MAS Notice 658 Management of Outsourced Relevant Services for Banks

MAS Notice 658
11 December 2023
NOTICE TO BANKS
Banking Act 1970 Management Of Outsourced Relevant Services

1. Introduction
   1.1 This Notice is issued pursuant to section 47A(2), (4), (6), (7) and (12) of the Banking
   Act 1970 (the “Act”) and applies to all banks in Singapore.
   1.2 This Notice sets out the requirements that a bank in Singapore has to comply with
   for the purposes of managing the risks associated with the bank’s outsourced relevant services.
2. Definitions
   2.1 For the purpose of this Notice –
   “board” means –
   (a) in the case of a bank incorporated in Singapore, a board-level committee; and (b) in the case of a bank incorporated outside Singapore, a board-level committee, or a management committee or body responsible for the oversight of the branches and offices of the bank located within Singapore; “customer”, in relation to a bank, includes the Authority or any monetary authority or central bank of any other country or territory, and any company which carries on a banking business, merchant banking business or investment banking business; “customer information”, in relation to a bank in Singapore, means – (a) any information relating to, or any particulars of, an account of a customer of the bank, whether the account is in respect of a loan, investment or any other type of transaction, but does not include any information that is not referable to any named customer or group of named customers; or (b) deposit information;

“deposit information”, in relation to a bank in Singapore, means any information relating to – (a) any deposit of a customer of the bank; (b) funds of a customer under management by the bank; or (c) any safe deposit box maintained by, or any safe custody arrangements made by, a customer with the bank, but does not include any information that is not referable to any named person or group of named persons; “exempted outsourced relevant service” means any outsourced relevant service that is set out in Annex D; “intragroup entity” in relation to a bank in Singapore, means – (a) an entity that has the same ultimate holding company as the bank; (b) an entity that is the ultimate holding company of the bank; or (c) a branch or office of the bank; “material ongoing outsourced relevant service” means any ongoing outsourced relevant service where the bank in Singapore has reasonable grounds to believe that – (a) any unauthorised disclosure of, access to, collection of, copying of, modification of, use of, disposal of or acts with similar risks done in relation to, any information, held by the service provider or sub-contractor, as the case may be; (b) any unauthorised access to the books, systems or premises of the service provider or sub-contractor, as the case may be; or (c) a failure by the service provider to provide the relevant service in accordance with the outsourcing agreement, will materially affect adversely or is likely to materially affect adversely – (i) any of the business of the bank referred to in section 30(1) of the Act; (ii) the customers or any group of customers, financial soundness or reputation of the bank;

(iii) the ability of the bank to manage its risks (including legal, reputational, technological and operational risks) arising from the relevant service; or (iv) the ability of the bank to comply with all laws and regulatory requirements that apply to the bank, whether in Singapore or elsewhere; “ongoing outsourced relevant service”, in relation to a bank in Singapore, means an outsourced relevant service that – (a) the bank obtains or receives or intends to obtain or receive, for a duration of more than 12 months; or (b) the bank obtains or receives for a duration of 12 months or less, but where the outsourcing agreement is renewed or extended, or which the bank intends to renew or extend, such that the cumulative duration of the bank obtaining or receiving the relevant service exceeds or will exceed 12 months; “outsourced relevant service”, in relation to a bank in Singapore, means a relevant service, other than a relevant service set out in Annex B, that – (a) is performed by the bank or was performed by the bank at any time prior to it obtaining or receiving the relevant service; (b) is integral to any business that the bank may carry on under section 30(1) of the Act, which includes, but is not limited, to any relevant service set out in Annex A; or (c) is set out in Annex C; “outsourcing agreement” means – (a) in the case where the service provider of a bank in Singapore is a branch or office of the bank, written policies and procedures by which the branch or office is to provide an outsourced relevant service; and (b) in the case where the service provider is any person, a written contract between a bank in Singapore and the person setting out the terms by which the person is to provide the outsourced relevant service; “overseas regulated financial institution” means an institution that is licensed, approved, registered or otherwise regulated under any law administered by a corresponding authority in a foreign country to carry on any financial activities in that country, or that is exempted from such licensing, approval, registration or regulation for the carrying on of any financial activities in that country;

