Notice FSM-N21 Technology Risk Management¶
Overview¶
MAS Notice FSM-N21 on Technology Risk Management is effective from 10 May 2024. It applies to specified financial institutions regulated under the Financial Services and Markets Act 2022 (FSMA). The notice replaced earlier sector-specific TRM notices (e.g., Notice CMG-N02, which was cancelled with effect from 10 May 2024).
Scope and Applicability¶
FSM-N21 applies to Capital Markets Intermediaries (CMIs) including holders of Capital Markets Services (CMS) licences, exempt entities, and other specified financial institutions under the FSMA. Licensed Financial Advisers are covered under the parallel Notice FSM-N23.
Non-compliance with Notice FSM-N21 is legally enforceable under the Financial Services and Markets Act 2022, with MAS having authority to impose penalties for non-compliance.
Key Requirements¶
1. Critical Systems Framework¶
Financial institutions must implement a framework and process to identify critical systems and make all reasonable efforts to maintain high availability for critical systems.
2. Recovery Time Objective (RTO)¶
Establish a recovery time objective (RTO) of no more than 4 hours for each critical system.
3. Incident Notification¶
Notify the Authority no more than one hour after discovering a relevant incident.
4. Root Cause Analysis Reporting¶
Submit a root cause and analysis report to the Authority no more than 14 days from the incident's discovery.
5. IT Controls¶
Implement IT controls to protect customer information against unauthorised access or disclosure.
6. Wider Scope vs. Previous Notices¶
The TRM requirements under the FSMA are enhanced to address growing technology risks including cyber security risks, with: - A wider scope of systems and activities subject to TRM requirements - MAS empowered to impose TRM requirements on any system that poses contagion cyber risk as they are interlinked to other systems of the FIs
Background: 2024 FSMA Technology Risk Harmonisation¶
On 10 May 2024, the provisions in the Financial Services and Markets Act 2022 (FSMA) on Technology and Risk Management, Control and Resolution of Financial Institutions commenced. MAS issued a harmonised set of new Notices on Technology Risk Management (TRM) and Cyber Hygiene to all regulated financial institutions, including: - Banks, finance companies, merchant banks - Insurers and insurance agents, insurance brokers - Capital markets financial institutions (FSM-N21) - Licensed financial advisers (FSM-N23) - Licensed trust companies - Digital payment token service providers
The FSMA empowers MAS to impose harmonised TRM requirements on all financial institutions for: - Management of technology risks including cyber security risks - Safe and sound use of technology to deliver financial services - Safe and sound use of technology to protect data
FAQs¶
MAS has published a dedicated FAQ document on the Notice on Technology Risk Management, available at: https://www.mas.gov.sg/regulation/faqs/faqs---notice-on-technology-risk-management