MAS TRM and outsourcing · Technology and third-party risk for Singapore financial institutions
MAS TRM and outsourcing compliance for technology and third-party risk your board and supervisor can see is under control.
The Monetary Authority of Singapore sets its technology and cyber risk expectations in the TRM Guidelines, sets separate expectations for outsourcing, and makes a narrower set binding through its notices. No certificate exists; the test is whether your controls and records stand up when MAS or your auditors look. Sterling's expert and experienced consultants map both to your licence, close the gaps with your teams and leave evidence that holds. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced information security and technology risk consultants, working with regulated institutions across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; no MAS TRM certificate exists and MAS supervises
8,100+ client engagements in 60+ countries.
MAS TRM client experience
What it is
What is MAS TRM and what is it used for?
MAS TRM is shorthand for how the Monetary Authority of Singapore expects financial institutions to govern technology risk. It rests on two instruments: the Technology Risk Management Guidelines, setting out principles across governance, systems, security and resilience, and MAS notices on technology risk management and cyber hygiene, which make a smaller set of expectations legally binding for each type of licensed institution. Separate Guidelines on Outsourcing, and for banks and merchant banks binding notices, cover reliance on service providers.
The guidelines themselves are not legally binding, but MAS has said it expects institutions to observe them and that observance feeds into its risk assessment of each institution. The January 2021 revision widened the focus to cloud, application programming interfaces, rapid software development, cyber threat intelligence and oversight of third-party service providers, which is where TRM and outsourcing meet.
Current edition. The Technology Risk Management Guidelines as revised on 18 January 2021. From 10 May 2024 MAS moved the technology risk and cyber hygiene notices to new references (for banks, FSM-N05 and FSM-N06). The Guidelines on Outsourcing (Banks) and (Financial Institutions other than Banks), dated 11 December 2023, took effect on 11 December 2024. Confirm the instruments that apply to your licence on mas.gov.sg before you plan.
Who it is for
Who needs MAS TRM and outsourcing compliance?
Any institution that MAS regulates is in scope of the TRM Guidelines and the outsourcing guidelines for its type, whatever its size: banks, insurers, payment firms, fund managers, brokers, financial advisers and trust companies among them. Proportionality matters, so a small licensee is not expected to run a bank's programme. Work usually starts from one of four places:
- A regulated client asks its supplier. Banks and insurers pass TRM and outsourcing expectations down to their technology vendors and service providers through due diligence and contract clauses.
- A licence application or tender needs it. Applicants and bidders are asked how they manage technology risk before anything is signed.
- The regulator raises it. An inspection finding, a supervisory query or a serious incident puts technology risk on the board's agenda.
- A group company sets the standard. A parent already aligned to TRM expects its Singapore entity, or its shared service centre, to match.
Requirements
What are the main MAS TRM and outsourcing requirements?
The TRM Guidelines are principles-based rather than a checklist of controls, grouped into broad areas of practice; outsourcing adds MAS's separate instruments, listed last. The summary below stays at area level; your programme is measured against the guidelines and the notices themselves, applied in proportion to your size and risk.
- Technology risk governance and oversight: board and senior management accountability for technology and cyber risk.
- Technology risk management framework: identifying, assessing, treating and monitoring technology risk.
- IT project management and security-by-design: security built into projects from the start.
- Software application development and management: secure development, testing and release.
- IT service management: change, incident, problem and configuration disciplines.
- IT resilience: availability, recoverability and disaster recovery of systems.
- Access control: user, privileged and remote access management.
- Cryptography: sound algorithms and key management.
- Data and infrastructure security: protecting data, networks, endpoints and cloud workloads.
- Cyber security operations and assessment: threat monitoring, response, testing and exercises.
- Online financial services: protecting customers and transactions on digital channels.
- IT audit: independent assurance over technology risk controls.
- Outsourcing risk management: the Guidelines on Outsourcing (Banks) or (Financial Institutions other than Banks), for arrangements to outsource relevant services on an ongoing basis.
- Outsourced relevant services at banks and merchant banks: MAS Notices 658 and 1121, which are legally binding on the institutions they cover.
What does useful MAS TRM and outsourcing evidence look like?