“relevant service” has the same meaning as defined in Section 47A(12) of the Act; “service provider”, in relation to a bank in Singapore, means – (a) any branch or office of the bank that is located outside Singapore; or (b) any person, that provides a relevant service to the bank; “sub-contracting arrangement” means an arrangement between a service provider and a sub-contractor, or between two sub-contractors, under which the sub￾contractor or one of the sub-contractors, as the case may be, agrees to provide the whole or any part of a relevant service to the bank in Singapore; “sub-contractor”, in relation to a bank in Singapore, means – (a) another branch or office of the bank, or any person, that is engaged by a service provider or another sub-contractor, as the case may be, to provide the whole or any part of a relevant service pursuant to a sub-contracting arrangement, where the service provider or sub-contractor is a branch or office of the bank; and (b) a branch or office of the bank, or any person, that is engaged by a service provider or another sub-contractor, as the case may be, to provide the whole or any part of a relevant service pursuant to a sub-contracting arrangement, where the service provider or sub-contractor is a person; “supervisory authority”, in relation to a foreign country or territory, means an authority of the foreign country or territory exercising any function that corresponds to a regulatory function of the Authority under the Act, the Monetary Authority of Singapore Act 1970 or any of the written laws set out in the Schedule to that Act; "ultimate holding company" has the same meaning as set out in section 5A of the Companies Act 1976.
2.2 For the purposes of this Notice, unless the context otherwise requires, a reference to
a “branch or office” of a bank in Singapore includes its head office.
2.3 The expressions used in this Notice shall, except where expressly defined in this
Notice or where the context otherwise requires, have the same respective meanings as in the Act.
2.4 A bank in Singapore that obtains or receives any exempted outsourced relevant
service does not need to comply with the requirements in this Notice in relation to the exempted outsourced relevant service.

SECTION A. MONITORING AND CONTROL OF OUTSOURCED RELEVANT
SERVICES
3. Register of Outsourced Relevant Services
3.1 A bank in Singapore must record in a register, a list of all –
(a) ongoing outsourced relevant services obtained or received from a service provider; and (b) outsourced relevant services obtained or received from a service provider, which involves the disclosure of customer information.
3.2 The bank must ensure that the register is to be updated promptly and submit the
register to the Authority semi-annually and at any time upon request by the Authority.
SECTION B.REQUIREMENTS RELATING TO MATERIAL ONGOING
OUTSOURCED RELEVANT SERVICES
4. Management of Material Ongoing Outsourced Relevant Services
4.1 A bank in Singapore must –
(a) implement policies and procedures to identify all material ongoing outsourced relevant services, and assess, manage and monitor any risk to the bank that may arise from obtaining or receiving each of these relevant services; (b) maintain effective supervision and monitor the provision of the material ongoing outsourced relevant service, including establishing appropriate levels of approving authorities that is commensurate with the scale and complexity of the material ongoing outsourced relevant service, to approve matters relating to the relevant service; (c) establish measures to minimise any disruption to the operations of the bank in the event that the service provider cannot adequately provide the material ongoing outsourced relevant service or where the bank needs to exercise its right to terminate the outsourcing agreement or to stop obtaining or receiving the material ongoing outsourced relevant service; (d) implement the measures mentioned in sub-paragraph (c) in the event that the service provider cannot adequately provide the material ongoing outsourced relevant service or where the bank needs to exercise its right to terminate the outsourcing agreement or to stop obtaining or receiving the material ongoing outsourced relevant service; and

(e) keep documentation sufficient to demonstrate compliance by the bank with the requirements in this paragraph.
5. Evaluation of Service Provider for Material Ongoing Outsourced
Relevant Services
5.1 For the purposes of section 47A(2)(a) and 47A(4)(a) of the Act, before obtaining any
material ongoing outsourced relevant service, a bank in Singapore must establish a framework for evaluating the ability of the service provider to perform the acts mentioned in section 47A(2)(a)(i) to 47A(2)(a)(v) or 47A(4)(a)(i) to 47A(4)(a)(v) of the Act, as the case may be. The bank must conduct due diligence checks against the framework and be satisfied of the results. The bank must ensure that the framework includes an assessment of all of the following matters at the minimum:
(a) in the case where the service provider is an intragroup entity of the bank in Singapore, the service provider’s risk management framework, and its track record in providing similar relevant services; (b) in all other cases other than that mentioned in paragraph (a), – (i) the service provider’s risk management framework; (ii) the service provider’s reputation and track record in providing similar relevant services; and (iii) the service provider’s financial strength and resources; (c) in the case where the material ongoing outsourced relevant service is obtained or received outside Singapore by the bank and involves the disclosure of customer information to the service provider, – (i) the risks of the bank not being able to comply with any obligations under any written law that requires it to keep confidential, any of its customer information; (ii) the service provider’s reputation and track record for safeguarding the confidentiality and integrity of customer information in its custody; (iii) the service provider’s ability to ensure that employees who are authorised to access the customer information are subject to confidentiality obligations; and (iv) the measures that the service provider has put in place to safeguard the confidentiality and integrity of customer information of the bank that is in

