Technology Risk Management for Singapore Insurers: MAS TRM Guidelines

Why Technology Risk Is a Regulatory Priority

For Singapore-licensed insurers, technology risk is no longer a back-office concern. MAS treats technology risk as a core pillar of operational risk management, and its supervisory expectations have become progressively more detailed.

Insurers depend on technology for core insurance functions -- policy administration, claims processing, actuarial modelling, regulatory reporting and customer-facing platforms -- and disruption to any of these carries both operational and reputational consequences. When technology failures affect policyholders or market integrity, the regulator takes notice.

This article outlines what MAS expects of licensed insurers in managing technology risk, and where supervisory attention tends to focus.

The Regulatory Framework

MAS's technology risk expectations for insurers are primarily set out in two instruments.

MAS Notice 655 (Technology Risk Management for Insurers) establishes binding requirements that all insurers licensed in Singapore must comply with. It covers governance, incident reporting, system resilience, access controls and outsourcing oversight. Unlike guidelines, Notice requirements are mandatory -- non-compliance is a regulatory breach.

MAS Technology Risk Management Guidelines provide detailed guidance on implementation. The Guidelines cover the same subject areas as the Notice but go further, setting out MAS's expectations for how technology risk should be identified, assessed, managed and monitored in practice. While the Guidelines are not legally binding, MAS uses them in inspection assessments and expects insurers to be able to demonstrate how they have applied the underlying principles.

Together, these instruments establish a comprehensive framework that applies to licensed insurers of all sizes. Smaller insurers and captives are expected to comply proportionately, but compliance is not optional.

Governance and Board Oversight

MAS expects technology risk governance to start at the board level. The board is responsible for approving the insurer's overall risk appetite for technology risk and for ensuring adequate investment in technology infrastructure and controls.

In practice, this means:

Board-level engagement. The board or a board committee should receive regular reporting on technology risk -- not just operational metrics, but risk indicators, significant incidents, and any changes in the technology risk profile. Technology risk should appear on the board risk register alongside market risk, credit risk and underwriting risk.

Designated technology risk oversight. Many insurers establish a board risk committee or board technology committee with explicit technology risk oversight responsibility. For smaller insurers without dedicated board committees, the full board should be able to demonstrate engagement with technology risk at a substantive level.

Chief Information Security Officer. MAS expects insurers of sufficient scale to have a designated person responsible for information security -- typically a Chief Information Security Officer (CISO) or equivalent. This role should have direct access to senior management and the board.

Technology risk in the ORSA. For insurers subject to Own Risk and Solvency Assessment requirements, technology risk (including cyber risk) should be reflected in the risk assessment and, where material, in the stress scenarios and capital projections.

System Resilience and Recovery

One of MAS's primary concerns in technology risk supervision is service resilience -- the ability of insurers to maintain critical operations during and after a technology disruption.

Recovery time and recovery point objectives. MAS expects insurers to define recovery time objectives (RTOs) and recovery point objectives (RPOs) for critical systems, and to test regularly that these objectives can actually be met. RTOs and RPOs that exist on paper but have never been tested against real recovery scenarios provide limited assurance.

Business continuity planning. The Business Continuity Plan (BCP) must cover technology failure scenarios, not just physical incidents. Technology BCPs should be tested at least annually and the results reported to senior management.

Third-party and cloud dependencies. Insurers increasingly rely on third-party technology providers and cloud infrastructure. MAS expects insurers to maintain visibility of these dependencies and to include them in resilience planning. An insurer that cannot recover from a cloud provider outage because it has no fallback arrangement is exposed to regulatory scrutiny.

Cybersecurity Controls

MAS has consistently identified cybersecurity as a top technology risk priority for the financial sector. For insurers, the key control areas include:

Access management. Privileged access to critical systems should be tightly controlled, regularly reviewed and supported by multi-factor authentication. Shared or generic accounts for privileged access are a recurring finding in regulatory inspections.

Patch and vulnerability management. Systems should be kept current with security patches, and known vulnerabilities should be tracked and remediated within defined timeframes. End-of-life systems that cannot be patched represent a specific regulatory concern.

Incident detection and response. Insurers should have documented procedures for detecting, assessing and responding to cybersecurity incidents. MAS Notice 655 requires prompt notification of MAS for incidents that meet specified severity thresholds.

Penetration testing. MAS expects insurers to conduct regular penetration testing of critical systems, with findings tracked through to remediation.

Technology Outsourcing

Technology outsourcing -- including cloud services, third-party software and managed service arrangements -- creates technology risk that MAS expects insurers to manage actively.

Under MAS's outsourcing guidelines, insurers must conduct due diligence on material technology service providers, include appropriate contractual protections (including audit rights, security standards and data handling requirements), and maintain oversight of ongoing provider performance.

The fact that a function is outsourced does not reduce the insurer's regulatory responsibility for managing the associated risk. MAS expects insurers to understand what their providers are doing and to be able to demonstrate that oversight is genuine.

Incident Reporting to MAS

MAS Notice 655 sets out specific requirements for reporting technology incidents to MAS. Insurers must report significant incidents -- including cyber attacks, major system outages and data breaches -- within defined timeframes. Late or incomplete incident reporting is a compliance failure in its own right.

The incident reporting requirements apply regardless of whether the incident was caused internally or by a third-party service provider. An insurer that experiences a major outage at a cloud provider, for example, must still assess whether the incident meets the reporting thresholds and report accordingly.

Common Findings in Technology Risk Reviews

Technology risk assessments and regulatory inspections for Singapore insurers commonly identify the following gaps:

Incomplete asset inventories. Insurers that do not maintain an accurate, current inventory of their technology assets cannot effectively manage the risk those assets carry.

Untested recovery capabilities. Business continuity and disaster recovery plans that have not been tested against realistic scenarios provide limited confidence in actual recovery capability.

Third-party oversight gaps. Insurers that rely heavily on third-party providers but have limited contractual protections or ongoing oversight mechanisms are exposed.

Weak access control reviews. Privileged access that is not regularly reviewed, or that is shared across multiple users, is a recurring control weakness.

Undocumented incident response. Insurers without clear, documented incident response procedures are likely to handle incidents poorly when they occur, compounding the operational and regulatory impact.

Our enterprise risk management and regulatory licensing teams work with Singapore-licensed insurers on technology risk governance, MAS compliance reviews and preparation for regulatory inspections. If you are assessing your technology risk framework against MAS requirements, our team is available to discuss your specific position.