In this guide · 7 sections
Short answer
MAS consultation P012-2026 proposes adding requirements on IT asset inventories, risk registers, change control, continuous monitoring, immutable or offline backups and incident management to 11 TRM Notices. It closed on 31 July 2026; the proposed start is 12 months after the final Notice is published.
What MAS consultation P012-2026 is
The MAS consultation page lists it as consultation P012-2026, started 10 June 2026 and closed 31 July 2026. The paper proposes amending 11 Notices on Technology Risk Management: FSM-N03, N05, N07, N09, N11, N13, N17, N19, N21, N23 and N25. Each Notice applies to a different type of FI, from licensed insurers to other regulated entities, and they share the same core text.
Notices are legally binding on the FIs they apply to. They sit alongside the broader, non-binding MAS Technology Risk Management Guidelines. Many of the proposals turn practices already described in the Guidelines into hard requirements.
The seven areas MAS wants to strengthen
The paper lists seven key areas, plus a clarification on downtime. Here is what each means in plain terms.
| Area | What MAS proposes FIs must do |
|---|---|
| IT asset management | Keep a complete, current inventory of hardware, software, cryptographic assets, open-source and third-party components |
| IT risk assessment | Run regular risk assessments, including supply-chain and AI-related threats, and keep a risk register with owners and key risk indicators |
| Capacity planning | Make sure critical systems, and the systems they depend on, can handle growth and traffic surges |
| Change management | Prevent unauthorised changes, assess risk before changes, test all changes to critical systems and have rollback plans |
| Continuous monitoring | Monitor critical systems for performance and security issues, with alert thresholds and response procedures |
| Data backup | Keep an immutable or offline backup of data crucial to key business services |
| Incident management | Have a framework with clear roles, evidence preservation, customer communication and prompt senior management notification |
Downtime, recovery and incident reporting timelines
Some existing requirements stay but are tightened. The current Notices already say total unscheduled downtime for each critical system must not exceed 4 hours in any 12 months. MAS observed that some FIs left out partial and intermittent disruptions, so the draft makes clear these must be counted.
The draft Notice text also keeps the familiar timelines that matter most to vendors who run systems for an FI:
- A recovery time objective (RTO) of not more than 4 hours for each critical system.
- Notify MAS as soon as possible, and no later than 1 hour, after discovering a relevant incident.
- Submit a root cause and impact analysis report within 14 days of discovery, unless MAS allows longer.
If you host, support or develop a critical system for an FI, your client cannot meet a 1-hour notification if you tell them the next morning. Expect contracts to set notification times for you that are shorter than the FI's own.
What this means for IT vendors and suppliers to FIs
The Notices bind the FI, not you. But almost every proposal depends on information or behaviour from suppliers, so the requirements will flow down through due diligence questionnaires, contract clauses and audits.
- Asset and component lists. The draft inventory covers open-source and third-party components and lists the parties responsible for maintenance, including external parties. Be ready to give a software bill of materials or at least a dependency list for what you deliver.
- Change control evidence. Show how changes are approved, tested and rolled back, and that nobody can push untested changes to a client's production system.
- Monitoring and alerts. Clients will ask what you monitor, what triggers an alert and how fast you respond.
- Backups that ransomware cannot touch. If you run backups for a client, be ready to explain whether they are immutable, offline or both, and how often restores are tested.
- Incident notification. Agree how and how fast you report incidents, who the contacts are and what evidence you preserve.
The open-source point is not theoretical. Our summary of the npm supply chain attack advisory shows how a compromised package can reach many businesses at once.
How a small IT vendor can prepare now
You do not need the final Notice to start. These steps are useful whatever MAS decides, and they answer the questions FI clients already ask.
List which FI clients and systems you touch
Note which systems a client might class as critical: anything handling transactions or essential customer services.
Build an inventory of what you deliver
Hardware, software versions, cloud services, open-source libraries and certificates, with an owner for each.
Write down your change process
Approval, testing, deployment and rollback. Keep records for each change to a client system.
Check your backups against ransomware
At least one copy should be immutable or offline, and you should have a recent tested restore.
Agree incident contacts and timelines
Given the 1-hour MAS notification, set your own target well inside that and test the call tree.
Watch the MAS site for the final Notice
When it is published, compare it with this list and update contracts within the 12-month window MAS proposed.
For the backup side, our guide to backing up Microsoft 365 and Google Workspace explains immutable and separate-copy options. If you sell cybersecurity services to FIs, also check the cybersecurity service provider licence rules.
Do it yourself or get help?
A one or two person IT shop can do most of this with a shared document and a few hours of discipline. The harder parts are a tested incident plan and evidence that backups would survive ransomware.
Vendor readiness checklist
A Security Health Check (S$290) gives you a written baseline of your own setup, and our Incident & Ransomware Response Plan (S$390) produces the roles, call tree and steps a client's due diligence will ask to see. This is not legal or regulatory advice; FIs should rely on MAS's final text and their own compliance teams.
Frequently asked questions
No. The Notices apply to the financial institutions named in each one, such as licensed insurers. Vendors are affected indirectly, because FIs must meet the requirements for systems that vendors build, host or support. In practice that means contract clauses, questionnaires and audits covering inventories, change control, backups and incident reporting.
MAS proposed that the revised requirements take effect 12 months after the final Notice is published. The consultation closed on 31 July 2026, and as of 18 October 2026 we could not find a final Notice on the MAS website. Industry responses asked for longer or phased timelines, so the final date may differ.
The draft Notice text keeps the requirement to notify MAS as soon as possible and no later than 1 hour after discovering a relevant incident, and to submit a root cause and impact analysis report within 14 days unless MAS allows longer. Vendors supporting critical systems should agree a faster internal notification target with their FI clients.
The draft says FIs must keep an immutable or offline backup of data crucial to relevant business services. MAS asked in the consultation whether both should be required or either should suffice, and whether backup frequency should be prescribed. Industry bodies mostly argued that either should be enough. Check the final Notice once published.
The Notice defines a critical system as one whose failure would cause significant disruption to the FI's operations or materially affect its service to customers, for example a system processing time-critical transactions or providing essential customer services. The FI decides which of its systems meet this test, so ask your client how it classifies the systems you support.