Board minutes showing technology risk decided, a risk register tied to critical systems, recovery tests with results against targets, access reviews with the removals they triggered, penetration test reports with closure dates, incident records with root causes, and for each outsourcing arrangement the risk assessment, due diligence, contract and exit plan. Where a notice applies, keep separate proof of each obligation.
Compliance route
How do you achieve MAS TRM and outsourcing compliance?
No body certifies MAS TRM or outsourcing compliance. Compliance is a programme you run and can demonstrate, reviewed by your internal and external auditors and supervised by MAS.
- 01Map the instruments to your licence.Confirm which guidelines and notices apply to your institution, which systems count as critical, which service providers perform relevant services and how far proportionality reaches.
- 02Gap assessment: compare current practice with the guidelines and notices.We test governance, controls, records and each outsourcing arrangement area by area, then agree prioritised actions, owners and dates.
- 03Remediate and document.Close the gaps in policy, process, technology and service-provider contracts, starting with anything a notice makes mandatory.
- 04Review independently and report to the board.Internal review or IT audit tests the controls; the board receives the results and the residual risks it is accepting.
- 05Operate, monitor and respond to supervision.Keep testing, reporting and improving, and be ready for inspections and supervisory questions.
Check the route before you sign. Anyone offering an "MAS TRM certificate" or an "MAS outsourcing certificate" is selling something MAS does not issue. Read the TRM and outsourcing guidelines and notices on mas.gov.sg, and if you also want an ISO/IEC 27001 certificate, confirm the certification body is accredited by a member of the Global ACI arrangement. The certification buyer's checklist
Cost
How much does MAS TRM compliance cost?
Remediation drives the budget more than paperwork: the controls still to build, the systems that count as critical and the testing that proves them.
| Cost component | What affects it |
|---|---|
| Consulting and gap assessment | Licence type, number of critical systems, and whether you choose Design™ or Drive™ |
| Technical remediation | Tools, configuration and infrastructure changes your gaps require, owned by your teams or vendors |
| Independent testing and audit | Penetration tests, recovery tests and IT audit, quoted by the providers you appoint |
| Your team's time | Owners for each area, and the effort of producing records that show controls operating |
| Software and learning | Effivity and Sterling Academy access, itemised at no additional cost |
What moves the price
- Cloud, outsourced and third-party dependencies
- Online services offered to customers
- Entities, sites and headcount in scope
What a Sterling proposal always shows
- Deliverables, assumptions and exclusions in writing
- Milestones linked to deliverables
- One all-inclusive proposal for our work
Timeline
How long does MAS TRM compliance take?
Remediation sets the pace: documenting governance is quick, while changing access models, recovery arrangements or vendor contracts takes longer. An existing ISO/IEC 27001 system helps. As an estimate, most programmes take four to nine months to reach a defensible position.
| Phase | What sets the pace |
|---|---|
| Applicability and gap assessment | Access to system owners, vendors and existing audit reports |
| Remediation | Technical change windows, budgets and vendor cooperation |
| Testing and evidence | Recovery and penetration test schedules, and time to fix what they find |
| Independent review | Auditor availability and the board calendar |
Your engagement
What your MAS TRM engagement includes
Sterling OS™ runs every engagement, and each phase has a technology risk meaning. Sterling does not certify, attest or validate MAS TRM compliance: MAS supervises your institution, and your auditors give their own opinions.
Design™: guided support
Your people build the framework and controls; a Sterling consultant sets the method, reviews each deliverable and coaches the owners.
Drive™: managed support
The alternative to Design™ for stretched teams: Sterling drafts policies, registers and procedures with your owners and runs the programme to independent review.
Sustain™: after the programme
Periodic control testing, board reporting support and preparation for inspections or audits.
Automate™: Effivity
Your risk registers, policies, audits and incidents run in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Supervisory judgements remain with MAS; audit opinions remain with your auditors.
Often combined with
Standards organisations pair with MAS TRM and outsourcing
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
- Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
- BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
- CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
- COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
Effivity · risk and security management software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the MAS TRM Guidelines.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. For an MAS TRM client, your consultant configures a technology risk workspace within the agreed scope: policies, risk and asset registers, control tests, audits, incidents, third-party reviews, training records and board reporting together. Your security tools do the technical work; Effivity holds the governance record around them. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Roles, policies and board reporting
Accountable owners, approved policies and a record of what the board reviewed and decided.
