Notice FSM-N23 — Notice on Technology Risk Management (Licensed Financial Advisers)¶

Back to Technology & Cyber

Previous Next

MAS Notice No.: FSM-N23

Notice to licensed financial advisers

Financial Services and Markets Act 2022

Issue Date: 09 May 2024

NOTICE ON TECHNOLOGY RISK MANAGEMENT¶

Introduction¶

1 This Notice is issued pursuant to section 29(1) of the Financial Services and Markets Act 2022 (the "Act") and applies to all financial advisers licensed under the Financial Advisers Act 2001 ("licensee").

Definitions¶

2 For the purpose of this Notice—

"critical system" in relation to a licensee, means a system, the failure of which will cause significant disruption to the operations of the licensee or materially impact the licensee's service to its customers, such as a system which—

(a) processes transactions that are time critical; or

(b) provides essential services to customers;

"IT security incident" means an event that involves a security breach, such as hacking of, intrusion into, or denial of service attack on, a critical system, or a system which compromises the security, integrity or confidentiality of customer information;

"relevant incident" means a system malfunction or IT security incident, which has a severe and widespread impact on the licensee's operations or materially impacts the licensee's service to its customers;

"system" means any hardware, software, network, or other information technology ("IT") component which is part of an IT infrastructure;

"system malfunction" means a failure of any of the licensee's critical systems.

3 Except where defined in this Notice or if the context otherwise requires, the expressions used in this Notice have the same meanings as in the Act.

Technology Risk Management¶

4 A licensee must put in place a framework and process to identify critical systems.

5 A licensee must make all reasonable effort to maintain high availability for critical systems. The licensee must ensure that the maximum unscheduled downtime for each critical system that affects the licensee's operations or service to its customers does not exceed a total of 4 hours within any period of 12 months.

6 A licensee must establish a recovery time objective ("RTO") of not more than 4 hours for each critical system. The RTO is the duration of time, from the point of disruption, within which a system must be restored. The licensee must validate and document at least once every 12 months, how it performs its system recovery testing and when the RTO is validated during the system recovery testing.

7 A licensee must notify the Authority as soon as possible, but not later than 1 hour, upon the discovery of a relevant incident.

8 A licensee must submit a root cause and impact analysis report to the Authority, within 14 days or such longer period as the Authority may allow, from the discovery of the relevant incident. The report must contain—

(a) an executive summary of the relevant incident;

(b) an analysis of the root cause which triggered the relevant incident;

(c) a description of the impact of the relevant incident on the licensee's—

i. compliance with laws and regulations applicable to the licensee;

ii. operations; and

iii. service to its customers; and

(d) a description of the remedial measures taken to address the root cause and consequences of the relevant incident.

9 A licensee must implement IT controls to protect customer information from unauthorised access or disclosure.

Effective Date¶

10 This Notice shall take effect on 10 May 2024.

Background: 2024 FSMA TRM Harmonisation¶

On 10 May 2024, the Financial Services and Markets Act 2022 (FSMA) provisions on Technology and Risk Management commenced. MAS issued a harmonised set of new TRM Notices to all regulated FIs. For Licensed Financial Advisers, FSM-N23 is the governing TRM notice, replacing the prior FAA-N18.

Notice FAA-N18 (Technology Risk Management for Financial Advisers) was cancelled with effect from 10 May 2024.

FSM-N21: TRM for Capital Markets Intermediaries (CMIs)
FSM-N24: Cyber Hygiene for Licensed Financial Advisers (companion notice)
FSM-N22: Cyber Hygiene for CMIs
Notice FAA-N18: Cancelled predecessor to FSM-N23 (effective 10 May 2024)

FAQ Reference¶

MAS FAQ on the Notice on Technology Risk Management: https://www.mas.gov.sg/regulation/faqs/faqs---notice-on-technology-risk-management

Source¶

MAS PDF: https://www.mas.gov.sg/-/media/mas-media-library/regulation/notices/trpd/notice-fsm-n23/mas-notice-fsm-n23.pdf
Source capture date: 2026-05-02 (Loop 103 Wave B)