The Monetary Authority of Singapore (MAS) sets technology risk expectations for the financial institutions (FIs) it regulates. This page is for IT and security teams at those FIs, with a focus on capital markets firms such as holders of a capital markets services licence, including licensed fund management companies. It summarises the MAS Technology Risk Management (TRM) Guidelines, the capital markets Notices on Cyber Hygiene and on Technology Risk Management, and related outsourcing and incident reporting documents, with practical steps. Banks, insurers and other sectors have their own versions of the two Notices, so check which Notice names your type of institution.
The key documents
- Technology Risk Management Guidelines, January 2021. Guidelines. "Technology risk management principles and best practices for the financial sector" (para 1.4). PDF.
- MAS Notice FSM-N22, Notice on Cyber Hygiene (capital markets financial institutions). Issued 09 May 2024, last revised 20 August 2024, effective 10 May 2024. Notice. Six baseline cyber controls. Notice page.
- MAS Notice FSM-N21, Notice on Technology Risk Management (capital markets financial institutions). Issued 09 May 2024, effective 10 May 2024. Notice. Critical systems, downtime, recovery and incident notification. Notice page.
- Guidelines on Outsourcing (Financial Institutions other than Banks). Effective 11 December 2024, last revised 24 January 2025. Guidelines. Outsourcing and cloud. Guidelines page.
- Circular on Financial Institution Incident Reporting (MAS/TCRS/2025/08), 16 December 2025. Circular. How to notify MAS and submit incident reports. Circular page.
- Frequently Asked Questions: Notice on Cyber Hygiene. MAS FAQ. PDF.
Two consultations are not in force: Consultation Paper P012-2026 on amendments to the TRM Notices (published 10 June 2026, closed 31 July 2026) and Consultation Paper P004-2026 on proposed Guidelines on Third-Party Risk Management (March 2026).
Binding or guidance? MAS says Notices "primarily impose legally binding requirements on a specified class of financial institutions or persons". For Guidelines, "Contravening guidelines is not a criminal offence and does not attract civil penalties", but institutions "should observe the spirit of these guidelines". "Circulars have no legal effect." (MAS, Supervisory Approach and Regulatory Instruments.) The TRM Guidelines add that "the degree of observance with the spirit of the Guidelines by an FI is an area of consideration by MAS" (para 2.2).
Governance and board oversight
What MAS says. The board and senior management "should have members with the knowledge to understand and manage technology risks" (TRM Guidelines 3.1.2). A CIO or Head of IT and a CISO or Head of Information Security should be appointed, "minimally approved by the Chief Executive Officer" (3.1.3). The board, or a committee it delegates, approves the technology risk appetite and tolerance statement (3.1.7), and senior management should keep it informed of "salient and adverse technology risk developments and incidents" (3.1.8). FIs should keep an inventory of information assets (3.3.2) and a risk register (4.5.2), and run security awareness training "at least annually" (3.6.2). The MAS FAQ says "MAS expects an FI to report to its senior management on the state of compliance with the Notice" on cyber hygiene (FAQ A8).
What this means for your IT
- Record who holds the CIO and CISO roles, with the CEO's approval.
- Keep a current asset inventory and technology risk register.
- Send senior management a periodic cyber hygiene compliance report.
IT projects and change management
What MAS says. Security-by-design means "building security in every phase of the SDLC" (5.4.2). Changes should be "assessed, tested, reviewed and approved before implementation" (7.5.1), with a backup and rollback plan (7.5.5) and defined emergency change procedures (7.5.6). Segregation of duties should ensure "no single individual has the ability to develop, compile and move software codes" between environments (7.6.1). Continued use of unsupported hardware or software needs management dispensation (7.3.3).
What this means for your IT
- Keep test evidence and a rollback plan for each change.
- Track end-of-support dates and keep signed dispensations.
Cyber hygiene essentials
What MAS says. Notice FSM-N22 sets six requirements, written as "must":
- Every administrative account must be "secured to prevent any unauthorised access to or use of such account" (para 4.1).
- Security patches must be applied "within a timeframe that is commensurate with the risks posed by each vulnerability", with controls where no patch exists (para 4.2).
- There must be "a written set of security standards for every system" (para 4.3).