the custody of the service provider, in relation to the provision of the relevant service.
5.2 A bank in Singapore must satisfy itself, on an ongoing basis, of the service provider’s
ability to perform the acts mentioned in section 47A(2)(a)(i) to 47A(2)(a)(v) or 47A(4)(a)(i) to 47A(4)(a)(v) of the Act, as the case may be. The bank must, at the minimum:
(a) after performing the initial due diligence checks mentioned in paragraph 5.1, perform the same due diligence checks within a period assessed by the bank to be commensurate with the risks of the material ongoing outsourced relevant service, but no later than 24 months of obtaining the material ongoing outsourced relevant service; and (b) thereafter, perform the due diligence checks mentioned in paragraph 5.1 at a frequency approved by the board of the bank that is commensurate with the risks of the material ongoing outsourced relevant service.
5.3 A bank in Singapore must document the due diligence checks required under
paragraphs 5.1 and 5.2, where applicable, (“Due Diligence Checks”) conducted by it and furnish the documentation to the Authority upon request.
5.4 Notwithstanding paragraphs 5.1 and 5.2, a bank in Singapore may rely on a third
party to perform the Due Diligence Checks if all of the following requirements are met:
(a) the bank is satisfied that the third party it intends to rely on is able to perform the Due Diligence Checks; and (b) the third party is able and willing to provide to the bank or Authority, upon the bank’s or Authority’s request, as the case may be, any record, document, report or information obtained by the third party with respect to the Due Diligence Checks, and the bank has obtained a written undertaking from the third party to this effect.
5.5 Where a bank in Singapore places reliance on a third party to perform the Due
Diligence Checks, the bank must –
(a) document the basis for its satisfaction that the requirements in paragraph 5.4 have been met; (b) obtain from the third party a record, document or report, or information setting out the basis for the third party’s assessment pursuant to the Due Diligence Checks; and (c) review the third party’s evaluation of the service provider.

5.6 To avoid doubt, notwithstanding any reliance on a third party in accordance with
paragraph 5.4, the bank in Singapore remains responsible for its obligations mentioned in paragraphs 5.1 to 5.3.
6. Requirements relating to Use of Sub-Contractor for Material
Ongoing Outsourced Relevant Services
6.1 Subject to paragraph 6.2, a bank in Singapore must not allow a material ongoing
outsourced relevant service to be sub-contracted unless – (a) the sub-contracting arrangement does not involve any disclosure of customer information; or (b) where the sub-contracting arrangement requires the disclosure of customer information, the bank has obtained the consent in writing of the customer or, if the customer is deceased, the customer’s appointed personal representative, for the bank to disclose the customer information to the service provider or the sub￾contractor, as the case may be.
6.2 Paragraph 6.1 does not apply where the customer information pertains to a
customer which is –
(a) a company which carries on banking business; or (b) a financial institution designated by the Authority by notice in writing for the purposes of the definition of “customer” in section 40A of the Act.
6.3 Where a bank in Singapore allows a material ongoing outsourced relevant service to
be sub-contracted, the bank must do all of the following:
(a) ensure that the service provider notifies the bank in writing prior to or within a reasonable time of the engagement of a sub-contractor unless the bank’s agreement for the engagement of the sub-contractor had been obtained prior to the sub-contractor’s engagement; (b) ensure that prior to obtaining or receiving any material ongoing outsourced relevant service, the bank documents its assessment that allowing the sub￾contracting arrangement for the material ongoing outsourced relevant service, or any part of it, – (i) would not pose any risks to the bank which it is not prepared, or is unable, to manage, in particular, legal, reputational, technological and operational risks; and

(ii) would not compromise:
(A) the provision of the relevant service to the bank; and (B) the confidentiality and integrity of all information disclosed to, or accessed, collected, copied, modified, used, stored or processed by, the service provider or the sub-contractor, as the case may be, in accordance with the outsourcing agreement and sub￾contracting arrangement respectively; (c) ensure that the bank regularly reviews its assessment in paragraph (b), and documents any changes to its assessment, including the reasons for the changes.
7. Outsourcing Agreement and Access to Information relating to
Material Ongoing Outsourced Relevant Services
7.1 For the purposes of section 47A(2)(b) and 47A(4)(b) of the Act, before obtaining a
material ongoing outsourced relevant service, a bank in Singapore must enter into an outsourcing agreement that contains terms which achieve the same effect as all of the following:
(a) a requirement that the service provider protects the confidentiality and integrity of all information of the bank in its custody, in relation to the provision of the material ongoing outsourced relevant service; (b) a requirement that the service provider ensures that it and its employees only access, collect, copy, modify, use, store or process any customer information of the bank to the extent that is necessary for it and its employees to provide the material ongoing outsourced relevant service; (c) a requirement that the service provider ensures that it and its employees do not disclose any customer information of the bank to any third party unless compelled by law, in which case the service provider must notify the bank as soon as practicable to the extent permitted by law; (d) a requirement that the Authority, or an auditor appointed by the Authority, be allowed to audit the books, systems and premises of the service provider for the purposes of determining whether the service provider is properly providing the material ongoing outsourced relevant service and assessing – (i) the ability of the service provider to – (A) ensure continuity of the material ongoing outsourced relevant service;

