The Monetary Authority of Singapore (MAS) conducted a public consultation last February 2019 on improvements to MAS’s oversight of outsourcing arrangements managed by banks and merchant banks.  In the consultation, MAS proposes to:

       i. introduce a new section in the Banking Act to enhance its authority to regulate banks and merchant banks’ outsourcing arrangements;

       ii. expand the definition of ‘material outsourcing agreements’ as compared to the definition in the Guidelines on Outsourcing issued on 27 July 2016 (and last revised on 5 October 2018); and

       iii. issue a notice to both banks and merchant banks setting out legally binding requirements in relation to their material outsourcing arrangements (Outsourcing Notices).

MAS’s central proposal in the consultation is to amend the Banking Act to strengthen its oversight of outsourcing arrangements by banks and merchant banks.  MAS’s proposed new authority includes:

       i. imposing different requirements in relation to different types of outsourcing arrangements; and

       ii. imposing different requirements on different banks or different classes of banks based on the risks arising from the activities of the banks, systemic impact of the banks on the financial sector and other factors that MAS considers relevant.

Currently, outsourcing arrangements by banks and merchant banks are regulated by MAS Notice 634 and MAS Notice 1108, respectively.  Both notices provide a comprehensive list of conditions for banks and merchant banks to observe when their outsourcing arrangements involve a disclosure of customer information outside Singapore.  However, both notices will be repealed when MAS issues the Outsourcing Notices.

The new Outsourcing Notices will apply to material outsourcing arrangements.  MAS proposes to include a significantly broadened definition of ‘outsourcing arrangements’ in the Banking Act and to define ‘material outsourcing arrangement’ to include any outsourcing arrangement where customer information is disclosed or where the service provider has access to customer information, regardless of where the outsourced function is to be performed, the tenure of the arrangement and the impact of unauthorised disclosure or access, and even if customers have given their written consent for the disclosure of their personal information.

Some of the requirements MAS intends to include in the Outsourcing Notices are:

       i. to conduct thorough checks on the service providers that banks intend to enter outsourcing arrangements with;

       ii. to provide measures to decrease disruption to a bank’s operations should a service provider fail to provide relevant service; and

       iii. to terminate outsourcing arrangements with a service provider when specified circumstances arise.

Banks found guilty of contravening MAS’s directions under the proposed new section of the Banking Act will be liable to a fine not exceeding S$250,000, with additional penalties for continuing offences.  MAS proposes to similarly enhance its oversight of the outsourcing arrangements of merchant banks.  Banks and merchant banks will be given 12 months to make the necessary arrangements to fully comply with the proposed Outsourcing Notices.

MAS also intends to seek feedback on the requirements applicable to outsourcing arrangements managed by other classes of financial institutions.  Until then, MAS expects those other institutions to observe the Guidelines on Outsourcing MAS issued in July 2016.

‍