MAS Proposes Tougher Technology Risk Notices for Insurers, Banks and Other Firms: Asset Inventories, Immutable Backups and Counting Partial Outages Toward the Four-Hour Downtime Limit

Singapore's financial regulator wants regulated firms to tighten how they manage technology risk, from the way they track their systems to how they back up data and count outages. According to an analysis by the law firm Rajah & Tann Asia dated July 17, 2026, the Monetary Authority of Singapore (MAS) consulted on amendments to its Notices on Technology Risk Management, inviting submissions by July 31, 2026. The proposed requirements would take effect 12 months after the finalised Notices are published, so firms would have a year to adapt.

The Notices apply to a wide range of institutions. The Rajah & Tann article lists the current framework as covering licensed insurers (Notice FSM-N03), banks, credit card or charge card licensees, finance companies, merchant banks, payment system operators, settlement institutions and digital payment token service licensees, licensed credit bureaus, registered insurance brokers, capital markets institutions, licensed financial advisers and licensed trust companies. The article lists FSM-N03 as applicable but does not say how the proposals affect insurers differently from other institutions.

The proposals touch several areas. On IT asset management, firms would keep a current inventory of IT assets, including hardware, software, cryptographic assets, open-source components and third-party components. A complete inventory is the basis for knowing what needs patching or replacing, and the inclusion of cryptographic and open-source assets reflects concerns about hidden dependencies. On risk assessment and monitoring, firms would carry out regular assessments and mitigate risks in proportion to their severity, maintain a risk register listing material risks, risk owners and mitigation measures, and track key risk indicators. The article links this to supply-chain and AI-related threats.

Capacity planning is another proposal: critical systems, and the systems they depend on, should have enough capacity for business needs, growth and surges in customer traffic. Change management rules would require firms to prevent unauthorised changes, assess change risks before implementation, including upstream and downstream effects, test changes to critical systems and have recovery measures ready. Firms would monitor critical systems continuously, with defined alert thresholds and response procedures.

Backups receive particular attention. Firms would keep immutable or offline backups of data that is crucial to business services. Immutable backups cannot be altered or deleted once written, and offline backups are disconnected from the network, so both protect against ransomware that encrypts or destroys data. For incident management, firms would define roles and responsibilities, preserve evidence, communicate with stakeholders and customers, and promptly notify senior management.

One proposal concerns the way downtime is counted. The current framework limits unscheduled downtime to four hours per critical system in any 12-month period. MAS proposes that partial or intermittent disruptions count toward this total. In practical terms, a system that is slow, available to only some customers or repeatedly dropping would use up part of the allowance even if it never fully stops, which closes a gap that might otherwise let firms report systems as "up" while customers struggle.

MAS asks nine consultation questions. Among them, according to the article, are whether backups should be both immutable and offline, whether backup frequency should be prescribed, and whether the term "partial or intermittent disruption" is clear enough. Those questions show where the regulator expects debate: how prescriptive the rules should be, and how to define a partial outage objectively.

The article is explicit about what it does not cover. It does not describe incident reporting timelines to MAS, recovery time objectives, or specific outsourcing and third-party requirements, other than mentioning supply-chain risk in the context of risk assessment. Readers who need those details should consult the full consultation paper.

The proposals come at a time of growing concern about concentration in technology services. A recent outage of Google Cloud's London region disrupted UK banking services on October 20, 2026, and shows how a single provider's failure can spread. The Singapore proposals do not mention that event, which happened after the consultation closed, but they address the same question, how firms can keep critical services running when technology fails, and they require firms to understand and monitor their dependencies.

It is also worth noting how the Notices relate to the rest of the regulatory system. MAS already sets technology risk expectations in guidelines, and the Notices make certain requirements binding. Because the same Notice family covers banks, payment firms, insurers, brokers and advisers, a change in one place affects very different businesses: a large bank with hundreds of critical systems and a small insurance broker with a handful. The consultation's questions on how prescriptive to be, for example on backup frequency, reflect the difficulty of writing rules that are meaningful for the largest firms and proportionate for the smallest. Industry responses, which were due by July 31, will show how much flexibility firms seek.

What should firms do? Compliance teams will want to review their asset inventories and confirm they capture cryptographic and third-party components, check that backups meet the immutability or offline standard, and revisit how they measure downtime. Because the effective date is 12 months after publication of the final Notices, there is time to plan, but the final text may differ from the proposals in light of feedback. For customers, the aim is more dependable digital services. For the industry, the cost is more documentation, testing and monitoring, which may fall more heavily on smaller firms.