(B) safeguard the confidentiality and integrity of all information in its custody, in relation to the provision of the material ongoing outsourced relevant service; and (C) manage its legal, reputational, technological and operational risks arising from the provision of the material ongoing outsourced relevant service; and (ii) the level of compliance of the service provider with written laws related to the provision of the material ongoing outsourced relevant service; (e) a requirement that the service provider, on a request by the bank, provides to the bank or the Authority, or any person appointed by the bank or the Authority, any record, document, report or information relating to the provision of the material ongoing outsourced relevant service; (f) a requirement that if the bank terminates the outsourcing agreement or stops receiving the material ongoing outsourced relevant service provided by the service provider, the service providerensures that all customerinformation given to the service provider are deleted, destroyed or rendered unusable as soon as possible except where – (i) the service provider is prohibited from doing so by written law or foreign laws, in the case where the material ongoing outsourced relevant service is performed overseas; or (ii) in the case where the service provider is an intragroup entity, the record, document or information is stored in a system of the service provider which, upon the termination of the outsourcing agreement, can only be accessed by the bank; and (g) a requirement that the bank may terminate the outsourcing agreement or stop receiving the material ongoing outsourced relevant service from the service provider under any of the following circumstances:
(i) by giving reasonable notice to the service provider; (ii) if directed by MAS to terminate the outsourcing agreement or to stop receiving the material ongoing outsourced relevant service from the service provider; (iii) if the service provider or a sub-contractor, where applicable, has failed to safeguard the confidentiality or integrity of customer information of the bank that is in the custody of the service provider or sub-contractor,

where applicable, in relation to the provision of the material ongoing outsourced relevant service; (iv) if there has been a demonstrable deterioration in the ability of the service provider or a sub-contractor, where applicable, to safeguard the confidentiality or integrity of the customer information in its custody.
7.2 Where an intragroup entity of the bank in Singapore has entered into an outsourcing
agreement on behalf of the bank, the bank must ensure that the terms set out in paragraph
7.1 are included in the outsourcing agreement before obtaining or receiving the material
ongoing outsourced relevant service.
8. Protection of Customer Information relating to Material Ongoing
Outsourced Relevant Services
8.1 A bank in Singapore that receives a material ongoing outsourced relevant service
from a service provider must implement adequate measures to protect customer information that is disclosed to the service provider or sub-contractor, as the case may be, against unauthorised disclosure, access, collection, copying, modification, use, disposal or similar risks. The bank must at the minimum ensure that the measures include all of the following:
(a) notifying the service provider in writing of – (i) the bank’s obligation to keep customer information confidential under the Act and common law; (ii) the service provider’s obligation to keep customer information confidential under the Act; and (iii) in the case where the material ongoing outsourced relevant service is to be performed outside Singapore, the bank’s obligations to protect customer information in accordance with the laws of the place where the material ongoing outsourced relevant service is to be performed; (b) ensuring that customer information is disclosed to, or accessed, collected, copied, modified, used, stored or processed by, a service provider and its employees or a sub-contractor and its employees only to the extent that is necessary for the service provider or the sub-contractor, and their respective employees, as the case may be, to provide the material ongoing outsourced relevant service.

9. Audit of Material Ongoing Outsourced Relevant Services
   9.1 Subject to paragraph 9.2, a bank in Singapore must conduct independent audits on
   each of its material ongoing outsourced relevant services, for the purposes mentioned in paragraph 7.1(d) at least once every three years.
   9.2 Where any material ongoing outsourced relevant service is provided by an
   intragroup entity, the bank must ensure that independent audits are conducted on the material ongoing outsourced relevant service for the purposes mentioned in paragraph 7.1(d) and at a frequency approved by the board that is commensurate with the nature, scope and complexity of the relevant service.
   9.3 The bank must, upon request by the Authority, provide the Authority with copies of,
   or access to, the reports of the independent audits referred to in paragraphs 9.1 and 9.2, within such time as may be specified by the Authority.
10. Termination of Material Ongoing Outsourced Relevant Services
    10.1 If any of the circumstances specified in paragraph 10.3 has arisen, a bank in
    Singapore must –
    (a) where the circumstance is one referred to in paragraph 10.3(a) or 10.3(e), or both:
    (i) consider whether to exercise its right to terminate the outsourcing agreement or to stop receiving the material ongoing outsourced relevant service from the service provider, and document the bank’s considerations; and (ii) if it decides to terminate the outsourcing agreement or to stop receiving the material ongoing outsourced relevant service from the service provider, notify the Authority of the circumstances that have arisen as soon as possible; or (b) in all other cases, consider whether to exercise its right to terminate the outsourcing agreement or to stop receiving the material ongoing outsourced relevant service from the service provider, and document the bank’s considerations.
    10.2 Upon the termination of the outsourcing agreement relating to a material ongoing
    outsourced relevant service, the bank in Singapore must ensure that all customer information given to the service provider or sub-contractor, where applicable, are removed from the possession of the service provider or sub-contractor, as the case may be, or deleted, destroyed or rendered unusable as soon as possible except where –

