Singapore payment licensees: cyber hygiene and technology risk ready for MAS

MAS cancelled the earlier PSN05 and PSN06 notices with effect from 10 May 2024 and replaced them with notices issued under the Financial Services and Markets Act 2022. Documents written for PSN06 need checking against the new text and updated references.

On the FSM-N14 page MAS lists who it covers: major payment institutions, standard payment institutions, money-changing licensees, and operators and settlement institutions of designated payment systems.

Mandatory and expected

Notices state what a licensee must do. The TRM Guidelines describe themselves as general guidance, and MAS considers the degree of observance with their spirit in supervision. So in our plan, gaps against the notices always come first.

• Administrative accounts (para 4.1): each one secured against unauthorised access or use.
• Security patches (para 4.2): applied within a timeframe that matches the risk of each vulnerability; where no patch exists, compensating controls.
• Security standards (para 4.3): a written set of configurations for every system, and conformity with it.
• Network perimeter (para 4.4): controls that restrict all unauthorised traffic.
• Malware protection (para 4.5) on every system where it is available.
• MFA (para 4.6): for all administrative accounts on critical systems and all accounts used to access customer information over the internet.

Provider-run systems

Paragraph 3.1 lifts a requirement only where the firm can control the system neither directly nor through its provider, and switching provider is unreasonable. We test clouds and SaaS tools against that test and document the conclusion.

The firm needs a process to identify critical systems and must validate and document, at least once every 12 months, how it performs recovery testing and when the RTO was validated. The root cause report covers an executive summary, the root cause analysis, the impact on regulatory compliance, operations and customer service, and the remedial measures.

What we prepare

A list of critical systems with the rationale, a recovery test scenario and record, an incident assessment procedure that reaches the MAS notification decision inside the hour, and a root cause report template built for your systems.

A few expectations that come up most often for payment firms:

• the board and senior management appoint a CIO or head of IT and a CISO or head of information security (para 3.1.3);
• security awareness training runs at least annually for staff, contractors and providers with access to information assets (para 3.6.2);
• internet-facing systems get a penetration test at least once a year and after major changes (para 13.2.4);
• IT audit gives the board an independent view of risk management adequacy (para 15.1.1).

The penetration test is arranged on request with a separate provider; we prepare the scope and take the results into the remediation plan. If you are still applying for the licence, our Singapore licensing team runs the application.

How we work

1. A paid 30-minute consultation and a scope letter: systems, dates, fixed price.
2. Review against FSM-N14, FSM-N13 where it applies and the TRM Guidelines; a person checks every finding.
3. Remediation by us or with your team, then a re-check.
4. An evidence folder mapped to notice paragraphs.