title: Singapore — Operational Resilience & Critical Infrastructure | World Payments Monitor canonical: https://payments.gi/jurisdictions/singapore/w3/ publisher: Asymmetric Intelligence ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-23 MAS frames operational resilience around four pillars — operational risk, technology & cyber risk, third-party risk, and business continuity management. The Technology Risk Management (TRM) Guidelines (revised January 2021) and Business Continuity Management Guidelines, plus Notices on Cyber Hygiene and outsourcing Notices (658/1121), set supervisory expectations applicable to payment services firms. MAS is actively consulting on enhanced TRM/BCM and Third-Party Risk Management guidelines. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/singapore/) Horizon · 2026 (± a year) MAS enhanced TRM/BCM and Third-Party Risk Management guidelines_Consultation · Tier 1 source_ Standing sub-brief · as of 23 June 2026 271 words · last cycle 2026-06-23 #### Operational Resilience & Critical Infrastructure Singapore frames operational resilience for financial institutions through a four-pillar structure rather than a single consolidated statute. MAS delivers operational risk, technology and cyber risk, third-party risk, and business continuity management through the TRM Guidelines (revised January 2021), the BCM Guidelines, the Cyber Hygiene Notice and outsourcing Notices (658/1121). There is no single DORA-equivalent statute. This is a deliberate regime-specific structure: the absence of a consolidated resilience regulation is a feature of the Singapore approach rather than a silent omission, and it is a structural contrast with the EU DORA regime that multinational PSPs must navigate. Resilience expectations therefore reach payments firms through Guidelines and Notices rather than one binding instrument. Notice 1121 (dated 11 December 2023, effective 11 December 2024) addresses outsourced relevant services for merchant banks. MAS is consulting on enhanced TRM and BCM guidelines and on Third-Party Risk Management expectations, and a CTREX Panel was formed in 2024. The applicability is cross-cutting: both bank PSPs and nonbank PI/EMI operators are subject to these resilience expectations through the Guidelines/Notices channel. The analytical takeaway for W3 is that a multinational operator subject to DORA in the EU faces a structurally different — Guidelines-and-Notices-based — resilience regime in Singapore, with the practical compliance burden delivered through multiple instruments rather than one consolidated rulebook. #### Outlook The forward item is the MAS consultation on enhanced TRM/BCM and Third-Party Risk Management guidelines, expected to land in 2026 at consultation stage and to raise resilience and third-party expectations for FIs including payments firms. No move toward a single DORA-equivalent statute is signalled; the four-pillar, multi-instrument structure is expected to persist. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.mas.gov.sg/regulation/operational-resilience](https://www.mas.gov.sg/regulation/operational-resilience) retrieved 2026-06-23 2. T1 [https://www.mas.gov.sg/regulation/third-party-risk-management](https://www.mas.gov.sg/regulation/third-party-risk-management) retrieved 2026-06-23 3. T1 [https://www.mas.gov.sg/regulation/cyber-security](https://www.mas.gov.sg/regulation/cyber-security) retrieved 2026-06-23 4. T3 [https://www.gieom.com/synopsis-of-the-operational-resilience-guideline-of-mas-monetary-authority-of-singapore/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]](https://www.gieom.com/synopsis-of-the-operational-resilience-guideline-of-mas-monetary-authority-of-singapore/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication])