# MAS Technology Risk Management Guidelines: Guidelines on Risk Management Practices – Technology Risk (Technology Risk Management Guidelines, January 2021)

Source: https://www.bankingnewsai.com/ai-regulation/documents/mas-trm-guidelines-2021
Last updated: Oct 24, 2026

The MAS Technology Risk Management (TRM) Guidelines, published on 18 January 2021, set out 'risk management principles and best practice standards to guide financial institutions in managing technology risk' — board oversight, security-by-design, secure software development, third-party and API controls, access control, cyber operations and IT audit. They contain no AI-specific section: the only reference to machine learning is paragraph 12.2.4 on user behavioural analytics for security monitoring. Their AI relevance comes from MAS's Guidelines on AI Risk Management of 7 October 2026, which say relevant technology risk management guidance 'would apply' to AI systems and name the TRM Guidelines in footnote 47, making them the technology and cybersecurity baseline banks apply to every AI system.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [MAS](https://www.bankingnewsai.com/ai-regulation/mas) |
| Type | Guidance |
| Status | In force |
| Published | Jan 18, 2021 |
| Applies to | All MAS-regulated financial institutions listed on the guideline page, including full, merchant and wholesale banks (branches and locally incorporated), banking financial holding companies, finance companies and card issuers, insurers, capital markets intermediaries and infrastructure, payment institutions and financial advisers; implementation is 'commensurate with the level of risk and complexity of the financial services offered and the technologies supporting such services' (paragraph 2.2) |
| Official text | https://www.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines |

## Key points

- Fifteen sections: technology risk governance and oversight, a technology risk management framework, IT project management and security-by-design, software application development, IT service management, IT resilience, access control, cryptography, data and infrastructure security, cyber security operations and assessment, online financial services and IT audit.
- Board and senior management are expected to 'cultivate a strong risk culture, and ensure the establishment of a sound and robust technology risk management framework' (paragraph 1.4(a)).
- Paragraph 3.4 extends technology-risk due diligence to third-party services that are not outsourcing: the FI should assess exposure to risks affecting the confidentiality, integrity and availability of systems and data at the third party 'before entering into a contractual agreement or partnership'.
- Paragraph 6.1.3 requires a policy so that 'third party and open-source software codes' are reviewed and tested before integration, and 6.1.4 asks FIs to track vulnerabilities in them — the controls that reach open-source models and AI libraries.
- Section 6.4 requires a vetting process and risk assessment before third parties connect to the FI's systems via APIs, scaled to the sensitivity of the data exchanged.
- Paragraph 12.2.4 is the only machine-learning reference: user behavioural analytics 'might include the use of machine learning algorithms in real time to analyse system logs'.
- The Guidelines are not binding rules, but 'the degree of observance with the spirit of the Guidelines by an FI is an area of consideration by MAS' (paragraph 2.2); separate MAS Notices on Technology Risk Management carry the binding requirements, and MAS consulted on amendments to those Notices from 10 June to 31 July 2026 (Consultation Paper P012-2026).
- MAS's Guidelines on AI Risk Management cite the TRM Guidelines twice: for technology and cybersecurity risks of AI systems (paragraph 5.16, footnote 47) and for the technology infrastructure supporting AI (paragraph 6.3, footnote 50).

## What changed for banks

The January 2021 revision replaced the 2013 TRM Guidelines, adding board accountability for technology risk, security-by-design, software supply-chain and API controls, and cyber-resilience testing such as adversarial attack simulation exercises. Nothing in it was written for AI, but in October 2026 MAS made it the reference point for the security, access-control and infrastructure expectations in its AI risk management Guidelines, so AI systems are now examined against TRM controls in the same way as other IT systems.

## Use cases it governs

- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)
- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [AI-generated code & coding agents](https://www.bankingnewsai.com/ai-regulation/by-use-case#ai-generated-code)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)

## FAQ

### Do the MAS TRM Guidelines say anything about AI?

Not directly. The only machine-learning reference is paragraph 12.2.4 on behavioural analytics for security monitoring. MAS's Guidelines on AI Risk Management (7 October 2026) say relevant technology risk management guidance 'would apply' to AI systems and name the TRM Guidelines, so the TRM controls on secure development, third-party code, APIs, access and cyber operations apply to AI systems too.

### Are the MAS Technology Risk Management Guidelines binding on banks?

They are guidelines, not legislation, but paragraph 2.2 says the degree of observance with their spirit is an area of consideration when MAS supervises an institution. Binding technology-risk requirements sit in MAS's Notices on Technology Risk Management, which MAS proposed to amend in Consultation Paper P012-2026 (June 2026).

### Which TRM controls matter most for an AI system at a bank?

Third-party and open-source code review (paragraphs 6.1.3-6.1.4), API vetting and risk assessment (section 6.4), technology risk assessment of non-outsourced third-party services (paragraph 3.4), access control (section 9), data security (section 11.1) and security monitoring (section 12). MAS's AI Guidelines list secured deployment environments, input validation, API authentication and privileged access management for AI systems in paragraph 5.16.

## Related documents

- [MAS Guidelines on Artificial Intelligence Risk Management](https://www.bankingnewsai.com/ai-regulation/documents/mas-guidelines-ai-risk-management-2026) — Guidelines on Artificial Intelligence Risk Management for Financial Institutions (Oct 7, 2026)
- [MAS SAFR white paper on AI agents](https://www.bankingnewsai.com/ai-regulation/documents/mas-safr-agentic-finance-2026) — Safeguards for Agentic Finance at Runtime (SAFR) (Jul 3, 2026)
- [MAS MindForge AI Risk Management Toolkit](https://www.bankingnewsai.com/ai-regulation/documents/mas-mindforge-ai-risk-management-toolkit-2026) — AI Risk Management: Operationalisation Handbook (Project MindForge AI Risk Management Toolkit) (Mar 20, 2026)
- [MAS third-party risk management consultation (P004-2026)](https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-third-party-risk-management-2026) — Consultation Paper on Proposed Guidelines on Third-Party Risk Management (Mar 6, 2026)
- [MAS Consultation Paper P017-2025 (AI Risk Management Guidelines)](https://www.bankingnewsai.com/ai-regulation/documents/mas-consultation-ai-risk-management-guidelines-2025) — Consultation Paper on Guidelines on Artificial Intelligence Risk Management (Nov 13, 2025)
- [MAS Circular MAS/TCRS/2025/06](https://www.bankingnewsai.com/ai-regulation/documents/mas-circular-cyber-risks-deepfakes-2025) — Cyber Risks Associated with Deepfakes (Information Paper) (Sep 18, 2025)
- [MAS AI Model Risk Management information paper](https://www.bankingnewsai.com/ai-regulation/documents/mas-info-paper-ai-model-risk-management-2024) — Artificial Intelligence Model Risk Management: Observations from a Thematic Review (Information Paper) (Dec 5, 2024)
- [MAS Circular MAS/TCRS/2024/05](https://www.bankingnewsai.com/ai-regulation/documents/mas-circular-cyber-risks-generative-ai-2024) — Cyber Risks Associated with Generative Artificial Intelligence (Information Paper) (Jul 30, 2024)

Last reviewed Oct 24, 2026. Cite the official text (https://www.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/mas-trm-guidelines-2021
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (45 authorities, 256 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.