Singapore's MAS Consults on Tighter Technology Risk Rules for Financial Firms

The Monetary Authority of Singapore has proposed amendments to its Notices on Technology Risk Management, seeking to reinforce financial institutions' technology resilience amid rapid digitalisation and an evolving threat landscape. Through a consultation paper, the regulator set out changes intended to sharpen expectations across key areas including IT asset management, IT risk assessment and monitoring, change-management controls, and data backup and recovery. The move reflects growing supervisory concern that as banks, insurers and other financial firms rely ever more heavily on digital systems, third-party providers and cloud infrastructure, the potential impact of outages, cyberattacks and operational failures on customers and the wider system also rises. Strengthening the rules is designed to ensure that institutions can prevent, detect and recover from technology disruptions, and that critical services remain available. The consultation invites industry feedback before the measures are finalised. It forms part of a broader effort by the authority to keep Singapore's financial sector secure and competitive as a regional hub, complementing its work on artificial intelligence governance, cyber resilience and operational risk, and signalling that technology risk oversight remains a central supervisory priority.