(a) the service provider or sub-contractor, as the case may be, is prohibited from doing so by written law or foreign laws, in the case where the material ongoing outsourced relevant service is performed overseas; or (b) in the case where the service provider or sub-contractor is a branch or office of the bank, the customer information is stored in a system used by the bank which upon the termination of the outsourcing agreement, can only be accessed by the bank.
10.3 The circumstances referred to in paragraph 10.1 are:
(a) the service provider or sub-contractor, where applicable, has failed to safeguard the confidentiality or integrity of information of the bank that is in the custody of the service provider or sub-contractor, where applicable, in relation to the provision of the material ongoing outsourced relevant service; (b) the service provider has failed to comply with any written law related to the provision of the material ongoing outsourced relevant service; (c) the service provider has undergone or is undergoing a change in ownership and where such a change might adversely affect whether the bank is able to satisfy itself of the service provider’s ability to provide the material ongoing outsourced relevant service based on the framework in paragraph 5.1 of this Notice; (d) there has been a deterioration in the ability of the service provider to provide the material ongoing outsourced relevant service in accordance with the outsourcing agreement; (e) there has been a demonstrable deterioration in the ability of the service provider or sub-contractor, where applicable, to safeguard the confidentiality or integrity of the customer information in its custody; (f) the bank or any person appointed by the bank is prevented by the service provider, from obtaining any record, document, report or information relating to the provision of material ongoing outsourced relevant service; and (g) the bank is prevented by the service provider from assessing the service provider’s compliance with the outsourcing agreement.
11. Material Ongoing Outsourced Relevant Services obtained or
received from an Overseas Regulated Financial Institution
11.1 For material ongoing outsourced relevant services where the service provider or a
sub-contractor is an overseas regulated financial institution, a bank in Singapore must –

(a) implement measures to ensure that the bank and the Authority (in accordance with the Act) have access to customer information and any record, document, report or information relating to the provision of the service by the service provider; and (b) ensure that customer information relating to the material ongoing outsourced relevant service of the bank is adequately protected when accessed by a supervisory authority of the service provider or sub-contractor, as the case may be.
11.2 For the purposes of paragraph 11.1(b), the bank must provide all of the following to
the Authority:
(a) a written set of policies and procedures of the bank for managing requests for any customer information of the bank that is in the possession of the service provider or sub-contractor (“the Customer Information”) from the supervisory authority to the bank or the service provider or sub-contractor, as the case may be. The bank must ensure that the written policies and procedures at the minimum set out the criteria under which the bank or the service provider or sub-contractor, as the case may be, may disclose the Customer Information to the supervisory authority and how the bank will ensure that it is notified of any requests for Customer Information from the supervisory authority; (b) a written undertaking to notify the Authority in writing of any disclosure of Customer Information to the supervisory authority, within 14 working days after such disclosure.
SECTION C. REQUIREMENTS RELATING TO OUTSOURCED RELEVANT
SERVICES THAT INVOLVE THE DISCLOSURE OF CUSTOMER INFORMATION
12.1 A bank in Singapore which obtains or receives an outsourced relevant service that is
a material ongoing outsourced relevant service does not need to comply with the requirements in Section C in respect of the outsourced relevant service. Evaluation of Service Provider relating to Outsourced Relevant Services
12.2 For the purposes of section 47A(2)(a) and 47A(4)(a) of the Act, before obtaining an
outsourced relevant service which involves the disclosure of customer information, to evaluate the ability of the service provider to safeguard the confidentiality and integrity of customer information disclosed to, or accessed, collected, copied, modified, used, stored or processed by, the service provider, a bank in Singapore must conduct due diligence checks to assess and be satisfied of all of the following matters at the minimum:
(a) the service provider’s reputation and track record for safeguarding the confidentiality and integrity of customer information in its custody;

