Monetary Authority of Singapore Updated Outsourcing Guidelines

The Monetary Authority of Singapore (MAS) introduced new guidelines on outsourcing for financial institutions on 27 July, 2016 (the Guidelines). The Guidelines are the product of extensive industry and public consultation, and supersede the guidelines on outsourcing previously issued in October 2004 (as updated in July 2005).

The Guidelines provide expanded guidance to financial institutions (as defined under s 27A of the MAS Act (Cap. 186)) on the expectations of MAS in relation to prudent risk management practices for outsourcing arrangements. The Guidelines build on the previous version, and reflect the concerns of modern financial institutions operating in markets today.

The Guidelines can be accessed here, and you can also access the Response to Feedback Received on Public Consultation on Guidelines on Outsourcing (MAS Response to Feedback) and the FAQ on MAS Guidelines on Outsourcing (FAQ), which provide further background information and useful clarifications on the Guidelines.

This article provides a brief summary of the key changes and points to take-away from the Guidelines.

1. Application of the Guidelines

The Guidelines apply to all outsourcing arrangements, existing and future. The MAS Response to Feedback provides that institutions are required to conduct a self-assessment of all existing outsourcing arrangements against the Guidelines within three months (by 27 October 2016), and that any deficiencies in existing outsourcing arrangements that were identified in the self-assessment should be should be rectified within twelve months from the issuance of the Guidelines.

2. Removal of the requirement to notify MAS of new outsourcing arrangements

Previously, institutions needed to notify MAS when planning to enter, or of entry, into a material outsourcing arrangement or variations to such arrangement. This requirement has been removed in the Guidelines with immediate effect, demonstrating recognition from MAS that outsourcing arrangements are increasingly common in today's business environment, and that it is neither practical nor efficient to notify MAS of such arrangements. Institutions are still expected to exercise appropriate due diligence on their outsourcing arrangements, and be ready to demonstrate to MAS their observance of the Guidelines.

3. Introduction of a register of outsourcing arrangements

Institutions were previously required to maintain a central record of all material outsourcing arrangements that was readily accessible for review by the board and senior management of the institution. Now, institutions are required to maintain a register of outsourcing arrangements in the form provided in Annex 3 (access here), which must be submitted to MAS at least annually or upon request.

4. Notification of Adverse Developments

The previous guidelines included an obligation to notify of adverse developments that could significantly affect an institution, as well as an obligation to notify MAS of specific events, for example:

The Guidelines now include a general obligation to notify MAS of any adverse development arising from its outsourcing arrangement that could "impact the institution". Such adverse developments include "any event that could potentially lead to prolonged service failure or disruption in the outsourcing arrangement, or any breach of security and confidentiality of the institution’s customer information", including adverse developments encountered within an institution's group and cyber security incidents.

5. The Circular on Information Technology Outsourcing Guidelines (2011) (IT Circular) and the MAS Technology Questionnaire for Outsourcing (2015) (Technology Questionnaire) are superseded

MAS has confirmed (in the FAQ) that the Guidelines supersede the IT Circular and the associated Technology Questionnaire. Institutions no longer need to complete the lengthy Questionnaire, and instead only need to submit the outsourcing register to MAS as detailed at 3 above. We expect that industry will develop its own practical checklists and processes, so that outsourcing arrangements may be appropriately assessed against the Guidelines.

6. Additional and revised definitions

Additional and revised definitions have been included in the Guidelines, providing increased clarity and certainty:

7. Required provisions in the Outsourcing Agreement

The provisions required in outsourcing agreements under the Guidelines are largely the same as required under the previous version of the guidelines, with the addition of the following:

Given the application of the Guidelines to existing outsourcing arrangements, institutions will need to plan to address any gaps in respect of such requirements within 12 months of the issuance of the Guidelines, as detailed at 1 above.

It is worth noting that MAS has removed from the Guidelines the requirement for service providers and subcontractors to provide an indemnity in favour of MAS, in response to feedback provided as part of the public consultation on the draft guidelines.

8. Due diligence (employees of service provider)

The previous guidelines detailed the due diligence evaluation that an institution should conduct on a service provider. The due diligence obligation remains, with additional assessments to be undertaken in relation to the employees of the service provider undertaking any part of the outsourcing arrangement. The guidelines provide examples of what should be considered, including (among others) whether employees have been the subject of any proceedings of a disciplinary or criminal nature, and whether employees have been convicted of any offence.

9. Cloud Computing

The Guidelines include specific guidance on cloud computing in section 6, which describes MAS' position on cloud computing. MAS considers cloud services operated by service providers as a form of outsourcing, and recognises that institutions may leverage on such services to enhance their operations and service efficiency. MAS considers the risks of cloud services are similar to general outsourcing services, however notes that institutions should be aware of characteristics typical to cloud services, such as multi-tenancy, data commingling and the higher propensity for data processing to be carried out in multiple locations.

MAS stresses that institutions are ultimately responsible and accountable for maintaining oversight of cloud services and managing the relevant risks, and should adopt an appropriate and prudent risk management approach.

Herbert Smith Freehills LLP has a Formal Law Alliance (FLA) with Singapore law firm Prolegis LLC, which provides clients with access to Singapore law advice from Prolegis. The FLA allows the two firms to deliver a complementary and seamless legal service.