MAS outsourcing and technology risk expectations should be considered alongside business continuity. The relevant frameworks include the MAS Guidelines on Outsourcing, the MAS Technology Risk Management Guidelines (2021) and the MAS Business Continuity Management Guidelines.
MAS issued its Guidelines on Outsourcing on 27 July 2016 (last revised 5 October 2018). From 11 December 2024 they were replaced by the Guidelines on Outsourcing (Banks) and the Guidelines on Outsourcing (Financial Institutions other than Banks), both issued on 11 December 2023. They apply a risk-based approach, with fuller expectations for material outsourcing arrangements: in summary, those which, if disrupted, could significantly affect the institution’s business operations, reputation or profitability, or its ability to manage risk and comply with laws and regulations, or which involve customer information where unauthorised access or disclosure would materially affect the institution or its customers.
MAS Notice 658 (banks) and Notice 1121 (merchant banks), Management of Outsourced Relevant Services, issued 11 December 2023 and in force since 11 December 2024, set legally binding requirements alongside the guidelines.
MAS does not generally require prior notification of material outsourcing; it removed that expectation in 2016. Banks must keep an outsourcing register and submit it to MAS twice a year and on request, and Notices 658 and 1121 require notification in specific cases, such as subcontracting of material services and certain terminations. MAS consulted in March 2026 on Guidelines on Third-Party Risk Management, which would replace the outsourcing guidelines once finalised.
