# MAS Notice 658 on outsourced relevant services: Notice 658 Management of Outsourced Relevant Services for Banks

Source: https://www.bankingnewsai.com/ai-regulation/documents/mas-notice-658-outsourced-relevant-services
Last updated: Oct 24, 2026

MAS Notice 658, published on 11 December 2023 and effective from 11 December 2024, is the binding outsourcing rule for banks in Singapore, issued under section 47A of the Banking Act 1970. It requires a register of outsourced relevant services submitted to MAS semi-annually, due diligence on providers of material ongoing outsourced services (repeated within 24 months and then at a board-approved frequency), controls on sub-contracting, contractual access rights, protection of customer information and exit measures. MAS's Guidelines on AI Risk Management (7 October 2026) say MAS 'expectations and requirements on managing the risks from outsourcing and use of third-party services would apply to the use of third-party AI', and MAS's 2026 third-party risk consultation says Notice 658 will remain in effect.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [MAS](https://www.bankingnewsai.com/ai-regulation/mas) |
| Type | Regulation |
| Status | In force |
| Published | Dec 11, 2023 |
| Effective | Dec 11, 2024 |
| Applies to | All banks in Singapore; issued under section 47A of the Banking Act 1970. Merchant banks are covered by the parallel Notice 1121. Binding requirements, which apply to third-party AI services where the arrangement is an outsourced relevant service under the Notice's definitions |
| Official text | https://www.mas.gov.sg/regulation/notices/notice-658 |

## Key points

- Issued pursuant to section 47A(2), (4), (6), (7) and (12) of the Banking Act 1970 and 'applies to all banks in Singapore' (paragraph 1.1); MAS's page states it is effective on 11 December 2024.
- Paragraph 3: banks must keep a register of all ongoing outsourced relevant services and of outsourced services involving disclosure of customer information, update it promptly and submit it to MAS semi-annually and on request.
- Paragraph 4: for material ongoing outsourced relevant services, banks must identify them, assess and monitor their risks, set approving authorities commensurate with scale and complexity, and establish and be ready to implement measures to minimise disruption if the provider fails or the contract is terminated.
- Paragraph 5: before obtaining a material ongoing service, banks must run due diligence against a framework covering the provider's risk management framework, reputation and track record and financial strength, repeat it no later than 24 months after obtaining the service, and thereafter at a frequency approved by the board.
- Further sections govern the use of sub-contractors, the outsourcing agreement and access to information, protection of customer information, termination, and services obtained outside Singapore.
- MAS's page lists the earlier Notice 634 'Banking Secrecy – Conditions for Outsourcing' as cancelled, and the 2016 Guidelines on Outsourcing were in effect until 10 December 2024.
- For AI, footnote 39 of MAS's Guidelines on AI Risk Management applies outsourcing and third-party requirements to third-party AI, and paragraph 5.11 says the FI 'retains primary accountability for its use of third-party AI'.

## What changed for banks

Notice 658 moved banks' outsourcing regime from banking-secrecy conditions (Notice 634) and voluntary guidelines to binding statutory requirements under section 47A of the Banking Act, with a semi-annual register, periodic due diligence and sub-contracting controls. MAS's March 2026 consultation on Third-Party Risk Management Guidelines would widen the guidance layer to all third-party services but keeps Notice 658 as the baseline requirement for banks.

## Use cases it governs

- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Data & privacy](https://www.bankingnewsai.com/ai-regulation/by-use-case#data-privacy)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)

## FAQ

### Does MAS Notice 658 apply to AI vendors?

Where a bank's use of an AI service is an outsourced relevant service as defined in the Notice, yes: the register, due diligence, sub-contracting, access and customer-information requirements apply. MAS's Guidelines on AI Risk Management add that outsourcing and third-party requirements apply to third-party AI and that the bank retains primary accountability for it.

### When did MAS Notice 658 take effect?

MAS published Notice 658 on 11 December 2023 and its page states that it is effective on 11 December 2024. The Guidelines on Outsourcing (Banks) took effect on the same date, replacing the 2016 Guidelines on Outsourcing for banks.

### Will Notice 658 be replaced by the MAS Third-Party Risk Management Guidelines?

No. Consultation Paper P004-2026 proposes Guidelines that supersede the Guidelines on Outsourcing, but says MAS Notices 658 and 1121 will remain in effect and continue to set baseline requirements for banks and merchant banks.

## Related documents

- [MAS Guidelines on Artificial Intelligence Risk Management](https://www.bankingnewsai.com/ai-regulation/documents/mas-guidelines-ai-risk-management-2026) — Guidelines on Artificial Intelligence Risk Management for Financial Institutions (Oct 7, 2026)
- [MAS SAFR white paper on AI agents](https://www.bankingnewsai.com/ai-regulation/documents/mas-safr-agentic-finance-2026) — Safeguards for Agentic Finance at Runtime (SAFR) (Jul 3, 2026)
- [MAS MindForge AI Risk Management Toolkit](https://www.bankingnewsai.com/ai-regulation/documents/mas-mindforge-ai-risk-management-toolkit-2026) — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) (Mar 20, 2026)
- [MAS third-party risk management consultation (P004-2026)](https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-third-party-risk-management-2026) — Consultation Paper on Proposed Guidelines on Third-Party Risk Management (Mar 6, 2026)
- [MAS Consultation Paper P017-2025 (AI Risk Management Guidelines)](https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-ai-risk-management-guidelines-2025) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025)
- [MAS Circular MAS/TCRS/2025/06](https://www.bankingnewsai.com/ai-regulation/documents/mas-circular-cyber-risks-deepfakes-2025) — Cyber Risks Associated with Deepfakes (Information Paper) (Sep 18, 2025)
- [MAS AI Model Risk Management information paper](https://www.bankingnewsai.com/ai-regulation/documents/mas-info-paper-ai-model-risk-management-2024) — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024)
- [MAS Circular MAS/TCRS/2024/05](https://www.bankingnewsai.com/ai-regulation/documents/mas-circular-cyber-risks-generative-ai-2024) — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024)

Last reviewed Oct 24, 2026. Cite the official text (https://www.mas.gov.sg/regulation/notices/notice-658) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/mas-notice-658-outsourced-relevant-services
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 256 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.