The reliable delivery of financial services is essential to maintaining a trusted and resilient financial centre. Operational disruptions can occur due to external events like pandemics and natural disasters, or internal lapses like technology failures. The risk of such disruptions has risen given greater digitalisation, more reliance on third-party services, and increasing interconnectedness of the financial ecosystem.

2    Operational resilience refers to a financial institution's (FI's) ability to deliver critical business services and functionsThis is analogous to 'Critical Operations' referred to in the 'Principles for Operational Resilience' by the Basel Committee on Banking Supervision. through disruptions. To achieve operational resilience, an FI will need to have effective frameworks on operational risk management, technology and cyber risk management, third-party risk management and business continuity management.

3    The four key pillars of operational resilience interact to ensure that FIs: (a) implement a robust governance structure and appropriate risk appetite; (b) similarly extend such oversight to external dependencies when third-party service providers are used; (c) manage cyber threats, system failures and digital transformation risks that could impact business operations or compromise third-party service providers; and (d) plan well for business continuity that include response and recovery measures which account for operational disruptions, third-party failures and technology incidents.

Diagram 1: Key Pillars of Operational Resilience

4    FIs should seek to minimise the occurrence of disruptions, and to minimise their impact if they occur despite best efforts. FIs should therefore have the ability to deliver critical business services and functions in the event of a disruption, albeit at a potentially degraded level. An operationally resilient FI should minimally be able to:

5    MAS expects FIs to achieve a robust level of operational resilience. FIs should comply with MAS' regulatory instruments on operational risk management, technology & cyber risk management, third-party risk management, and business continuity managementA bank or insurer subject to Notice 654 / Notice 134 recovery and resolution planning requirements should also appropriately harmonise its operational resilience approach. This includes ensuring consistency across both frameworks relating to the stated actions, organisational mappings, and critical business services and functions..

Guidelines on Operational Risk Management:
Guidance for FIs to establish sound and robust operational risk governance and oversight. MAS consulted on the updated Guidelines on Operational Risk Management.

Notices on Cyber Hygiene:
Requirements that FIs have to comply with for the purposes of managing cyber hygiene on securing administrative accounts, applying security patching, establishing baseline security standards, deploying network security devices, implementing anti-malware measures and strengthening user authentication.

Notices on Technology Risk Management:
Requirements that FIs have to comply with, for a high level of reliability, availability and recoverability of critical IT systems and to implement IT controls to protect customer information from unauthorised access or disclosure.

Guidelines on Technology Risk Management
Guidance for FIs to establish sound and robust technology risk governance and oversight, as well as maintain IT and cyber resilience.

Notices on Management of Outsourced Relevant Services for Banks and Merchant Banks and Guidelines on Outsourcing:
Requirements and guidance on managing risks associated with outsourced relevant servicesBanks and merchant banks should refer to MAS Notices 658 and 1121 and the Guidelines on Outsourcing (Banks), while other FIs should refer to the Guidelines on Outsourcing (Financial Institutions Other than Banks).. MAS consulted on the Guidelines on Third-Party Risk Management. When finalised, it will provide guidance for FIs to implement controls commensurate with the nature and extent of risks arising from FIs’ use of third-party services regardless of whether the use of such services constitute an outsourcing arrangement.

Guidelines on Business Continuity Management:
Guidance for FIs to take an end-to-end service-centric view in ensuring the continuous delivery of critical business services and functions to their customers.