What financial institutions need to know about technology risk, cybersecurity, and regulatory obligations
Technology Risk Management (TRM) provides a framework for managing these risks. For financial institutions in Singapore, understanding TRM begins with understanding the Monetary Authority of Singapore (MAS), the institution’s business activities and the requirements that apply to it.
MAS, TRM and regulatory obligations
MAS is Singapore’s central bank and integrated financial regulator. Its regulatory remit includes banking, insurance, capital markets, financial advisory and payment services.
TRM covers how an organization identifies, assesses, manages and monitors risks arising from technology. These risks include cyberattacks, unauthorized access, data loss, system failures and weaknesses in third-party services.
MAS issues both Technology Risk Management Guidelines and legally binding Notices. These instruments serve different purposes.
| Instrument | What it means for a financial institution |
|---|---|
| Applicable legislation, regulations and MAS Notices | Establish legally binding obligations for entities within their scope, subject to their definitions, exclusions and effective dates. |
| MAS TRM Guidelines | Set out supervisory expectations, risk management principles and good practices. Although generally not independently legally binding, they are relevant to MAS’s assessment of an institution’s risk management. |
The MAS TRM Guidelines provide the broader risk management framework. Applicable Notices establish specific mandatory requirements.
Understanding the businesses behind the technology
Financial services businesses differ in their activities, information holdings, and operational dependencies. These differences affect how IT services and security controls should be designed.
| Business type | What it does | Information and services requiring protection |
|---|---|---|
| Asset and fund manager | Manages investment portfolios or pooled investor capital. | Investor records, portfolio information, trading access and transaction instructions. |
| Hedge fund | An investment fund using strategies that may include derivatives, short selling or leverage. | Trading strategies, positions, counterparty information and time-sensitive communications. |
| Private equity firm | Invests in private businesses, often over a longer investment period. | Deal documents, valuations, due diligence and portfolio-company information. |
| Venture capital firm | Invests in startups and growth businesses. | Investment decisions, shareholder records and confidential company information. |
| Wealth manager or private bank | Provides investment, wealth planning or banking services. | Client identities, financial profiles, banking instructions and account access. |
| Single-family office | Manages the investments and affairs of one family. | Family records, ownership structures, investment information and payment instructions. |
| Multi-family office | Provides services to multiple families. | Client records, mandates, portfolios and communications. |
| Corporate finance adviser | Advises on transactions such as fundraising, acquisitions and restructuring. | Commercial negotiations, transaction documents and market-sensitive information. |
| Insurer or insurance intermediary | Underwrites insurance or arranges and advises on insurance products. | Policyholder information, claims records, personal data and servicing systems. |
| Trust company | Provides trust administration and related services. | Trust deeds, beneficiary records, asset information and distribution instructions. |
| Payment service provider | Provides specified payment services. | Transaction data, payment systems, customer information and authentication services. |
| Fintech startup | Uses technology to provide financial services or develop solutions for the financial industry. | Depending on its activities: customer and transaction data, platform access, software, APIs and financial information. |
Are fintech startups considered financial institutions?
Some are, while others are technology service providers. A company’s startup status, size, or use of technology does not determine whether it is regulated by MAS.
A fintech business providing regulated financial services may require the relevant license unless an exemption or exclusion applies. For example, a business providing regulated payment services may operate as a licensed payment institution.
A company that supplies software, analytics, cybersecurity or IT infrastructure to financial institutions is not automatically a MAS-regulated financial institution solely because it serves those clients.
| Fintech business model | Regulatory consideration |
|---|---|
| Provides payment services directly | Assess whether the services fall within regulated payment activities and whether licensing, exemptions or exclusions apply. |
| Provides investment or financial advisory services through a digital platform | Assess the actual activities and the relevant financial services licensing requirements. |
| Develops software or infrastructure for financial institutions | Supplying technology alone does not automatically make the company a MAS-regulated financial institution. Client contracts may nevertheless impose security, audit and service obligations. |
For Entrust Network, the practical approach is to determine what the financial services, which entity provides the service, and which regulatory status applies.
