# MAS Guidelines on Outsourcing (Banks): Guidelines on Outsourcing (Banks)

Source: https://www.bankingnewsai.com/ai-regulation/documents/mas-guidelines-outsourcing-banks-2023
Last updated: Oct 24, 2026

MAS's Guidelines on Outsourcing (Banks), published 11 December 2023 and effective 11 December 2024, set out MAS's expectations of a bank or merchant bank that outsources relevant services, alongside the binding Notice 658. They cover board and senior-management responsibilities, risk evaluation, assessment of service providers, outsourcing agreements, sub-contractors, confidentiality, business continuity, monitoring, audit, offshore and intragroup outsourcing, and include an annex on cloud computing. They replaced the 2016 Guidelines on Outsourcing (revised 2018) for banks and apply to third-party AI through footnote 39 of MAS's AI Risk Management Guidelines; MAS proposed in March 2026 to supersede them with Guidelines on Third-Party Risk Management.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [MAS](https://www.bankingnewsai.com/ai-regulation/mas) |
| Type | Guidance |
| Status | In force |
| Published | Dec 11, 2023 |
| Effective | Dec 11, 2024 |
| Applies to | All banks and merchant banks in Singapore with, or planning, an arrangement for ongoing outsourced relevant services, except exempted services in Annex D of MAS Notices 658 and 1121; applied in proportion to the risks and materiality of each arrangement |
| Official text | https://www.mas.gov.sg/regulation/guidelines/guidelines-on-outsourcing-banks |

## Key points

- Section 3 covers board and senior management responsibilities, evaluation of risks, assessment of service providers, the outsourcing agreement, sub-contractors, confidentiality and security, business continuity, monitoring and control, audit and inspection, outsourcing outside Singapore, intragroup outsourcing and outsourcing of internal audit.
- Paragraph 1.3: banks should ensure outsourced services, whether provided by a service provider or its sub-contractor, 'continue to be managed as if the services were still managed by the Bank'.
- Paragraph 1.1 names country risk when a provider is overseas and 'concentration risk when more than one function is outsourced to the same service provider' — the risk MAS and the FSB flag for reliance on a few AI model providers.
- Paragraph 1.2 asks banks to self-assess all existing outsourcing arrangements against the Guidelines.
- Paragraph 1.4: arrangements outside the definition of outsourcing 'should also be subject to adequate risk management and sound internal controls'; Annex 1 helps assess materiality and Annex 2 covers cloud computing.
- The 2016 Guidelines on Outsourcing (last revised 5 October 2018) were in effect until 10 December 2024 and MAS now lists them as cancelled.
- Consultation Paper P004-2026 (6 March 2026) proposes Guidelines on Third-Party Risk Management that would supersede these Guidelines and extend the expectations to all third-party services.

## What changed for banks

The 2023 Guidelines split the earlier cross-sector 2016 Guidelines on Outsourcing into a bank-specific version aligned with Notices 658 and 1121, effective December 2024. They are a transitional instrument: MAS's March 2026 consultation would fold them into Third-Party Risk Management Guidelines covering all third-party services, including AI services that are not outsourcing.

## Use cases it governs

- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)

## FAQ

### Are the MAS Guidelines on Outsourcing still in force?

For banks, the operative versions are the Guidelines on Outsourcing (Banks) and Notice 658, both effective 11 December 2024. The 2016 Guidelines on Outsourcing (revised 2018) were in effect until 10 December 2024 and are listed as cancelled. MAS proposed in March 2026 to replace the bank Guidelines with Guidelines on Third-Party Risk Management, which had not been issued as of 24 October 2026.

### How do the MAS outsourcing guidelines apply to AI?

MAS's Guidelines on AI Risk Management say MAS expectations on outsourcing and third-party services apply to third-party AI. A bank should assess an AI provider, contract for visibility and audit, manage sub-contractors and concentration risk, and plan exit as it would for other outsourcing, then add the AI-specific testing in paragraphs 5.10-5.11 of the AI Guidelines.

## Related documents

- [MAS Guidelines on Artificial Intelligence Risk Management](https://www.bankingnewsai.com/ai-regulation/documents/mas-guidelines-ai-risk-management-2026) — Guidelines on Artificial Intelligence Risk Management for Financial Institutions (Oct 7, 2026)
- [MAS SAFR white paper on AI agents](https://www.bankingnewsai.com/ai-regulation/documents/mas-safr-agentic-finance-2026) — Safeguards for Agentic Finance at Runtime (SAFR) (Jul 3, 2026)
- [MAS MindForge AI Risk Management Toolkit](https://www.bankingnewsai.com/ai-regulation/documents/mas-mindforge-ai-risk-management-toolkit-2026) — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) (Mar 20, 2026)
- [MAS third-party risk management consultation (P004-2026)](https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-third-party-risk-management-2026) — Consultation Paper on Proposed Guidelines on Third-Party Risk Management (Mar 6, 2026)
- [MAS Consultation Paper P017-2025 (AI Risk Management Guidelines)](https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-ai-risk-management-guidelines-2025) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025)
- [MAS Circular MAS/TCRS/2025/06](https://www.bankingnewsai.com/ai-regulation/documents/mas-circular-cyber-risks-deepfakes-2025) — Cyber Risks Associated with Deepfakes (Information Paper) (Sep 18, 2025)
- [MAS AI Model Risk Management information paper](https://www.bankingnewsai.com/ai-regulation/documents/mas-info-paper-ai-model-risk-management-2024) — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024)
- [MAS Circular MAS/TCRS/2024/05](https://www.bankingnewsai.com/ai-regulation/documents/mas-circular-cyber-risks-generative-ai-2024) — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024)

Last reviewed Oct 24, 2026. Cite the official text (https://www.mas.gov.sg/regulation/guidelines/guidelines-on-outsourcing-banks) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/mas-guidelines-outsourcing-banks-2023
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 256 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.