Release of MAS Outsourcing Notices for banks and merchant banks

Banks and merchant banks are required to maintain an outsourcing register, which is an inventory of outsourced relevant services to be submitted to the MAS semi-annually or upon request by the authority.

What should banks and merchant banks do?

• Reassess the scope of third party arrangement based on the definitions in the Notice and the applicability of any current policies to manage these.
• Prepare or reassess the outsourcing register based on the definitions in the Notice and prepare to provide this semi-annually to MAS.

The Notices set out the requirements on ongoing outsourced relevant services focusing on services that are material including requirements on due diligence, sub-contracting, service agreements, protection of customer information, independent audit, service termination and service provider that is an overseas regulated financial institution.

What should banks and merchant banks do?

Perform a self-assessment of sufficiency of existing policies and procedures to meet the Notice requirements for material ongoing outsourced relevant services. Some suggested actions are (but not limited to):

• Defining frequency of due diligence and independent audit, including obtaining necessary Board approval.
  
• Establish protocols to be notified by service providers of sub-contractors and include assessment of risk imposed by sub-contractor to the service before engagement. Consider retrospective assessment and subcontractor involvement in current material ongoing outsourced relevant services.
  
• Revisit customer consent for disclosure of customer information to sub-contractors.
  
• Prepare to comply with outsourcing agreement requirements entered or renewed during and/or after the effective date of 11 December 2024.
  
• Establish process to identify and circumstances that warrant termination, including notification of MAS for specific conditions.
  
• Establish processes and protocols required with intragroup service providers around service agreements, disclosure of customer information to overseas regulators, independent audits, etc.
  

Outsourced relevant service that is not material and not ongoing that involves the disclosure of customer information requires measures around due diligence, outsourcing agreements, protection of access to customer information and termination of services that focus on safeguarding of confidentiality and integrity of customer information.

What should banks and merchant banks do?

Identify and establish processes to manage outsourced relevant services (non-material and non-ongoing) that involve the disclosure of customer information.