Which MAS Notices should an institution check?
MAS issues different TRM and Cyber Hygiene Notices for different categories of financial institutions.
Selected references include:
| Institution category | TRM Notice | Cyber Hygiene Notice |
|---|---|---|
| Banks | FSM-N05 | FSM-N06 |
| Capital markets financial institutions | FSM-N21 | FSM-N22 |
| Licensed financial advisers | FSM-N23 | FSM-N24 |
| Licensed trust companies | FSM-N25 | FSM-N26 |
| Registered insurance brokers | FSM-N19 | FSM-N20 |
This is a reference guide rather than a complete applicability assessment. Each Notice’s scope, definitions, and exclusions must be checked.
The six mandatory cyber hygiene areas
For entities covered by Notice FSM-N22, cyber hygiene requirements address six areas:
| Area | Main requirement |
|---|---|
| Administrative accounts | Secure administrative accounts against unauthorised access or use. |
| Security patches | Apply patches within timeframes proportionate to vulnerability risk and implement controls where patches are unavailable. |
| Security standards | Maintain written security standards for systems and address risks arising from non-conformity. |
| Network perimeter defense | Restrict unauthorised network traffic. |
| Malware protection | Implement malware protection measures where available and implementable. |
| Multi-factor authentication | Implement MFA for the accounts specified in the Notice. |
The MFA provisions cover administrative accounts on critical systems and accounts used to access customer information through the internet.
Meeting these six areas alone does not establish compliance with every applicable MAS obligation.
How to Get Started with MAS TRM
An effective approach to technology risk management begins with understanding your organization’s obligations, identifying business risks, and turning requirements into everyday practices.
For financial institutions and fintech businesses in Singapore, five practical steps can help establish a clear starting point:
- Confirm your regulatory profile. Identify your legal entity, business activities, and license or exemption status. Determine which mandatory MAS Notices and supervisory Guidelines apply to your organization.
- Identify critical services and systems. Understand which business services depend on technology, what information needs protection, and where external providers support your operations.
- Assess your controls and gaps. Review access security, patching, monitoring, backups and recovery arrangements alongside your policies, procedures and supporting records.
- Assign responsibilities and priorities. Establish accountable owners, prioritize improvements by risk, and agree on actions, resources, and completion dates.
- Test, review and improve. Validate response and recovery arrangements through appropriate assessments and exercises. Use the findings to strengthen controls and keep management informed.
The MAS Financial Institutions Directory can help verify listed regulatory status. Licensing records and compliance review may be needed to complete the assessment.
Take the Next Step with Entrust Network
Whether you are establishing your technology risk management framework or strengthening existing arrangements, Entrust Network can help connect your IT operations, cybersecurity controls, and compliance support.
Whether you are establishing your technology risk management framework or strengthening existing arrangements, Entrust Network can help connect your IT operations, cybersecurity controls, and compliance support.
Contact Entrust Network Services to discuss your organization’s managed IT, cybersecurity, and MAS TRM support needs.
Author
Jamson Lim
IT Director, Data Protection Officer (DPO) and Cybersecurity Consultant
Jamson Lim is an IT and cybersecurity professional with more than 20 years of experience in cloud security, data protection, secure infrastructure, cybersecurity governance, and compliance advisory.
He holds a Master of Computing from the National University of Singapore (NUS) and an Advanced Diploma in Data Protection from Singapore Management University (SMU). He is certified as a Certified Ethical Hacker (CEH) and Certified Linux Systems Engineer (CLSE).
He holds a Master of Computing from the National University of Singapore (NUS) and an Advanced Diploma in Data Protection from Singapore Management University (SMU). He is certified as a Certified Ethical Hacker (CEH) and Certified Linux Systems Engineer (CLSE).