- Perimeter controls must "restrict all unauthorised network traffic" (para 4.4).
- Malware protection on every system "where such malware protection measures are available and can be implemented" (para 4.5).
- Multi-factor authentication (MFA) for administrative accounts on critical systems and for "all accounts on any system used by the relevant entity to access customer information through the internet" (para 4.6).
The FAQ points to CIS and NIST for security standards (A4) and a "risk-based approach" to patching (A3).
What this means for your IT
- Write a hardening standard per system type, for example from CIS Benchmarks, and check conformance.
- Set patch timeframes by severity and criticality.
- Confirm MFA coverage against para 4.6.
Access control and privileged access
What MAS says. Access should follow "never alone", "segregation of duties" and "least privilege" (9.1.1). MFA "should be implemented for users with access to sensitive system functions" (9.1.5). Access reviews should be periodic (9.1.6), and unneeded access "should be revoked or disabled promptly" (9.1.7). Privileged access "should only be granted on a need-to-use basis", with activities "logged and reviewed" (9.2.1). Remote access should be encrypted, use strong authentication such as MFA (9.3.1) and come from secured devices (9.3.2).
What this means for your IT
- Link joiner, mover and leaver steps to HR events, and review access on a schedule.
- Log privileged sessions; allow remote access only from managed devices.
Cryptography
What MAS says. FIs should "adopt cryptographic algorithms from well-established international standards" (10.1.2). Key management should cover "key generation, distribution, installation, renewal, revocation, recovery and expiry" (10.2.1). Sensitive keys belong in "hardened and tamper resistant systems, e.g. by using a hardware security module" (10.2.4).
What this means for your IT
- List where keys and certificates are used, with algorithms and expiry dates.
Data and infrastructure security
What MAS says. Data loss prevention should cover data in motion, at rest and in use (11.1.1). Confidential data on systems and endpoints "should be encrypted and protected by strong access controls" (11.1.3). Networks should be segmented (11.2.2), with intrusion prevention (11.2.3) and regular firewall rule reviews (11.2.5). Endpoint protection (11.3.3) and application white-listing (11.3.6) are expected. Notice FSM-N21 requires IT controls "to protect customer information from unauthorised access or disclosure" (para 9).
What this means for your IT
- Encrypt devices holding confidential data and block unapproved file sharing (11.1.5).
- Put IoT devices on a separate network segment (11.5.3).
Cyber surveillance and security operations
What MAS says. FIs "should procure cyber intelligence monitoring services" (12.1.2) and "should establish a security operations centre or acquire managed security services" (12.2.1). Logs should be collected, retained and protected (12.2.2) and correlated (12.2.5), with timely escalation (12.2.6).
What this means for your IT
- Centralise security, system and network logs, with defined alert thresholds and escalation contacts.
Incident management and notification
What MAS says. The TRM Guidelines expect an incident management framework (7.7.1), a communications plan (7.7.6) and a cyber incident response plan (12.3.1).
Under Notice FSM-N21, a capital markets FI "must notify the Authority as soon as possible, but not later than 1 hour, upon the discovery of a relevant incident" (para 7), subject to listed exceptions. A "relevant incident" is a system malfunction or IT security incident with "a severe and widespread impact" on operations or that "materially impacts" service to customers (para 2). A root cause and impact analysis report is due "within 14 days or such longer period as the Authority may allow" (para 8).
The circular says to contact the MAS Review Officer in office hours, or the 24-hour MAS incident reporting line if the officer cannot be reached or it is outside office hours (para 5). From 1 February 2026, reports go through MAS-Tx (para 2): an Initial Incident Report "not later than 24 hours" from discovery and a Final Incident Report within 14 days (para 8).
What this means for your IT
- Decide in advance who classifies a "relevant incident" and who calls MAS.
- Set up the MAS-Tx "Incident Reporting" role before you need it (circular, footnote 5).
