# MAS third-party risk management consultation (P004-2026): Consultation Paper on Proposed Guidelines on Third-Party Risk Management Source: https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-third-party-risk-management-2026 Last updated: Oct 24, 2026 MAS Consultation Paper P004-2026, published 6 March 2026 with comments due by 20 April 2026, proposes Guidelines on Third-Party Risk Management that would supersede the Guidelines on Outsourcing (Banks) and the Guidelines on Outsourcing (Financial Institutions other than Banks) and extend outsourcing-style expectations to all third-party services. Institutions would submit a register of third-party arrangements semi-annually, including material sub-contractors where possible, and the Guidelines would take effect six months after issuance. For banks, Notices 658 and 1121 stay in effect; the draft names MAS's Guidelines on AI Risk Management as related guidance, so third-party AI services would fall under both. ## At a glance | Field | Value | | --- | --- | | Authority | [MAS](https://www.bankingnewsai.com/ai-regulation/mas) | | Type | Consultation | | Status | Proposed · comment period closed | | Published | Mar 6, 2026 | | Comment deadline | Apr 20, 2026 | | Applies to | All MAS-regulated financial institutions with third-party arrangements, including banks, applied proportionately to size, complexity and the materiality of third-party services; banks and merchant banks remain subject to Notices 658 and 1121. Proposed guidance — not yet issued as of 24 October 2026 | | Official text | https://www.mas.gov.sg/publications/consultations/1/consultation-paper-on-proposed-guidelines-on-third-party-risk-management | ## Key points - Scope: 'In line with FIs’ evolving use of third-party services beyond outsourcing', the Guidelines would supersede both sets of outsourcing guidelines and 'expand the application of the relevant expectations currently imposed on outsourced services to all third-party services' (paragraph 1.2). - Banks keep their binding baseline: 'MAS Notices 658 and 1121 will remain in effect' (paragraph 1.3). - The draft builds on FSB's toolkit on third-party risk management and the BCBS Principles for the Sound Management of Third-Party Risk (paragraph 1.4). - Register: an FI should submit a register of third-party arrangements semi-annually and on request, minimally covering all material arrangements, including material sub-contractors where possible; banks submit one register covering both regimes (paragraphs 3.8-3.9). - FIs subject to consolidated supervision or owning critical information infrastructure should consider third-party services used by branches and subsidiaries, including overseas, and notify MAS of adverse developments (paragraphs 3.3-3.5). - Pending issuance, MAS expects FIs to manage operational, technology and cyber risks of third-party arrangements, for example by re-performing risk evaluations after significant changes or incidents at a provider (paragraph 2.4). - Proposed transition: the Guidelines would take effect six months from issuance (paragraph 3.39). - Footnote 15 of the draft Guidelines lists the Guidelines on Artificial Intelligence Risk Management (then proposed) among related guidance. ## What changed for banks Singapore's third-party regime has been built around outsourcing; this consultation would make every third-party service — including AI model APIs, data providers and SaaS tools that are not outsourcing — subject to due diligence, contracting, register and exit expectations. Combined with the AI Risk Management Guidelines' third-party AI section, it would give MAS a complete framework for supervising banks' reliance on external AI providers once finalised. ## Use cases it governs - [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors) - [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general) - [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity) - [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai) ## FAQ ### Has MAS finalised the Third-Party Risk Management Guidelines? Not as of 24 October 2026. Consultation Paper P004-2026 ran from 6 March to 20 April 2026, and MAS proposed that the final Guidelines take effect six months after issuance. ### Would the MAS Third-Party Risk Management Guidelines cover AI providers? Yes, in that they would apply to all third-party services, not only outsourcing. The draft lists the Guidelines on Artificial Intelligence Risk Management as related guidance, and those AI Guidelines already apply MAS's outsourcing and third-party expectations to third-party AI. ### What happens to MAS Notice 658 under the proposal? It stays. Paragraph 1.3 of the consultation paper says MAS Notices 658 and 1121 will remain in effect and continue to set baseline requirements for banks and merchant banks. ## Related documents - [MAS Guidelines on Artificial Intelligence Risk Management](https://www.bankingnewsai.com/ai-regulation/documents/mas-guidelines-ai-risk-management-2026) — Guidelines on Artificial Intelligence Risk Management for Financial Institutions (Oct 7, 2026) - [MAS SAFR white paper on AI agents](https://www.bankingnewsai.com/ai-regulation/documents/mas-safr-agentic-finance-2026) — Safeguards for Agentic Finance at Runtime (SAFR) (Jul 3, 2026) - [MAS MindForge AI Risk Management Toolkit](https://www.bankingnewsai.com/ai-regulation/documents/mas-mindforge-ai-risk-management-toolkit-2026) — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) (Mar 20, 2026) - [MAS Consultation Paper P017-2025 (AI Risk Management Guidelines)](https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-ai-risk-management-guidelines-2025) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025) - [MAS Circular MAS/TCRS/2025/06](https://www.bankingnewsai.com/ai-regulation/documents/mas-circular-cyber-risks-deepfakes-2025) — Cyber Risks Associated with Deepfakes (Information Paper) (Sep 18, 2025) - [MAS AI Model Risk Management information paper](https://www.bankingnewsai.com/ai-regulation/documents/mas-info-paper-ai-model-risk-management-2024) — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024) - [MAS Circular MAS/TCRS/2024/05](https://www.bankingnewsai.com/ai-regulation/documents/mas-circular-cyber-risks-generative-ai-2024) — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024) - [MAS Notice 658 on outsourced relevant services](https://www.bankingnewsai.com/ai-regulation/documents/mas-notice-658-outsourced-relevant-services) — Notice 658 Management of Outsourced Relevant Services for Banks (Dec 11, 2023) Last reviewed Oct 24, 2026. Cite the official text (https://www.mas.gov.sg/publications/consultations/1/consultation-paper-on-proposed-guidelines-on-third-party-risk-management) for the rule and this page for the summary and dates. --- Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-third-party-risk-management-2026 Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 256 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.