MAS Third-Party Risk Management

• MAS Guidelines on Outsourcing for Banks
• MAS Guidelines on Outsourcing for Financial Institutions other than Banks
• MAS Guidelines on Risk Management Practices - Technology Risk

MAS states that the Guidelines on Outsourcing for financial institutions other than banks are effective on 11 December 2024 and apply to all financial institutions except banks and merchant banks. MAS describes the Technology Risk Management Guidelines as risk management principles and best practices for sound technology risk governance and IT and cyber resilience.

MAS wants financial institutions to remain responsible for regulated activities even when work is performed by another party. Outsourcing can reduce cost, speed delivery, or give access to specialist technology, but it can also create operational, technology, confidentiality, conduct, concentration, and resilience risk.

The MAS approach is practical: know what you outsource, decide what is material, perform due diligence, put the right contract terms in place, monitor the arrangement, understand subcontracting, protect confidential information, keep audit and access rights, maintain continuity, and plan for exit. For technology services, that same logic connects to cyber controls, cloud dependency, incident response, system resilience, and technology governance.

The page is for MAS-regulated financial institutions and the teams that run outsourcing, technology risk, cyber security, business continuity, procurement, legal, compliance, privacy, and internal audit. Scope depends on the license type and the specific MAS notice or guideline that applies to the institution.

Service providers also need to care because MAS-regulated customers will ask for evidence that the provider can support confidentiality, audit access, subcontractor control, continuity, incident response, monitoring, and exit.

For outsourcing and third-party governance, teams should be able to show:

• an outsourcing framework approved and owned at the right level;
• a current outsourcing register, including materiality and ownership;
• documented assessment of whether an arrangement is material;
• due diligence before outsourcing and when risk materially changes;
• contracts with confidentiality, security, audit, access, subcontracting, business continuity,

termination, and exit protections;

• oversight of subcontractors and downstream dependencies;
• monitoring of service performance, controls, incidents, issues, renewals, and provider changes;
• business continuity and exit planning for material arrangements;
• reporting that lets senior management understand risk, exceptions, and unresolved remediation.

For technology-heavy arrangements, the same record should connect to technology risk: systems used, data handled, cloud or hosting model, privileged access, recovery requirements, cyber evidence, incident support, and resilience testing.

The most common operating mistake is to split MAS work into disconnected files: procurement keeps the contract, information security keeps the assessment, legal keeps the clauses, business continuity keeps the plan, and the business owner keeps the actual provider relationship. That makes it hard to answer simple questions: Is this arrangement material? Who owns it? Which subcontractors matter? Is confidential data involved? What happens if the provider fails? When was the last review? What changed since approval?

A better MAS operating model gives every outsourcing arrangement a single record of truth. It should show the service, provider, owner, materiality rationale, contract, locations, data, technology dependencies, subcontractors, control evidence, monitoring status, open issues, approvals, and exit readiness.

• Outsourcing policy, governance framework, and approval matrix.
• Outsourcing register with materiality, owner, service, provider, jurisdiction, data, technology,

subcontractor, and review fields.

• Materiality assessments and due diligence records.
• Contract review evidence for MAS-relevant clauses.
• Confidentiality, data protection, audit, access, cyber, and continuity evidence.
• Monitoring records, performance issues, incidents, provider changes, and remediation.
• Business continuity and exit plans for material outsourcing.
• Management or board reporting on material arrangements, exceptions, and unresolved risk.

• The outsourcing register exists but does not include enough detail to run the program.
• Materiality decisions are inconsistent across business units.
• Subcontractors are known at onboarding but not refreshed when providers change their delivery

model.

• Contract review is not tied to ongoing monitoring.
• Exit plans are high-level and do not describe the actual replacement path, data movement,

transition support, or customer impact.

• Technology and outsourcing reviews are performed separately even when the service is a critical

technology dependency.

Halbarad helps MAS-regulated teams turn outsourcing and technology-risk expectations into a living operating record.

Halbarad can help teams:

• build and maintain outsourcing registers with materiality, owner, evidence, subcontractor,

monitoring, approval, and exit fields;

• use Spark Assessment to create an initial provider view from public evidence, trust centers,

attestations, incident history, and framework mappings;

• use Nth-Party Discovery to identify subcontractors, fourth parties, fifth parties, downstream

providers, and concentration exposure;

• use Continuous Monitoring to watch provider incidents, outages, advisories, status-page changes,

trust-center updates, and material-change signals;

• manage DDQs, contract evidence, approval routing, residual risk, issues, remediation, reporting,

and audit trail through Governance workflows.

Halbarad helps operationalize and evidence the work. It does not replace MAS guidance, legal interpretation, or institution-specific compliance judgment.