MAS Notice 658 and MAS Notice 1121
Is your financial institution prepared to comply with MAS Notice 658 and MAS Notice 1121?
The Monetary Authority of Singapore issued Notice 658 and Notice 1121 on 11 December 2023, requiring all banks, including merchant banks, to ensure that risks associated with outsourced relevant services are managed by governing engagements between financial institutions and their third-party service providers and suppliers.
Banks and merchant banks operating in Singapore must comply with MAS Notice 658 and Mas Notice 1121 by 11 December 2024.
In this article:
- Understanding MAS Notice 658 and MAS Notice 1121
- Axiom: Your Partner in MAS Notice 658 and MAS Notice 1121 Compliance
- Notice 658 and Notice 1121 FAQ
- Regulatory & Compliance Legal Consultants for Financial Services
In need of experienced legal consultants that can navigate MAS Notice 658 and MAS Notice 1121 requirements?
The MAS has placed greater emphasis on the overall third-party risk management framework and governance processes adopted by banks and merchant banks in relation to outsourced relevant services, requiring third-party engagements to be subject to adequate governance and sound risk management controls.
Axiom can help you find & engage the right regulatory and compliance legal consultants with the relevant knowledge and experience to seamlessly navigate the requirements of MAS Notice 658 and MAS Notice 1121, including supporting the review of contract templates and internal outsourcing policies and protocols to ensure compliance.
Get in Touch With Axiom
Let's discuss your legal department challenges and work together to find the right flexible in-house legal consultants.
* Required
Understanding MAS Notice 658 and MAS Notice 1121
MAS Notice 658 (applicable to banks) and MAS Notice 1121 (applicable to merchant banks) cover “outsourced relevant services,” defined as services integral to any business carried out under the Banking Act of 1970. Depending on their materiality and nature, specific types of arrangements are subject to differing levels of requirements.
Material Ongoing Relevant Outsourced Services
Under the Notices, outsourced relevant services deemed “material” and “ongoing” are subject to the following requirements:
- Due Diligence: All third-party service providers and subcontractors must undergo due diligence before the service is received, and within the first 24 months of receiving the service or at a frequency approved by the institution’s board, whichever is earlier.
- Outsourcing Agreements (entered or renewed after 11 December 2023): Outsourcing agreements must include specific provisions, such as the right of the bank and MAS to audit the service provider and the right of the institution to terminate the agreement in certain circumstances.
- Independent Audits: Independent audits must be conducted on each service at least once every three years or at a frequency approved by the institution’s board.
- Protection of Customer Information: Adequate measures must be implemented to safeguard customer information disclosed to a third-party service provider or subcontractor.
- Customer Consent: Banks and merchant banks must obtain customer consent where sub-contracting arrangements involve customer information.
- Notification of Termination: The MAS must be notified within 14 working days of a bank or merchant bank opting to terminate an outsourcing agreement if the third-party service provider failed or demonstrated deterioration in its ability to safeguard customer information.
Other MAS Notice 658 and MAS 1121 Requirements
Under the Notices, banks and merchant banks carrying out any outsourced relevant services must also comply with the following, regardless of materiality or nature:
- Outsourcing Register: Maintain an inventory of outsourced relevant services to be submitted to MAS semiannually or upon the regulator's request
- Group Policy (for banks or merchant banks in Singapore): Implement a group policy relating to outsourced relevant services for its branches
Finally, banks and merchant banks must adhere to requirements for due diligence, outsourcing agreements, customer consent, and protection of customer information for any outsourced relevant services that involve disclosing customer information, whether or not the service is material and ongoing.
Axiom: Your Partner in MAS Notice 658 and MAS Notice 1121 Compliance
MAS Notice 658 and MAS Notice 1121 will place a significant compliance burden on banks and merchant banks doing business in Singapore at a time when many corporate legal departments face considerable budgetary and headcount pressure.
Axiom can help.