(b) the service provider’s ability to ensure that employees who are authorised to access the customer information are subject to confidentiality obligations; (c) the measures that the service provider has put in place to safeguard the confidentiality and integrity of customer information of the bank that is in the custody of the service provider, in relation to the provision of the relevant service.
12.3 A bank in Singapore must satisfy itself, on an ongoing basis, of the service provider’s
ability to safeguard the confidentiality and integrity of customer information disclosed to, or accessed, collected, copied, modified, used, stored or processed by, the service provider.
12.4 A bank in Singapore must document the due diligence checks required under
paragraphs 12.2 and 12.3 and furnish the documentation to the Authority upon request.
12.5 Notwithstanding paragraphs 12.2 and 12.3, a bank in Singapore may rely on a third
party to perform the due diligence checks required under paragraphs 12.2 and 12.3 if the bank is satisfied that the third party it intends to rely on is able to perform the due diligence checks.
12.6 Where a bank in Singapore places reliance on a third party to perform the due
diligence checks required under paragraphs 12.2 and 12.3, the bank must – (a) document the basis for its satisfaction that the requirements in paragraph 12.5 have been met; (b) obtain from the third party a record, document or report, or information setting out the basis for the third party’s assessment pursuant to the due diligence checks; and (c) review the third party’s evaluation of the service provider.
12.7 To avoid doubt, notwithstanding any reliance on a third party in accordance with
paragraph 12.5, the bank in Singapore remains responsible for its obligations mentioned in paragraphs 12.2 to 12.4. Outsourcing Agreement and Access to Information relating to Outsourced Relevant Services
12.8 For the purposes of section 47A(2)(b) and 47A(4)(b) of the Act, before obtaining an
outsourced relevant service which involves the disclosure of customer information, a bank in Singapore must enter into an outsourcing agreement with the service provider, which must include all of the following:

(a) a requirement that the service provider protects the confidentiality and integrity of all customer information; (b) a requirement that the service provider ensures that the service provider and its employees only access, collect, store, process or use any customer information to the extent that is necessary for the service provider to provide the outsourced relevant service; (c) a requirement that the service provider ensures that the service provider and its employees do not disclose any customer information to any third party unless compelled by law, in which case the service provider must notify the bank as soon as practicable to the extent permitted by law; (d) a requirement that the service provider, on a request by the bank, satisfies the bank, its auditors, the Authority or any person appointed by the Authority, by the production of such evidence or information as the relevant person may require, that the service provider is in compliance with paragraph (a); (e) a requirement that the bank may terminate the outsourcing agreement or stop receiving the outsourced relevant service from the service provider under any of the following circumstances:
(i) theservice provider has failed to safeguard the confidentiality or integrity of the customer information in its custody; (ii) there has been a demonstrable deterioration in the ability of the service provider to safeguard the confidentiality or integrity of the customer information in its custody. Protection of Customer Information relating to Outsourced Relevant Services
12.9 A bank in Singapore that receives an outsourced relevant service which involves the
disclosure of customer information must implement adequate measures to protect such customer information that is disclosed to the service provider against unauthorised disclosure, access, collection, copying, use, modification, disposal or similar risks. The bank must at the minimum ensure that the measures include all of the following:
(a) notifying the service provider in writing of – (i) the bank’s obligation to keep customer information confidential under the Act and common law; (ii) the service provider’s obligation to keep customer information confidential under the Act; and

(iii) in the case where the outsourced relevant service is to be performed outside Singapore, the bank’s obligations to protect customer information in accordance with the laws of the place where the outsourced relevant service is to be performed; (b) ensuring that customer information is disclosed to, or accessed, collected, copied, modified, used, stored or processed by, a service provider and its employees only to the extent that is necessary for the service provider and its employees to provide the outsourced relevant service. Termination of Outsourced Relevant Services
12.10 If any of the circumstances specified in paragraph 12.8(e) arise, a bank in Singapore
must:
(a) notify the Authority of the circumstances that have arisen as soon as possible; (b) consider whether to exercise its right to terminate the outsourcing agreement or to stop obtaining or receiving the outsourced relevant service from the service provider, and document the bank’s considerations; and (c) exercise its right to terminate the outsourcing agreement or to stop obtaining or receiving the outsourced relevant service from the service provider if the Authority directs the bank to do so, having regard to public interest or the interest of depositors.
12.11 Upon the termination of the outsourcing agreement relating to an outsourced
relevant service that involves the disclosure of customer information or when a bank in Singapore stops obtaining or receiving an outsourced relevant service that involves the disclosure of customer information, the bank must ensure that all customer information given to the service provider are removed from the possession of the service provider or deleted, destroyed or rendered unusable as soon as possible except where – (a) the service provider is prohibited from doing so by written law or foreign laws, in the case where the outsourced relevant service is performed overseas; or (b) in the case where the service provider is a branch or office of the bank in Singapore, the customer information is stored in a system used by the bank which upon the termination of the outsourcing agreement, can only be accessed by the bank.
SECTION D. GROUP POLICY RELATING TO OUTSOURCED RELEVANT
SERVICES

