MAS Notices on Technology Risk Management (TRM Notices)
Is this legally binding?
Binding, sectoral. Binding, but only for a defined population: one regulated sector, or the federal government and the vendors it buys from.
Legally binding notices under s.29(1) Financial Services and Markets Act 2022, imposing technology risk management requirements on specified classes of financial institutions: critical-system identification, 4-hour maximum annual unscheduled downtime, 4-hour RTO, 1-hour incident notification to MAS, 14-day root cause report, and IT controls protecting customer information. Bind FIs only.
From the source
“This Notice is issued pursuant to section 29(1) of the Financial Services and Markets Act 2022”
MAS Notice FSM-N05 page and notice text (representative notice for banks)
Instrument record
- Short name
- MAS TRM Notices
- Date
- 2024-05-09
- Version
- Not versioned
- Cluster
- core
What this connects to
14 relations. Official relations are the ones the source documents state; anything marked GAGE analysis is our reading, not an agency's.
Operationalised by1
- ToolIncident notification instructions and reporting templateBinding, sectoral
Standard template and instructions used to fulfil the notice reporting obligations
Issued by1
- AgencyMonetary Authority of Singapore (MAS)Binding, sectoral
Notices issued by MAS pursuant to s.29(1) FSM Act 2022
Applies to1
- ConceptFinancial services sector (Singapore)Guidance
Binding on specified classes of MAS-regulated financial institutions only
Cited by10
- InstrumentConsultation Paper on Proposed Guidelines on Artificial Intelligence Risk Management for Financial Institutions (P017-2025)Consultation
Proposed Guidelines paras 4.16/5.3 (footnotes 28, 30): existing MAS technology risk management guidelines and notices apply to AI systems
- SectionNotice FSM-N05 Technology Risk Management (banks)Binding, sectoral
Sector-specific notice within the TRM notice family
- SectionNotice FSM-N21 Technology Risk Management (capital markets FIs)Binding, sectoral
Sector-specific notice within the TRM notice family
- SectionNotice FSM-N13 Technology Risk Management (designated payment systems and DPT service licensees)Binding, sectoral
Sector-specific notice within the TRM notice family
- SectionNotice FSM-N03 Technology Risk Management (licensed insurers)Binding, sectoral
Sector-specific notice within the TRM notice family
- ConceptTRM notice family across FI classesBinding, sectoral
Enumeration of the harmonised notice family per MAS consultation P012-2026
- ConceptDefinition: relevant incidentBinding, sectoral
Definition in Notice FSM-N05 para 2
- ConceptDefinition: critical systemBinding, sectoral
Definition in Notice FSM-N05 para 2
- SectionCircular on Financial Institution Incident Reporting (16 Dec 2025)Binding, sectoral
Related guidance on incident reporting to MAS
- EventConsultation P012-2026: proposed amendments to TRM Notices (10 Jun - 31 Jul 2026, closed)Consultation
Proposed amendments to the TRM notices (consultation closed 31 Jul 2026, not finalised)
Superseded by1
- SectionNotice FSM-N05 Technology Risk Management (banks)Binding, sectoralGAGE analysis, not official
FSM-N05 (FSM Act 2022, effective 10 May 2024) replaced the former MAS Notice 644 TRM notice issued to banks under the Banking Act. GAGE analysis of the renumbering; MAS page does not state the supersession expressly
Verified against the official source on 2026-08-17. GAGE is not affiliated with or endorsed by any agency named here, and nothing on this page is legal advice. How this is built and checked.