On the 11th of December 2023, the Monetary Authority of Singapore (“MAS”) published a revised version of the MAS outsourcing guidelines applicable to non-Bank Financial Institutions such as Fund Management Companies and Payment Service Providers. These guidelines help ensure sound risk management practices. This applies when Fund Management Companies and Payment Service Providers enter into outsourcing agreements, or plan to outsource business activities to a service provider. These guidelines are effective from the 11th of December 2024.
The revised version of the Outsourcing guidelines have undergone strategic refinement. They now draw a distinction between outsourcing for Non-Bank Financial Institutions and Banks. This deliberate separation underscores MAS’s commitment to precision and relevance. Each sector now receives guidelines tailored to its distinct operational requirements.
MAS Outsourcing Guidelines: Key Changes
Annex 2 of the previous Outsourcing Guidelines only provided a non-exhaustive list of examples of outsourcing arrangements. The newly revised Outsourcing Guidelines take this a step further to include a list of exempted outsourced services in Annex 1. This annex exempts services that are exclusively provided by the Government Technology Agency. It also exempts services unrelated to the conduct of financial business. Exempted services also come with a condition: the service provider must not handle any of the financial institution’s confidential information, such as customer data. Annex 1 provides much-needed clarity on the parameters surrounding outsourced services. It takes a nuanced approach in cases where MAS exempts certain services from stringent regulatory requirements. This fosters efficiency and aligns with the evolving landscape of technology and business processes.
Cloud Services and Material Outsourcing
For ease of reference, guidance on cloud computing services is now included in Annex 5 of the revised Outsourcing Guidelines. Professional services related to the institution’s business activities, such as accounting, internal audit, and compliance, also fall under the scope of outsourced arrangements. An institution that outsources all, or substantially all, of its risk management or internal control functions falls under a material outsourcing arrangement. This includes the professional services listed above. Factors that an institution should consider when assessing materiality is listed in Annex 3 of the revised Outsourcing Guidelines
A financial institution should follow the guidelines set by MAS. It should maintain its Outsourcing Register using the template in Annex 4 of the revised Outsourcing Guidelines, and be able to demonstrate compliance. In the newly revised Outsourcing Guidelines, it is no longer necessary for an institution to notify MAS before making any material outsourcing arrangement. This takes place with immediate effect. However, if MAS is not satisfied with an institution’s adherence to the Outsourcing Guidelines, it may require additional controls. These controls would address the identified issue. This may include the need to notify the MAS before committing to any material outsourcing arrangements. To avoid such issues, institutions should conduct appropriate due diligence on their outsourced service providers. They should also be able to demonstrate their adherence to the guidelines to MAS.
Business Continuity Management Alignment
The revised guideline incorporates the amendments relating to business continuity management for alignment with the revised Guidelines on Business Continuity Management. In the new guidelines, there is no requirement for outsourcing agreements to contain Business Continuity Plans (“BCP”) requirements on the service provider, in particular, recovery time objectives (“RTO”), recovery point objectives (“RPO”), and resumption operating capacities. It also removes the requirement for the service provider to test BCP plans in a way that validates RTO, RPO, and resumption operating capacity feasibility.
MAS Outsourcing Guidelines: Things to Take Note Of
1. When submitting an outsourcing register to the MAS, an institution should use the template provided for in Annex 4 of the Outsourcing Guidelines.
2. Financial Institutions should not outsource their internal audit function to the institution’s external audit provider. This will give rise to a conflict of interest.
3. If an internal audit function is outsourced, an institution should conduct periodic assessments to ensure that the service provider is able to perform the internal audit satisfactorily. This would apply similarly to any other outsourced function.
How can we help?
The regulatory landscape for Fund Management and Payment Services in Singapore continues to evolve, addressing emerging market risks and requirements.
At Curia Regis, we have a dedicated team in Singapore providing regulatory and compliance support. We help institutions meet MAS requirements across various strategies and business models. With extensive experience in this field, we help ensure your compliance frameworks align with MAS standards. Our approach is solution-oriented, tailored to your business size, type, and structure.
Reach out to us today to leverage our years of expertise. We specialise in the efficient implementation of these crucial compliance elements. Let us guide you through the complexities of regulatory compliance. We support your business through its obligations as it continues to grow.
