When escrow is demanded for source code: what to do first
A demand for source-code escrow means the other side wants a fallback if you cannot maintain the software. The first step is not to negotiate deposit terms. It is to confirm what the licence says about maintenance, termination and delivery format. Escrow protects a party only when the trigger events and the verification method are fixed before code is deposited.
What the law actually protects
Directive 2009/24/EC treats a computer program, including its source code, as a protected literary work. The directive sets the baseline: who may reproduce, adapt or distribute the code, and on what terms a lawful acquirer may act without separate authorisation. It does not mention escrow at all. Escrow is a contractual layer built on top of that protection, agreed between the parties and held by a third party. What the directive does settle, indirectly, is who owns the rights being deposited. An escrow demand cannot create ownership that the licence does not already grant, and it cannot strip protection from a party the licence never named.
What changes once escrow is demanded
Once a counterparty asks for escrow, three things move at once. A deadline for making the first deposit usually starts running, tied to a renewal date or to a support-level agreement rather than to the date of the demand itself. The meaning of "complete and working code" becomes something to argue about — a partial or stale deposit can satisfy the wording of a clause without satisfying its purpose. And any gap in the ownership chain becomes visible, because a competent escrow agent asks for proof of title before it will accept a deposit at all. None of these three points gets resolved by agreeing to escrow in principle; they get resolved by fixing definitions before any file changes hands.
What a complete deposit usually needs to include
A repository export alone rarely counts as a working deposit. The parties normally need to agree, in writing, that a release includes:
- the full source tree, not a selected subset of modules;
- build scripts and configuration files needed to compile the code without guesswork;
- a dependency manifest, including versions of any third-party libraries used;
- enough documentation for a competent developer unfamiliar with the project to build and run it.
Without this list, "the code was deposited" and "the code works" can be two different facts.
What to do first
- Legal counsel pulls the current licence and isolates every clause touching escrow, maintenance and termination before any reply goes out.
- The technical lead maps which repository state, scripts and dependencies would actually count as a complete deposit.
- Whoever owns the contract checks the chain of title: fully owned code, code licensed-in from a third party, and code written by an external contractor each raise a different question.
- The parties agree, in writing, an escrow agent and a trigger list before any file is transferred to anyone.
- Counsel drafts a verification protocol setting who tests the deposit and how often it gets refreshed.
- Only after these five steps does the commercial negotiation over deposit format make sense.
Typical trigger events and who moves first
| Trigger event | What normally has to be shown | Who acts first |
|---|---|---|
| Licensor insolvency or cessation of business | Documentary proof of the event, as defined in the escrow agreement | The beneficiary, applying to the escrow agent |
| Failure to meet an agreed support level | A documented breach, not a bare complaint | The beneficiary, with evidence of the breach |
| Change of control at the licensor | An express trigger clause naming this event | Whoever drafted the trigger list, usually in advance |
| Contract termination for cause | An undisputed termination, or a ruling that it was valid | The escrow agent, once both sides confirm or a forum decides |
Who decides, and on what evidence
An escrow agent is not a court and does not investigate. It releases a deposit only against the evidence the agreement itself specifies — typically a written notice, a certificate, or a ruling from a named forum. If the trigger is disputed, the agent simply holds the deposit and does nothing further. The dispute then goes wherever the licence sends it: arbitration, a named court, or a mediation step that has to run first. There is no default timeline built into escrow as a mechanism. The licence sets one, or it does not, and where it does not, the delay can run for months while the underlying software problem gets worse.
Common branches
If the licence never named specific trigger events, an escrow demand at this stage is really a request to negotiate the trigger list retroactively, which changes the leverage on both sides.
If the code was written partly by an external contractor, the chain of title needs checking before any deposit is accepted — an escrow agent will not resolve a dispute about who actually owns what sits inside the deposit. When a contractor claims ownership of the code: what covers that ownership question on its own.
If part of the deposit is a smart contract or a tokenised licence key rather than a plain repository, the written licence and the on-chain logic can point in different directions at the moment of release. A smart contract conflicts with the written licence tokenised sets out how that conflict usually gets resolved.
If the licence itself has been pledged as security for financing, escrow terms and security terms can overlap, and the two need aligning rather than negotiating twice from scratch.
What this page does not decide
This page does not draft an escrow agreement or fix a deposit format; that is a service question, handled once the facts above are settled, not a legal question on its own. It also does not cover disputes that only resemble this one on the surface. A claim of bad-faith registration against a trade mark, for instance, follows an entirely different procedure with a different forum. A competitor claims bad faith trade mark is the page for that situation. And it does not replace the actual licence: the wording of the trigger clause controls, this page only orients the first response.
Related situations
Escrow demands often surface alongside financing questions rather than on their own. When a licence is used as security: what to covers the parallel case where the licence itself, not the underlying code, has been pledged.
Verified
This page was checked against Directive 2009/24/EC. Our approach to collecting, cross-checking and dating sources — and where that approach stops — is set out in Methodology: collection, cross-checking and dating and its limits. Sources checked as of the current publication date.
FAQ
What is the first step when escrow is demanded for source code?
Confirm what the current licence already says about maintenance, termination and deposit format before drafting any reply. Negotiating new terms without checking the existing clause first wastes the time that actually matters, and often repeats a fight the licence already settled.
Which deadline is already running?
If the demand is tied to a renewal date or a support-level agreement, a deposit deadline may already be running from the date the licence sets, not from the date the demand was made. Checking the licence's own calendar comes before any commercial reply.
Who decides, and on what evidence?
The escrow agent decides on the narrow evidence the agreement specifies — usually a notice or a certificate, not an investigation. A disputed trigger does not get resolved by the agent at all; it goes to whatever forum the licence names, on whatever evidence that forum requires.