SingaporeMAS Notice FSM-N05, Technology Risk Management Requirements for Banks
Monetary Authority of Singapore Notice FSM-N05 on Technology Risk Management issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 5, 6 and 9
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to every bank in Singapore, that is a locally incorporated or branch full bank or wholesale bank; reached by declaring that you are a bank.
- Make all reasonable effort to keep critical systems highly available, with no more than 4 hours of unscheduled downtime in total for each critical system in any 12 months (paragraph 5).
- Set a recovery time objective of no more than 4 hours for each critical system, and validate and document at least once every 12 months how you test recovery and when the objective is validated (paragraph 6).
- Implement IT controls to protect customer information from unauthorised access or disclosure (paragraph 9).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Monetary Authority of Singapore, which issues the Notice and supervises banks.
Settledness
- As of
- Open questions
- What penalty does the Financial Services and Markets Act 2022 attach to contravening a notice issued under section 29(1), a provision not read for this row?
What this law does
Paragraph 5 of the Notice requires a bank to make all reasonable effort to maintain high availability for critical systems and to keep unscheduled downtime for each critical system to no more than a total of 4 hours in any period of 12 months. Paragraph 6 requires a bank to establish a recovery time objective of not more than 4 hours for each critical system. Paragraph 9 requires a bank to implement IT controls to protect customer information from unauthorised access or disclosure.
The Notice is issued under section 29(1) of the Financial Services and Markets Act 2022 and applies to all banks in Singapore. The Notice is effective from .
When LexLint raises it
When your app profile says your app is a bank.