Technology risk and asset registers
Critical systems and information assets linked to their risks, treatments and review dates.
Project and change records
Security requirements and sign-offs captured as projects and changes move towards release.
Incidents, problems and root causes
Every incident logged with impact, cause and the corrective action that stopped it recurring.
Recovery plans and test results
Recovery objectives, test schedules and results held side by side so shortfalls are visible.
Access reviews and follow-up
Periodic reviews assigned to owners, with the removals and exceptions they produced.
Audit programmes and findings
Internal reviews planned by risk, findings tracked to closure with evidence attached.
Forms and workflows that fit your institution
Fields, approvals and reports configured without code to match your licence and structure.
What this means at the inspection
An inspector asking how you know a critical system can recover in time wants the last test, the gap it found and who fixed it. With Effivity, those records are already linked, dated and owned.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, business continuity, privacy and more when you integrate other standards
Sterling Academy · security e-learning
Give staff, technology teams and directors one view of technology risk.
Sterling Academy offers video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness training so every employee recognises the risks they handle
- Internal auditor training, as applicable to your standard, as part of the engagement
- Completion reports by team, ready for auditors and inspectors
- New joiners trained as they arrive, keeping records current
Keep exploring
Explore more about MAS TRM and outsourcing
MAS TRM resources
Services for MAS TRM and outsourcing
Why Sterling
Want successful MAS TRM compliance? Come to Sterling.
Singapore institutions often run technology across countries and vendors. Sterling builds one framework across all of it, with one engagement team accountable.
60+ countries since 2003
Security, continuity and governance programmes for financial and technology organisations, with offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; third-party testing and audit shown separately.
Guidelines and notices kept apart
Mandatory obligations tracked on their own, so the board always knows what is required and what is good practice.
Expert and experienced consultants
Technology risk specialists who understand your systems before they open the guidelines.
The Sterling Promise
What our MAS TRM compliance success guarantee means
We stay with you until your agreed MAS TRM compliance outcome is achieved, through the gap assessment, remediation and the closure of findings from independent review.
The engagement identifies the instruments, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. MAS retains its supervisory judgement and your auditors their opinions. Our commitment concerns the agreed compliance support, not a promise that no incident or supervisory finding will ever arise.
FAQs
Frequently asked questions about MAS TRM and outsourcing
Are the MAS TRM and outsourcing guidelines mandatory?
No, MAS guidelines are not legally binding, but MAS expects institutions to observe the TRM Guidelines and considers observance when it assesses each institution's risk. The notices on technology risk management and cyber hygiene, and Notices 658 and 1121 on outsourced relevant services, are different: they are binding on the institutions to which they are issued.
Does ISO/IEC 27001 certification mean we comply with MAS TRM?
Not on its own. ISO/IEC 27001 covers much of the security ground, but MAS TRM also expects board oversight, resilience, secure development and online-service controls in its own terms, so map one to the other first.
Do the guidelines apply to a small payment or fintech firm?
Yes, if MAS regulates the firm. The guidelines are applied in proportion to the size, nature and complexity of the institution, so a small licensee sets priorities rather than copying a bank's programme.
We are a technology vendor, not a bank. Why are clients asking about MAS TRM and outsourcing?
Because the institution stays responsible for risk it outsources, and MAS's outsourcing guidelines shape how it selects and oversees you. Expect questionnaires, contract clauses and audit rights; a documented security and continuity framework answers most of them once.
Which MAS outsourcing guidelines apply to our institution?
Banks and merchant banks follow the Guidelines on Outsourcing (Banks) and, for outsourced relevant services, Notices 658 and 1121. Other MAS-regulated institutions follow the Guidelines on Outsourcing (Financial Institutions other than Banks). Both took effect on 11 December 2024. Sustain™ clients hear from us when MAS updates its instruments.
Keep exploring
More on MAS TRM and outsourcing and related standards
More in Financial services, payments & AML
Talk to a consultant
Plan your MAS TRM compliance programme with a clear view of what is mandatory.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice