MAS Consultation Paper P004-2026, published 6 March 2026 with comments due by 20 April 2026, proposes Guidelines on Third-Party Risk Management that would supersede the Guidelines on Outsourcing (Banks) and the Guidelines on Outsourcing (Financial Institutions other than Banks) and extend outsourcing-style expectations to all third-party services. Institutions would submit a register of third-party arrangements semi-annually, including material sub-contractors where possible, and the Guidelines would take effect six months after issuance. For banks, Notices 658 and 1121 stay in effect; the draft names MAS's Guidelines on AI Risk Management as related guidance, so third-party AI services would fall under both.
OFFICIAL TEXT: mas.gov.sg ↗ · PROPOSED · COMMENT PERIOD CLOSED · MAS
| Document | MAS third-party risk management consultation (P004-2026) — Consultation Paper on Proposed Guidelines on Third-Party Risk Management |
| Issued by | Monetary Authority of Singapore |
| Type | Consultation |
| Status | Proposed · comment period closed |
| Published | Mar 6, 2026 |
| Comment deadline | Apr 20, 2026 |
| Applies to | All MAS-regulated financial institutions with third-party arrangements, including banks, applied proportionately to size, complexity and the materiality of third-party services; banks and merchant banks remain subject to Notices 658 and 1121. Proposed guidance — not yet issued as of 24 October 2026 |
| Official source | mas.gov.sg ↗ |
| Use cases | Third-party & vendor AI · AI governance (general) · Cybersecurity · Generative & agentic AI |
What are the key points of MAS third-party risk management consultation (P004-2026)?
- Scope: 'In line with FIs’ evolving use of third-party services beyond outsourcing', the Guidelines would supersede both sets of outsourcing guidelines and 'expand the application of the relevant expectations currently imposed on outsourced services to all third-party services' (paragraph 1.2).
- Banks keep their binding baseline: 'MAS Notices 658 and 1121 will remain in effect' (paragraph 1.3).
- The draft builds on FSB's toolkit on third-party risk management and the BCBS Principles for the Sound Management of Third-Party Risk (paragraph 1.4).
- Register: an FI should submit a register of third-party arrangements semi-annually and on request, minimally covering all material arrangements, including material sub-contractors where possible; banks submit one register covering both regimes (paragraphs 3.8-3.9).
- FIs subject to consolidated supervision or owning critical information infrastructure should consider third-party services used by branches and subsidiaries, including overseas, and notify MAS of adverse developments (paragraphs 3.3-3.5).
- Pending issuance, MAS expects FIs to manage operational, technology and cyber risks of third-party arrangements, for example by re-performing risk evaluations after significant changes or incidents at a provider (paragraph 2.4).
- Proposed transition: the Guidelines would take effect six months from issuance (paragraph 3.39).
- Footnote 15 of the draft Guidelines lists the Guidelines on Artificial Intelligence Risk Management (then proposed) among related guidance.
What did MAS third-party risk management consultation (P004-2026) change for banks?
Singapore's third-party regime has been built around outsourcing; this consultation would make every third-party service — including AI model APIs, data providers and SaaS tools that are not outsourcing — subject to due diligence, contracting, register and exit expectations. Combined with the AI Risk Management Guidelines' third-party AI section, it would give MAS a complete framework for supervising banks' reliance on external AI providers once finalised.
Has MAS finalised the Third-Party Risk Management Guidelines?
Not as of 24 October 2026. Consultation Paper P004-2026 ran from 6 March to 20 April 2026, and MAS proposed that the final Guidelines take effect six months after issuance.
Would the MAS Third-Party Risk Management Guidelines cover AI providers?
Yes, in that they would apply to all third-party services, not only outsourcing. The draft lists the Guidelines on Artificial Intelligence Risk Management as related guidance, and those AI Guidelines already apply MAS's outsourcing and third-party expectations to third-party AI.
What happens to MAS Notice 658 under the proposal?
It stays. Paragraph 1.3 of the consultation paper says MAS Notices 658 and 1121 will remain in effect and continue to set baseline requirements for banks and merchant banks.
| Date | Document | Status |
|---|---|---|
| Oct 7, 2026 | MAS Guidelines on Artificial Intelligence Risk Management — Guidelines on Artificial Intelligence Risk Management for Financial Institutions | Final |
| Jul 3, 2026 | MAS SAFR white paper on AI agents — Safeguards for Agentic Finance at Runtime (SAFR) | Final |
| Mar 20, 2026 | MAS MindForge AI Risk Management Toolkit — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) | Final |
| Nov 13, 2025 | MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management | Superseded |
| Sep 18, 2025 | MAS Circular MAS/TCRS/2025/06 — Cyber Risks Associated with Deepfakes (Information Paper) | In force |
| Dec 5, 2024 | MAS AI Model Risk Management information paper — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) | Final |
Follow every document these regulators publish
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning