meta_id 3225839

The Monetary Authority of Singapore (MAS) has issued a consultation paper proposing comprehensive amendments to its Notices on Technology Risk Management across various financial sectors to enhance the technology and operational resilience of financial institutions (FIs). The consultation paper prescribes: IT asset management enhancements requiring FIs to maintain a comprehensive and up-to-date inventory of all IT assets, encompassing hardware, software, cryptographic assets, open-source components, and third-party components. This lifecycle tracking is designed to improve oversight over vulnerability, patch, and technology obsolescence management. IT risk assessment and registers mandating that FIs establish a formal framework to regularly assess system threats—explicitly highlighting risks tied to IT supply chains and the utilization of Artificial Intelligence (AI). FIs must maintain an IT risk register documenting material risks, designated risk owners, and mitigation measures, supported by Key Risk Indicators (KRIs) for active monitoring. Capacity planning frameworks obligating FIs to manage and plan the capacity of all critical systems and their underlying dependencies. The capacity must be mathematically sufficient to withstand projected business growth and unexpected surges in customer traffic. Change management controls enforcing strict measures to block unauthorized system changes and preserve system availability. FIs must conduct risk assessments evaluating upstream and downstream impacts before deploying modifications, carry out rigorous testing for critical systems, and prepare executable change recovery plans. Continuous monitoring and alerts stipulating that critical systems must be monitored continuously to catch security or performance degradation early. This framework must establish clear threshold indicators that automatically trigger structured alerts and corresponding remedial response procedures. Immutable or offline data backups forcing FIs to preserve data critical to business services using an immutable or offline backup strategy. This safeguards essential transaction and operational data against destructive system bugs, human error, or cyber-attacks such as ransomware. Incident management and investigation establishing clear incident management protocols that dictate precise roles, ensure the collection and preservation of forensic evidence, mandate swift escalation to senior management, and standardize proactive communications with affected customers and stakeholders. Unscheduled downtime calculation clarifying that any partial or intermittent disruptions impacting operations or customer services must be explicitly factored into the calculation of a system's total unscheduled downtime. Under the rules, total unscheduled downtime for a critical system remains capped at 4 hours within any 12-month period. Feedback on the proposed amendments may be submitted via this FormSG link by July 31, 2026.