MAS TRM Guidelines: What Singapore Financial Institutions Must Do for IT Compliance

What Is the MAS TRM Framework?

The Monetary Authority of Singapore (MAS) Technology Risk Management (TRM) Guidelines set baseline cyber and IT risk expectations for all financial institutions operating in Singapore. First issued in 2013 and significantly revised in 2021, the TRM Guidelines are principles-based — not a prescriptive checklist — and MAS uses them to assess IT governance maturity during supervisory engagements.

Who Does It Apply To?

Any entity holding a MAS licence or exemption is expected to demonstrate compliance, including:

• Banks (full, wholesale, digital)
• Insurers and insurance intermediaries
• Capital markets services licensees
• Payment service providers under the Payment Services Act
• Fund managers and trust companies
• Licensed financial advisers

Third-party IT providers serving these institutions are indirectly in scope — MAS expects financial institutions to flow TRM requirements down to vendors through contractual obligations.

The Six Core Areas of MAS TRM

1. IT Governance

The Board must approve the IT strategy and receive briefings on material technology risks at least annually. A Chief Information Officer or equivalent must have the mandate and resources to manage technology risk.

2. IT Risk Management

A technology risk register must be maintained and reviewed quarterly. Annual risk assessments must cover internal systems, third-party dependencies, and cloud services. Risk acceptance must be formally documented.

3. IT Project and Change Management

All material changes to IT systems must follow a formal change management process with documented testing, rollback plans, and approval workflows. Emergency changes must be retrospectively reviewed within 5 business days.

4. IT Service Reliability and Recovery

Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) must be defined for all critical systems and tested at least annually. MAS expects major retail banks to keep critical system downtime under four hours per year.

5. Access Controls and Identity Management

Multi-factor authentication is required for all privileged and remote access. Privileged accounts must be managed through a Privileged Access Management (PAM) solution. Access reviews must occur at least annually and immediately upon role change or termination.

6. Cyber Security

A comprehensive cybersecurity programme is required covering: threat intelligence, vulnerability management, annual penetration testing of internet-facing systems, SOC monitoring, and incident response capability validated through tabletop exercises.

Most Common Compliance Gaps We See

• Patch management cycles exceeding 30 days for critical vulnerabilities
• Privileged access managed through shared admin credentials in spreadsheets — no PAM solution
• A documented DR plan that has never been tested through an actual rehearsal
• Third-party IT vendors without contractual audit rights or SLA reporting obligations
• EDR not deployed across all endpoints, including executive and remote-worker devices
• Cyber incident response plan more than 12 months old and not updated after staff changes

Preparing for a MAS Technology Risk Review

MAS does not announce TRM reviews the way PDPA audits occur. They typically surface during regular supervisory meetings or following a reported incident. Continuous compliance is the only viable preparation:

1. Maintain a living technology risk register reviewed quarterly
2. Keep all IT policies version-controlled and accessible for review
3. Retain evidence of access reviews, vulnerability scans, and patch cycles
4. Ensure all critical vendors have signed your IT security addendum with audit rights
5. Conduct at least one annual DR/BCP drill with documented results and remediation actions

AGR Networks works with Singapore financial institutions as a managed IT and infrastructure partner, supporting patch management, PAM implementation, annual vulnerability assessments, and IT risk reporting for Board submissions. Speak with our team about your TRM programme.