Guidelines on Risk Management Practices – Technology Risk

What it is

The guideline is titled "Guidelines on Risk Management Practices – Technology Risk", with a "Published Date: 18 January 2021" shown on MAS's own page.

MAS describes it as "Risk management principles and best practice standards to guide financial institutions in managing technology risk."

MAS further states: "The guidelines set out risk management principles and best practices to guide financial institutions to establish sound and robust technology risk governance and oversight, as well as maintain IT and cyber resilience."

MAS's page lists earlier license-type-specific Notices on technology risk management — including "Notice PSN05 Technology Risk Management [Cancelled]", "Notice 127 Technology Risk Management [Cancelled]" and "Notice 506 Notice on Technology Risk Management [Cancelled]" — each marked cancelled with effect from 10 May 2024. A separate, current binding Notice does exist: MAS Notice FSM-N13 "Technology Risk Management" states it is "effective from 10 May 2024" and describes "Requirements on technology risk management for operators and settlement institutions of designated payment systems and holders of payment services licence (digital payment token service)" — its own "Applies to:" line names only "Designated Payment System Operator" and "Designated Payment System Settlement Institution", a narrower scope than this Guidelines document's own "Applies to" list.

Who owns it

The guideline is issued and published by the Monetary Authority of Singapore (MAS).

Who asks for it

Statutory (scoped). This demandDriver reflects only MAS Notice FSM-N13 "Technology Risk Management" — its own page states it is "effective from 10 May 2024", issued "pursuant to: Financial Services and Markets Act 2022", and its own "Applies to:" line names only "Designated Payment System Operator" and "Designated Payment System Settlement Institution". Whether other institution types named on this Guidelines document's own broad "Applies to" list (banks, insurers, fund managers, etc.) are separately bound by other current MAS Notices was not verified in this record and is not asserted either way.

The page's own "Applies to:" line names a long list of MAS-licensed institution types — among them "Financial Holding Company (Banking)", "Major Payment Institution" and "Licensed Trust Company" — spanning banks (Full/Merchant/Wholesale), insurance companies, payment institutions, fund management companies, and exchange/clearing entities.