Introduction
In 2016, the Monetary Authority of Singapore (MAS) issued revised Guidelines on Outsourcing (Outsourcing Guidelines 2016) to financial institutions.
The Outsourcing Guidelines 2016 applied to all financial institutions under the Monetary Authority of Singapore Act, including retail and merchant banks, insurers, trust companies and payment services providers.
Two new sets of guidelines
In 2023, the MAS issued two new sets of guidelines: Guidelines on Outsourcing (Banks) (the New Bank Guidelines) and Guidelines on Outsourcing (Financial Institutions other than Banks) (the New FI Guidelines). These set out MAS’ expectations for both banks and financial institutions (FIs) that are not banks with regard to their outsourced services. While the New Bank Guidelines apply to retail and merchant banks, the New FI Guidelines apply to any financial institution as defined in Section 2 of the Financial Services and Markets Act 2022 other than a retail and merchant bank. In other words, financial institutions other than banks (FIOBs) include finance companies, insurers, insurance intermediaries, financial advisers, payment services providers, trust companies, financial holding companies and credit card issuers.
It should also be noted that the Outsourcing Guidelines 2016 remain in effect until 10 December 2024; thereafter the two new guidelines will come into effect. We have written a client update on the New Bank Guidelines on 20 December 2023.
Key changes for non-bank financial institutions
Non-bank financial institutions should already be complying with the Outsourcing Guidelines 2016, and many of the obligations under the Outsourcing Guidelines 2016 will remain in place under the New FI Guidelines. However, the New FI Guidelines have introduced further changes and guidance for FIOB/s to manage risks arising from their outsourcing, such as:
- Where the MAS is not satisfied with the FIOB’s observance of the guidelines, it could require the FIOB to pre-notify the MAS of new material outsourcing arrangements.
- FIOBs may adopt a risk-based approach to determine the frequency for the re-performance of due diligence for outsourcing arrangements.
- Outsourcing agreements no longer need to contain recovery time objectives or recovery point objectives, but FIOBs should still verify that the service provider has satisfactory business continuity plans (BCPs) in place and that recovery objectives can be met.
- An FIOB should involve its service providers, where applicable, in the testing of its own BCPs, and the FIOB could also take part in its service providers’ business continuity tests.
- FIOBs should conduct periodic assessments to assess the service provider’s ability to perform its internal audit function satisfactorily. These can include assessments aligned with the Quality Assurance and Improvement Program under the International Standards for the Professional Practice of Internal Auditing.
The New FI Guidelines also set out in Annex 1 outsourced services exempted from the New FI Guidelines. These include:
- Services wholly provided by the Government Technology Agency (GovTech) or agents appointed by GovTech; and
- services that are not for the conduct of any financial business of the FIOB and where the service provider does not receive, handle or have access to the FIOB’s confidential or customer information. Examples include cleaning, gardening and pantry services.
Banks vs non-bank financial institutions
From 11 December 2024, there will be certain differences between the regimes for banks’ material ongoing outsourced relevant services (MOORS) and for non-bank financial institutions’ material outsourcing arrangements. The most significant differences are set out by category in the table available for download below.
Conclusion
Overall, while the New FI Guidelines are similar in some respects to the Outsourcing Guidelines 2016, the New Bank Guidelines have imposed more specific requirements for the outsourcing agreements and sub-contracting of MOORS by banks. In comparison, FIOBs are subject to comparatively lighter obligations with respect to their material outsourcing arrangements. In preparation for the new regimes, which come into effect in December 2024, all FIOBs should reassess their current outsourcing arrangements as well as their processes for procuring and evaluating their outsourcing arrangements.
Client Alert 2024-030
