What Are the MAS Outsourcing Guidelines?

What do the MAS Outsourcing Guidelines require of institutions that use third-party service providers? The core principle fits in one sentence: outsourcing does not diminish the obligations of an institution, its board and senior management to comply with Singapore laws and regulations. On this basis, the guidelines require institutions to assess the materiality of their outsourcing, conduct due diligence on service providers, set out more than ten key terms in the contract, and put business continuity and exit arrangements in place. Singapore-licensed institutions that use third-party wallet, custody or cloud services all fall within these requirements.

Which Institutions Do the MAS Outsourcing Guidelines Apply To?

MAS has issued two sets of outsourcing guidelines, both effective from 11 December 2024. One applies to banks and merchant banks and is accompanied by the legally binding MAS Notices 658 and 1121; the other applies to financial institutions other than banks and was revised on 24 January 2025. The institutions listed in the non-bank version include Major Payment Institutions (MPIs) and Standard Payment Institutions (SPIs), and payment services licensees that provide Digital Payment Token Service are also covered.

Paragraph 1.1 of both guidelines says the same thing: outsourcing does not diminish the obligations of an institution, its board and senior management to comply with the relevant laws and regulations in Singapore. An institution can hand day-to-day operations to a service provider, but oversight and governance responsibility stays with the institution. The same is true in other jurisdictions, as a comparison of who is responsible for compliance when using a third-party wallet provider shows.

What Counts as Material Outsourcing?

The non-bank guidelines define an “outsourcing arrangement” as one in which a service provider provides a service that the institution could otherwise perform itself, and either the institution depends on that service on an ongoing basis or the service is integral to the provision of a financial service. “Material outsourcing” refers to an arrangement that, if disrupted or subject to a security breach, could have a material impact on the institution’s business operations, reputation or profitability, or one involving customer information whose compromise could have a material impact on customers. The equivalent concept in the bank version is “material ongoing outsourced relevant services” (MOORS).

Cloud services count as outsourcing too: an annex to the guidelines states explicitly that MAS regards cloud services operated by service providers as a form of outsourcing. For institutions providing digital payment token services, handing customer asset wallets and signing to a third party usually means assessing against this standard whether the arrangement is material outsourcing.

What Is Required When Selecting and Managing Service Providers?

The first requirement is due diligence. The guidelines require institutions to consider the service provider’s physical and IT security controls, business reputation and financial strength, including its ethical and professional standards; the bank version also requires assessing whether the service provider can perform the service with the same high standard of care as if the bank were providing it itself.

The second is ongoing management. For material outsourcing, institutions must maintain an outsourcing register and keep it readily accessible; non-bank institutions must also submit the register using the specified template at least once a year, or whenever MAS requests it. If an adverse development arises in the outsourcing that could affect the institution, MAS should be notified as soon as possible.

The third concerns overseas service providers. Institutions should not enter into an outsourcing arrangement with a service provider located in a jurisdiction that may hinder MAS’s timely access to information. For the specific questions to ask when assessing a wallet provider, institutions can apply the six criteria for choosing a secure Wallet-as-a-Service provider.

What Should Contracts and Exit Arrangements Cover?

The guidelines require outsourcing contracts to cover at least the following: the scope of the outsourcing; performance, operational, internal control and risk management standards; confidentiality and security; business continuity management; monitoring and control; audit and inspection; notification of adverse developments; dispute resolution; default termination and early exit; and applicable laws. Where the service provider uses subcontractors, the institution must still retain the ability to monitor and control. For material outsourcing, the contract should also allow the institution to audit the service provider and its subcontractors, and require the service provider to respond promptly to requests from MAS or the institution for reports on its security and control environment.

Exit also needs to be planned in advance. The guidelines require institutions to ensure that business continuity is not compromised by outsourcing and that they have the right to terminate the contract in situations such as default. For wallet and custody services, this means the contract should spell out how keys and assets will be migrated after termination, and the points to watch during a wallet migration are covered in migrating from an in-house wallet to WaaS.

Conclusion

The key points of the MAS Outsourcing Guidelines are that responsibility always remains with the institution, that material outsourcing must go through due diligence, contractual safeguards, registration and ongoing monitoring, and that exit arrangements must be prepared in advance. Institutions using third-party wallet or custody services in Singapore also need to meet the requirements of the MAS Technology Risk Management Guidelines.