What Are the MAS Technology Risk Management (TRM) Guidelines?

What do the MAS Technology Risk Management (TRM) Guidelines require? They are the technology risk management practice guidelines issued by MAS on 18 January 2021, covering board oversight, third-party services, system testing, disaster recovery, access control and cryptographic key management, among other areas. The guidelines themselves are not legally binding, but for licensed institutions providing digital payment token services, MAS has separate legally binding notices that set hard requirements on matters such as system availability and incident reporting.

Which Institutions Do the TRM Guidelines Apply To?

The TRM Guidelines apply to all financial institutions regulated by MAS, including Major Payment Institutions and Standard Payment Institutions. Paragraph 2.2 of the guidelines states that the extent to which an institution implements the guidelines should be commensurate with the risk and complexity of its financial services, and whether the institution observes the spirit of the guidelines is one of the factors MAS takes into account.

Two notices are legally binding. The Notice on Technology Risk Management (FSM-N13) has applied since 6 November 2024 to payment services licensees providing digital payment token services: the total unscheduled downtime of each critical system must not exceed 4 hours in any 12-month period, and the recovery time objective must not exceed 4 hours; after discovering a relevant incident, the licensee must notify MAS as soon as possible and no later than 1 hour, and submit a root cause and impact analysis report within 14 days. The Notice on Cyber Hygiene (FSM-N14) applies to all payment services licensees, covering administrative accounts, security patches, network perimeter defence, malware protection and multi-factor authentication.

What Do the TRM Guidelines Require on Governance and Third-Party Risk?

Section 3 of the guidelines requires the board and senior management to ensure that internal controls and risk management are implemented effectively, and to establish a technology risk management strategy. On third-party services, the guidelines note that not all third-party services constitute outsourcing, but institutions must still assess and manage the risks to the confidentiality, integrity and availability of IT systems and data held at third parties. Where a service does constitute outsourcing, it must also be handled under the MAS Outsourcing Guidelines.

On access control, Section 9 requires applying the principles of “never alone”, “segregation of duties” and “least privilege”, with privileged access granted only when necessary. MAS’s consumer protection guidelines for digital payment token service providers (PS-G03) also cite these three principles and require restricting any single individual from authorising and executing the transfer or withdrawal of customer assets alone, which matches the design logic of a transfer approval workflow.

What Do the TRM Guidelines Require on Key Management?

Section 10 requires cryptographic key management policies, standards and procedures covering key generation, distribution, installation, renewal, revocation, recovery and expiry. Specifically, keys should be stored in hardened, tamper-resistant systems, such as hardware security modules; each key should be used for a single purpose only; if a key is compromised, it and all keys that may be affected must be revoked and replaced; destroyed keys must be unrecoverable; and key backups must be kept for recovery and given a high level of protection.

For the safeguarding of customer assets, PS-G03 also requires digital payment token service providers to keep the credentials for at least 90% of customer assets in systems that are not connected to the internet at all times, and encourages them to consider a higher proportion. When deciding the split between hot and cold wallets, businesses can draw on how businesses should split funds between hot and cold wallets.

What Do the TRM Guidelines Require on System Testing and Disaster Recovery?

Section 5.7 requires a test plan to be drawn up and approved before testing, with testing covering business logic, system functions, security controls and system performance; unit testing, system integration testing and user acceptance testing should take place in segregated environments, and regression testing should be carried out after changes. Paragraph 13.2.4 also requires penetration testing of systems at least once a year or when there are major changes.

On disaster recovery, paragraph 8.3.1 requires the disaster recovery plan to be tested regularly to validate its effectiveness, while FSM-N13’s 4-hour recovery time objective for critical systems is a hard requirement. For wallet systems, this means rehearsing how to recover from a service disruption or the loss of keys or key shards, and the design of the response process is covered in how businesses should build a crypto incident response plan.

Conclusion

The MAS TRM Guidelines provide an overall framework for technology risk management, while FSM-N13 and FSM-N14 set legally binding requirements on availability, incident reporting and cyber hygiene for payment services licensees. For digital payment token service providers, the priorities are key management, segregation of duties, the cold storage ratio and disaster recovery drills, while the requirements of the license itself are set out in an overview of the DPT license in Singapore.