Resilience and recovery
What MAS says. Notice FSM-N21 requires a process to identify critical systems (para 4). Unscheduled downtime per critical system must not exceed "a total of 4 hours within any period of 12 months" (para 5). Each critical system needs a recovery time objective "of not more than 4 hours", with recovery testing validated and documented "at least once every 12 months" (para 6). The TRM Guidelines add a disaster recovery plan "reviewed at least annually" (8.2.2), restore testing (8.4.3) and backups "stored offline or at an offsite location" (8.4.4). Consultation Paper P012-2026 proposes an "immutable or offline backup" of crucial data (para 2.17); this is a proposal only.
What this means for your IT
- Keep a critical systems list with tested recovery times and a downtime log.
- Test restores, not just backup jobs.
Third parties, cloud and outsourcing
What MAS says. FIs should assess a third party's technology risks "before entering into a contractual agreement or partnership" (TRM Guidelines 3.4.2). Outsourced services should "continue to be managed as if the services were still managed by the institution" (Outsourcing Guidelines 2.1). FIs should keep a register of outsourcing arrangements (5.8.2(a)), submit it to MAS "at least annually or upon request" (4.1.1) and review material arrangements "at least on an annual basis" (5.8.2(d)). "MAS considers CS operated by service providers as a form of outsourcing" (Annex 5, para 5). Consultation Paper P004-2026 proposes Guidelines on Third-Party Risk Management that would supersede the outsourcing guidelines (para 1.2).
What this means for your IT
- Include cloud and managed IT services in the outsourcing register.
- Put security, audit, incident notification and exit terms into contracts (Outsourcing Guidelines 5.5.2).
Audit and testing
What MAS says. FIs should run regular vulnerability assessments (13.1.1). For internet-facing systems, "the FI is expected to conduct PT to validate the adequacy of the security controls at least once annually or whenever these systems undergo major changes or updates" (13.2.4). Cyber exercises (13.3.1), adversarial attack simulation (13.4.1) and a remediation process with severity-based timeframes (13.6.1) are also expected. IT audit should give "an independent and objective opinion" (15.1.1).
What this means for your IT
- Schedule annual penetration tests for internet-facing systems and after major changes.
- Track findings to closure.
How Dual Layer IT can help
Dual Layer IT is ISO/IEC 27001:2022 certified, and our engineers hold CISSP, CISM and CISA certifications.
- IT compliance audits: a gap review against the TRM Guidelines and the Notices that apply to you.
- Cybersecurity: hardening, MFA, logging and incident response planning.
- Managed IT: patching, access reviews, backups and restore testing, with records for auditors.
Frequently asked questions
Are the MAS TRM Guidelines legally binding?
No. They are Guidelines; MAS says contravening guidelines "is not a criminal offence and does not attract civil penalties", though observance is considered in supervision (TRM Guidelines 2.2). The Notices are different: MAS describes Notices as imposing "legally binding requirements".
How quickly must a capital markets firm tell MAS about a major IT incident?
Notice FSM-N21 says "not later than 1 hour" after discovering a relevant incident (para 7), with a root cause and impact analysis report within 14 days (para 8).
Does using a cloud or managed service provider take systems out of scope?
Not in general. MAS treats cloud services from providers as outsourcing, and FIs remain "ultimately responsible and accountable" (Outsourcing Guidelines, Annex 5, paras 5 and 8). The Cyber Hygiene Notice's exemption (para 3.1) applies only where the FI cannot exercise control in all the listed ways.
Do we need to send MAS a cyber hygiene attestation?
The FAQ says FIs "are not required to submit an attestation or audit report" to MAS, but MAS expects a report to senior management (A8).
Sources
- MAS, Technology Risk Management Guidelines, January 2021.
- MAS, Notice FSM-N22 Notice on Cyber Hygiene, last revised 20 August 2024.
- MAS, Notice FSM-N21 Notice on Technology Risk Management, 09 May 2024.
- MAS, Guidelines on Outsourcing (Financial Institutions other than Banks), last revised 24 January 2025.
- MAS, Circular on Financial Institution Incident Reporting, 16 December 2025.
- MAS, Frequently Asked Questions: Notice on Cyber Hygiene.
- MAS, Consultation Paper P012-2026, 10 June 2026.
- MAS, Consultation Paper P004-2026, March 2026.
- MAS, Supervisory Approach and Regulatory Instruments.
This page summarises MAS publications for information. It is not legal or regulatory advice; read the documents in full and take advice from your compliance team.