Founded over 20 years ago to meet the unique resourcing needs of modern legal departments, we’re committed to helping our clients control costs, achieve efficiencies, and remain agile in the face of today’s rapidly evolving regulatory landscape. With access to an international network of more than 14,000 high-caliber legal professionals throughout the world, Axiom can connect your organization with one or more regulatory and compliance legal consultants with the relevant knowledge and experience to seamlessly navigate the complex requirements imposed by MAS Notice 658 and MAS Notice 1121:
- Regulatory Compliance Advisory: Provide comprehensive guidance on interpreting and adhering to the new requirements.
- Implementation Support: Assist with implementing the new requirements, including developing an Outsourced Registry, formulating group policies, and reviewing and/or drafting outsourcing agreements.
- Compliance Support: Perform due diligence checks, maintain Outsourced Register, and monitor the performance of outsourced service providers.
- Training and Education: Playbook creation to leverage when educating staff members on the new requirements and their application.
Axiom clients are never asked to compromise their highest standards.
We hire just 3% of lawyers and legal consultants who apply, and each is subjected to a rigorous interview and meaningful background check that requires the submission of at least three references from past supervisors. The attorneys and legal consultants who do make the cut boast an average of 18 years of experience and include many Fortune 500 and Am Law 200 veterans, as well as graduates of a U.S. News & World Report Top 50 Law School.
Our deep bench of legal consultants allows us to craft flexible, bespoke solutions that align with each client’s unique needs, culture, and goals. You can engage an Axiom legal consultant for as long as they're needed on a full- or part-time basis, either onsite or from a remote location. While your team will be responsible for supervising their work, we’ll partner with you throughout the onboarding process to ensure they’re fully meeting your expectations from day one.
MAS Notice 658 and Notice 1121 FAQ
MAS Notice 658 and MAS Notice 1121 are part of a set of directives issued by the Monetary Authority of Singapore to strengthen the regulatory framework for outsourcing arrangements used by financial institutions. The original Guidelines on Outsourcing has been separated into a set of directives which include two notices and two guidelines, comprising of MAS Notice 658 which applies to banks, MAS Notice 1121 which applies to merchant banks, Guidelines on Outsourcing which applies to banks, and Guidelines on Outsourcing which applies to non-bank financial institutions.
The directives set out MAS’ expectations for financial institutions to manage risks of outsourced relevant services.
MAS Notice 658 and MAS Notice 1121 sets out requirements ongoing outsourced relevant services that are material, as well as requirements on outsourced relevant services which involve the disclosure of customer information by banks and merchant banks to service providers. The Guidelines on Outsourcing sets out MAS’ expectations on banks and merchant banks on risk management of outsourcing arrangements and should be read in conjunction with the MAS Notice 658 and MAS Notice 1121 on management of outsourced relevant services for banks and merchant banks.
MAS Notice 658 applies to banks, financial institutions, and other entities regulated by the Monetary Authority of Singapore. This includes both local and foreign banks operating in Singapore.
MAS Notice 1121 applies to all merchant banks in Singapore, including locally incorporated merchant banks and branches of foreign merchant banks in Singapore.
Checks on the following may be considered:
- Maintain an outsourcing register to track all outsourced service providers, whether material or non-material
- Conduct evaluation on outsourced service providers and sub-contractors
- Review outsourcing agreements to include certain terms and conditions
Non-compliance with MAS Notice 658 or MAS 1121 can result in severe penalties, including fines, sanctions, and revocation of the financial institution's operating license in Singapore.
Ready to Connect with Axiom?
Axiom helps the world's top companies and organizations— from mid-market innovators to over half of the Fortune 100— work smarter, mitigate risk more effectively, and make the most of every budgeted dollar without compromising legal outcomes.
If your organization requires compliance assistance with MAS Notice 658 or MAS Notice 1121, we’re ready to help. Axiom’s financial services legal consultants and regulatory compliance legal consultants have deep experience in finance, regulations, compliance, securities, and more.