13. Group Policy
    13.1 Subject to paragraph 13.2, a bank incorporated in Singapore must implement a
    group policy relating to outsourced relevant services to ensure that each of its branches comply with all requirements in this Notice, as if it were a bank in Singapore.
    13.2 Where a branch of a bank in Singapore, that is located outside Singapore, obtains or
    receives material ongoing outsourced relevant services, the bank may elect not to comply with paragraph 7.1 as if the branch was a bank in Singapore provided the bank ensures the branch has entered into an outsourcing agreement with the service provider and the bank documents and satisfies itself that the risks from not complying with paragraph 7.1 would be addressed and how the bank would so address the risks.
    SECTION E. EFFECTIVE DATES OF REQUIREMENTS IN THIS NOTICE
14. EFFECTIVE DATES
    14.1 This Notice, other than paragraphs 7.1 and 12.8, takes effect on 11 December 2024.
    14.2 Paragraph 7.1 takes effect on the following dates:
    (a) where the outsourcing agreement relating to a material ongoing outsourced relevant service is entered into prior to 11 December 2023, on the date which the bank next extends the tenure of the outsourcing agreement or 11 December 2024, whichever is later. (b) where the outsourcing agreement relating to a material ongoing outsourced relevant service is entered into:
    (i) between 11 December 2023 and 11 December 2024 (both dates inclusive), on the date which the bank next extends the tenure of the outsourcing agreement or 11 December 2024, whichever is later; or (ii) after 11 December 2024, on the date which the bank enters into the outsourcing agreement;
    14.3 To avoid doubt, in the case where a bank in Singapore assesses an ongoing
    outsourced relevant service to be a material ongoing outsourced relevant service after 11 December 2023, paragraph 7.1 takes effect on the date on which the bank next extends the tenure of the outsourcing agreement in respect of such relevant service or 11 December 2024, whichever is later.
    14.4 Paragraph 12.8 takes effect on the following dates:
    (a) where the outsourcing agreement relating to an outsourced relevant service which involves the disclosure of customer information is entered into prior to 11 December 2023, on the date which the bank next extends the tenure of the outsourcing agreement or 11 December 2024, whichever is later.

(b) where the outsourcing agreement relating to an outsourced relevant service which involves the disclosure of customer information is entered into:
(i) between 11 December 2023 and 11 December 2024 (both dates inclusive), on the date which the bank next extends the tenure of the outsourcing agreement or 11 December 2024, whichever is later; or (ii) after 11 December 2024, on the date which the bank enters into the outsourcing agreement.

Annex A
RELEVANT SERVICES INTEGRAL TO ANY BUSINESS THAT THE BANK MAY CARRY ON UNDER SECTION 30(1) OF THE ACT

1. Processing of applications such as those relating to loan origination and credit
   cards;
2. Middle and back office operations such as electronic funds transfer (excluding
   services under paragraph 1(xi), (xii), (xiii) of Annex B), maintaining the register of participants of a collective investment scheme (CIS) (as defined in section 2(1) of the Securities and Futures Act 2001), sending of accounts and reports to CIS participants, processing of trade orders, trade settlement and risk management;
3. Administration of claims such as loan negotiations, loan processing, collateral
   management and collection of bad loans;
4. Processing of documents such as cheques, credit card and bill payments, bank
   statements, other corporate payments and customer statement printing;
5. Investment management such as discretionary portfolio management, cash
   management;
6. Calculation of any financial benchmark (as defined in section 2(1) of the
   Securities and Futures Act 2001);
7. White-labelling arrangements such as for trading and hedging facilities;
8. Marketing or research conducted in the name of the bank or cobranded with
   the name of the bank, or where such marketing or research involves the bank’s confidential information or customers’ information;
9. Professional services related to the business activities of the bank, such as
   accounting, internal audit, actuarial or compliance services;
10. Performance of name screening services by third party providers for anti￾money laundering and countering the financing of terrorism (AML/CFT) or
    know-your-client (KYC) purposes on behalf of the bank.;
11. Due diligence performed on potential customers; and
12. Card embossing services.

