MAS issues notices to banks and merchant banks on management of outsourced relevant services

30 January 2024

On 11 December 2023, the Monetary Authority of Singapore (“MAS”) issued Notice 658 on Management of Outsourced Relevant Services for Banks and Notice 1121 on Management of Outsourced Relevant Services for Merchant Banks (collectively, “Notices”). The Notices, which apply to banks and merchant banks (collectively, “Banks”) in Singapore and take effect on 11 December 2024, set out the requirements these entities must comply with for the purposes of managing the risks associated with their outsourced relevant services.

Notices

The Notices set out requirements on:

  • ongoing outsourced relevant services, with a focus on services that are material (i.e. material ongoing outsourced relevant services (“MOORS”)); and
  • outsourced relevant services, including those which are not material or not ongoing, which involve the disclosure of customer information by Banks to service providers.

In conjunction with the publication of the Notices, MAS has also published the Guidelines on Outsourcing (Banks) and FAQ on MAS Guidelines on Outsourcing.

Response to feedback received

This development follows the publication by MAS of a consultation paper seeking feedback on the proposed Notices on 18 December 2020. MAS’ response to feedback received from the consultation was released on 11 December 2023. Highlights of MAS’ response are set out below.

Outsourcing register

MAS had proposed that Banks maintain and keep updated a register of outsourced relevant services (“Outsourcing Register”). In its response, MAS said that it will include non-material services and one-off services that involve disclosure of customer information within the scope of the Outsourcing Register. MAS will require the submission of Outsourcing Registers on a semi-annual basis, and upon request.

Due diligence

After considering the feedback received, MAS will allow Banks to adopt a risk-based approach when determining when to perform the post-commencement due diligence, but it should not be later than 24 months from the engagement of the service provider.

Sub-contracting

Given the risk to Banks from sub-contractors in the supply chain of Banks, MAS will require Banks to assess and be satisfied of their ability to manage the risks involved before allowing sub-contracting of MOORS, and ensure they are notified within a reasonable period of the engagement of a sub-contractor and thereafter assess the sub-contractor.

Term on right of Banks to terminate outsourcing agreement

Following feedback, MAS will streamline the proposed termination grounds. As current industry practice provides safeguards for Banks to exit long-dated outsourcing agreements based on Banks’ risk assessment, MAS will limit the grounds for termination required in outsourcing agreements to the following:

  • by giving reasonable notice to the service provider;
  • if directed by MAS to terminate the outsourcing agreement or to stop receiving the material ongoing outsourced relevant service from the service provider;
  • if the service provider or sub-contractor failed to safeguard the confidentiality or integrity of customer information of the Bank; and
  • if there has been a demonstrable deterioration in the ability of the service provider or sub-contractor to safeguard the confidentiality of customer information.

Confirmations where service provider or sub-contractor is an ORFI and MOORS involves disclosure of customer information

MAS had proposed that where the service provider or sub-contractor is an overseas regulated financial institution (“ORFI”) and disclosure of customer information is involved, Banks are to provide MAS with confirmations from the regulator of the ORFI.

Following feedback, MAS will not proceed with the requirement for confirmations. Instead, for MOORS that involve disclosure of customer information and where the service provider or sub-contractor is an ORFI, Banks will be expected to establish relevant policies and procedures, and be required to provide a written undertaking to notify MAS of any disclosure of customer information to the overseas regulator within 14 working days of such disclosure.

Reference materials

The following materials are available on the MAS website www.mas.gov.sg: