#
MAS frames operational resilience around four pillars — operational risk, technology & cyber risk, third-party risk, and business continuity management. The Technology Risk Management (TRM) Guidelines (revised January 2021) and Business Continuity Management Guidelines, plus Notices on Cyber Hygiene and outsourcing Notices (658/1121), set supervisory expectations applicable to payment services firms. MAS is actively consulting on enhanced TRM/BCM and Third-Party Risk Management guidelines.
Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →
Resilience expectations therefore reach payments firms through Guidelines and Notices rather than one binding instrument. Notice 1121 (dated 11 December 2023, effective 11 December 2024) addresses outsourced relevant services for merchant banks. MAS is consulting on enhanced TRM and BCM guidelines and on Third-Party Risk Management expectations, and a CTREX Panel was formed in 2024. The applicability is cross-cutting: both bank PSPs and nonbank PI/EMI operators are subject to these resilience expectations through the Guidelines/Notices channel.
The analytical takeaway for W3 is that a multinational operator subject to DORA in the EU faces a structurally different — Guidelines-and-Notices-based — resilience regime in Singapore, with the practical compliance burden delivered through multiple instruments rather than one consolidated rulebook.
Outlook
The forward item is the MAS consultation on enhanced TRM/BCM and Third-Party Risk Management guidelines, expected to land in 2026 at consultation stage and to raise resilience and third-party expectations for FIs including payments firms. No move toward a single DORA-equivalent statute is signalled; the four-pillar, multi-instrument structure is expected to persist.
no periodic updates on record for this sub-brief
Sources and findings (4)
- T1https://www.mas.gov.sg/regulation/operational-resilienceretrieved
- T1https://www.mas.gov.sg/regulation/third-party-risk-managementretrieved
- T1https://www.mas.gov.sg/regulation/cyber-securityretrieved
- T3https://www.gieom.com/synopsis-of-the-operational-resilience-guideline-of-mas-monetary-authority-of-singapore/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]