Annex B
RELEVANT SERVICES THAT ARE EXCLUDED FROM THE DEFINITION OF OUTSOURCED RELEVANT SERVICE The following are relevant services that are excluded from the definition of “outsourced relevant service” in paragraph 2.1 of the Notice:

1. The following relevant services that require the use of third-party providers
   because of the characteristics of the service provided:
   (i) custody account services provided by any person referred to in regulation 27(1) or (3) of the Securities and Futures (Licensing and Conduct of Business) Regulations (“Regulations”) for the purposes of the bank maintaining a custody account as required under regulation 27 of the Regulations; (ii) telecommunication services and public utilities such as electricity, SMS gateway services; (iii) postal services as defined in section 2(1) of the Postal Services Act 1999 (“Postal Services Act”) that is provided by any person licensed under
   section 6 of the Postal Services Act;
   (iv) market information services such as those provided by Bloomberg, Moody’s and Standard & Poor’s; (v) payment card network infrastructure such as those provided by Visa, MasterCard; (vi) clearing and exchanging of articles by the Automated Clearing House established under regulation 3 of the Banking (Clearing House) Regulations; (vii) global financial messaging infrastructure provided by Society for Worldwide Interbank Financial Telecommunication (SWIFT); (viii) correspondent banking services; (ix) services provided by credit bureaus relating to the disclosure and obtaining of credit-related information; (x) services provided by MAS such as MEPS+;

(xi) services provided via payments systems such as those provided via Fast And Secure Transfers (FAST), Interbank GIRO (IBG), NETS EFTPOS, Grabpay or Paypal; (xii) services provided via central addressing system provided via PayNow; (xiii) bill payment services provided by AXS Pte Ltd and SingPost Self-Service Automated Machines (SAM); (xiv) training on usage and technical support of third-party IT tools (including Commercial Off-The-Shelf software) by a vendor who developed the IT tools; (xv) supply and maintenance of equipment for incident management or emergency use such as fire protection, physical surveillance, power supply disruption, emergency communications and personal protection1 ; (xvi) advisory services, including services provided under a retainer arrangement, such as the provision of legal opinions, independent appraisals, advisory services by trustees in bankruptcy, loss adjusters and specialised tax advisory services; (xvii) expert assessment or independent consulting for areas where the bank does not have the internal expertise to conduct; and (xviii) services provided by any of the following persons in the course of operating an organised market, or a clearing facility or carrying on business in a regulated activity, as the case may be:
(a) approved exchange;
(b) overseas exchange;
(c) approved clearing house;
(d) recognised clearing house;
(e) recognised market operator;
(f) holder of a capital markets services licence; (g) exempt person; (h) a person operating an organised market or a clearing facility or carrying on business in a regulated activity outside of Singapore that is regulated by a financial services regulatory authority of a country or jurisdiction other than Singapore 1 Personal protection refers to protection and minimisation of staff’s exposure to injuries or infection. In this context, this term refers to Personal Protection Equipment (PPE). Masks and bullet-proof vests would be examples of PPE.

The persons referred to in paragraph 1(xviii) have the meanings given by
section 2(1) of the Securities and Futures Act 2001.
2. The following relevant services relating to introducer arrangements and
principal-agent relationships:
(i) sale of insurance policies by agents on behalf of the bank and ancillary services relating to those sales; (ii) introducer arrangements between the bank and an introducer, where the bank does not have any existing contractual relationship with the person introduced.
3. Statutory audit and independent audit assessments performed by external
auditors, which the bank is not legally able to perform or not able to perform due to conflict of interest.

Annex C
RELEVANT SERVICES CONSIDERED AS OUTSOURCED RELEVANT SERVICES

1. Public cloud services including, but not limited to, software-as-a-service,
   platform-as-a-service and infrastructure-as-a-service2 ;
2. Hosting of information systems, and managing and maintenance of
   information systems including but not limited to end-user support, local or wide area networks management and information technology security operations;
3. Information technology helpdesks services;
4. Data centre operations or data centre facilities management services;
5. Support services relating to archival, storage and destruction of data and
   records relating to the bank’s confidential and/or customer information;
6. Services relating to manpower management including but not limited to
   payroll processing, benefits and compensation administration and recruitment;
7. Corporate secretariat services;
8. Services relating to the facilitating or execution of electronic signatures;
9. Services relating to the maintenance of automated teller machines.
   “Infrastructure-as-a-Service” (IaaS) refers to a business model that typically involves providing customers with IT infrastructure (e.g. servers and storage) over the internet on a pay-per-use basis. “platform-as-a￾service” (PaaS) refers to a business model that typically involves supplying customers with an on-demand environment for developing, running and managing software applications over the internet. “software-as-a￾service” (SaaS) refers to a business model that typically involves allowing customers to connect to and use cloud-based applications over the internet on a subscription basis.

Annex D
EXEMPTED OUTSOURCED RELEVANT SERVICES

1. Outsourced relevant services wholly provided by Government Technology
   Agency (GovTech) or agents appointed by GovTech. The full list of services can be found at https://api.singpass.gov.sg/singpass-api-products.
2. Outsourced relevant services that are not performed for the purposes of
   carrying on any businesses referred to in section 30(1) of the Act and where the service provider does not receive, handle or have access to the bank's confidential information or customer information. Examples of such relevant services include cleaning, gardening and pantry services including the maintenance of vending machines.