MAS Proposes to Further Amend Business Continuity Guidelines

The proposals cover guidance on third-party dependencies; exposure to concentration risk when several of an institution's critical business functions are outsourced to a single provider; threat monitoring, review, and reporting; testing of business continuity management frameworks and undertake effective remedial actions; and responsibilities of Board and senior management. The guidelines stipulate that, in establishing recovery strategies, a financial institution should adopt an end-to-end view of the critical business services’ dependencies, to not only consider the recovery of individual processes, but the complete set of processes supporting the delivery of the service. This will minimize the degree of disruption, safeguard customer interests, and maintain the safety and soundness of financial institutions. Financial institutions should also ensure clear accountability and responsibility for the overall business continuity of each critical business service. Where the delivery of a business service depends on multiple business functions, an overall manager should be appointed to coordinate incident management across the affected functions and oversee the resumption of the business service in the event of a disruption.

Comment Due Date: November 15, 2021

Keywords: Asia Pacific, Singapore, Banking, Business Continuity, Guidance, Operational Risk, Cyber Risk, Outsourcing Arrangements, Cloud Service Providers, Regtech, MAS