of solutions for financial institutions, including financial market infrastructures, with installations in over 55 countries. The company specialises in the design and delivery of mission-critical infrastructure systems that support national and regional financial ecosystems.

CMA’s product portfolio includes real-time gross settlement systems (RTGS), automated clearing houses (ACH), instant payment systems (IPS), transaction routing and orchestration platforms, payment hubs, as well as depository and trading infrastructure. These systems are typically deployed at central banks, national payment operators, and financial institutions, forming the backbone of domestic and cross-border payment and capital market operations.

CMA solutions are designed to operate in highly demanding environments, supporting high transaction volumes, 24/7 availability, and strict requirements for resilience, security, and regulatory compliance where system availability is directly linked to financial stability.

Given the critical role these systems play within the global financial ecosystem, CMA has consistently taken a proactive stance toward transparency and long term supportability, to provide confidence to IT teams as well as risk, compliance, and executive stakeholders responsible for overseeing mission critical financial infrastructures.

Challenge

Financial institutions and infrastructure operators that rely on CMA Small Systems operate in highly regulated, mission-critical environments where payment, clearing, and financial market infrastructure systems must remain continuously available, maintainable, and secure. Central banks, regulators, and financial institutions globally are placing increasing emphasis on operational resilience, third-party risk governance, and the ability to ensure continuity of critical financial systems.

Regulators, auditors, and customers’ own internal risk teams expect organisations to demonstrate robust third party controls. This includes continuity plans and clear exit strategies for critical software dependencies, ensuring that the specialist software supporting national and regional financial ecosystems could continue to be supported under all circumstances, including supplier disruption, ownership change, or insolvency.

CMA also noted that beyond contractual commitments, customers increasingly required evidence that escrow deposits were complete, accurate, and technically usable. CMA required a solution that met these expectations without compromising their intellectual property, innovation, or customer relationships.

“Operational resilience is a critical consideration for financial institutions. By working with Escode, we support our customers in maintaining continuity for business critical systems and meeting regulatory and third party risk requirements.”

– Maxim Neshcheret,
Regional Director, Asia, CMA Small Systems

Solution

To strengthen customer confidence and address evolving regulatory expectations CMA Small Systems and Escode established a long term, collaborative escrow and verification framework designed to support both CMA and its global customers.

At the core of this approach is the establishment of a clear, enforceable legal right for customers to access and use critical software assets in the event CMA is unable to continue providing the service. The software escrow solution CMA adopted is not simply secure storage. It’s a legally binding, tri party agreement that defines what is held in escrow, the circumstances under which it can be released, and how it may be used to maintain operational continuity.

The process operates as follows:

• CMA deposits its source code, build materials, and supporting documentation into escrow with Escode, ensuring that all assets required to support business continuity are protected under a formal legal framework.
• Independent verification and testing activities are undertaken where required to confirm that the escrow deposit is complete, current, and capable of being rebuilt or deployed independently. This provides confidence that the materials are not only accessible, but usable in practice.
• Escode produces formal, independent reports documenting the outcomes of verification and scenario testing exercises. These reports provide objective, audit ready evidence that CMA’s escrow arrangements can support recovery and exit planning in the event of supplier failure.

By combining software escrow agreements with practical verification and scenario testing, this framework moves beyond theoretical continuity planning. It enables CMA customers to demonstrate compliance with internal governance frameworks, audit expectations, and regional regulatory requirements through documented, independent evidence.

Results

The long standing partnership between CMA Small Systems and Escode has delivered clear and sustained benefits for all stakeholders.

• Increased customer confidence through escrow arrangements validated by independent verification.
• Demonstrable evidence that escrow deposits are complete, rebuildable, and fit for purpose.
• Reduced third party and concentration risk for financial institutions operating critical CMA systems globally.
• Alignment with global and regional regulatory expectations, supported by independent verification reporting.
• Protection of CMA’s intellectual property without introducing commercial or technical friction.
• A proven, scalable escrow and verification model supporting customer relationships for more than 15 years. 

By combining escrow with verification as a proactive mechanism, CMA reinforces its position as a trusted, enterprise grade software provider. This enables its customers to rely on CMA’s solutions with confidence, even in the most demanding and highly regulated operational environments.

“We highly value our strategic partnership with CMA Small Systems, working closely together to help them support continuity for their customers’ most critical applications and address the risks associated with third party dependency. Software escrow, combined with verification and ongoing oversight, forms an important part of how vendors like CMA Small Systems demonstrate resilience and compliance in regulated markets.”

– Alex McCulloch,
Director of Market Development (Middle East)