The Monetary Authority of Singapore (MAS) sets the technology bar for banks and other financial institutions through its Technology Risk Management (TRM) Guidelines. The current edition was published on 18 January 2021.
Two questions come up most for buyers. Where do the guidelines ask for threat intelligence, and where do they ask you to manage third parties? The short answer is clause 12.1 for threat intelligence and clause 3.4 for third-party services. This page maps both, with the exact clauses.
What the TRM Guidelines Are, and What They Are Not
The TRM Guidelines are advisory. They set out the standards MAS expects, but they are not a Notice and do not carry legal force on their own. The clause numbers below are recommendations, not offences.
The statutory cyber-hygiene baseline for banks is a separate instrument, Notice FSM-N06. It replaced the older Notice 655 on 10 May 2024 and sets six mandatory measures, such as securing administrative accounts and multi-factor authentication. FSM-N06 does not require threat intelligence. So the threat-intelligence duty still comes from the advisory TRM Guidelines, not the Notice.
Where Threat Intelligence Sits: Clause 12.1
Threat intelligence lives in Section 12, Cyber Security Operations, at clause 12.1, Cyber Threat Intelligence and Information Sharing. Clause 12.1.1 asks the financial institution to collect, process and analyse cyber-related information for its relevance and potential impact. That information includes cyber events, threat intelligence and system vulnerabilities.
Clause 12.1.2 is the direct line. It states, ‘The FI should procure cyber intelligence monitoring services.’ The same clause asks institutions to join trusted information-sharing arrangements, so they receive timely and actionable threat information.
Two nearby clauses extend the idea. Clause 12.2 covers continuous cyber event monitoring and detection. Clauses 13.4 and 13.5, the Adversarial Attack Simulation Exercise and Intelligence-Based Scenario Design, ask for red-team testing driven by real threat scenarios.
One naming note trips people up. The 2021 edition has no section called Cyber Surveillance. In the current text, the threat-intelligence duty is clause 12.1, so cite that number.
Where Third-Party Risk Sits: Clause 3.4
Third-party technology risk sits in Section 3, Technology Risk Governance and Oversight, at clause 3.4, Management of Third Party Services. Clause 3.4.1 draws an important line. It states, ‘The use of certain third party services by FIs may not always constitute outsourcing.’ A service can hold your confidential customer data without meeting the test for outsourcing, and it is still in scope here.
Clause 3.4.2 asks the institution to assess and manage its technology risk at the third party before signing a contract, not after. Clause 3.4.3 asks it to ensure the third party protects the confidentiality and integrity of its data and keeps its systems resilient.
Outsourcing that does meet the test falls under a separate set of rules. The old 2016 Guidelines on Outsourcing (last revised 2018) were cancelled on 11 December 2024. MAS replaced them with two instruments, the Guidelines on Outsourcing (Banks) and the Guidelines on Outsourcing (Financial Institutions other than Banks), both effective 11 December 2024. That is where the outsourcing register and the materiality assessment live. So two rules can apply to one vendor: clause 3.4 for the technology risk, and the current Outsourcing Guidelines when the arrangement is material outsourcing.
Who Owns It: The Board and Senior Management
MAS puts accountability at the top. Clause 3.1, the Role of the Board of Directors and Senior Management, sets the duty. The board and senior management should have members who can understand and manage technology risks, including risks from cyber threats (clause 3.1.2). Clause 3.1.6 asks them to set the tone from the top and build a strong culture of technology risk awareness.
In practice, a threat-intelligence feed or a vendor-risk report is not IT housekeeping. It is evidence the board is expected to see and act on.
A Plain Map: Clause to Obligation
Here is the two-sided view. The first rows cover the threat-intelligence duty; the later rows cover third parties and oversight. Each row names the real clause.
| Requirement area | MAS clause | What it asks for |
|---|---|---|
| Threat intelligence | TRM 12.1 | Procure cyber intelligence monitoring; join information-sharing |
| Event monitoring | TRM 12.2 | Continuous detection of cyber events |
| Intelligence-led testing | TRM 13.4, 13.5 | Red-team exercises based on real threat scenarios |
| Third-party services | TRM 3.4 | Assess vendor technology risk before contract; require a standard of care |
| Material outsourcing | Outsourcing Guidelines | Outsourcing register and materiality assessment |
| Board oversight | TRM 3.1 | Board and senior management own technology and cyber risk |
| Statutory baseline | Notice FSM-N06 | Six cyber-hygiene measures, not threat intelligence |
What This Means If You Run These Controls
If you are a Singapore financial institution, clause 12.1 is why an outside-in cyber threat intelligence service is more than a nice-to-have. It is the control MAS names for collecting and acting on cyber-related information. A third-party risk management program answers clause 3.4 the same way, by checking a vendor’s exposure before you sign and watching it after.
The pattern is not unique to Singapore. The EU asks for the same discipline through its NIS2 and DORA third-party rules, and Australia through APRA CPS 230 and CPS 234. If you need the groundwork first, start with our threat intelligence 101 guide, then map each control back to its clause.