Guidelines issued by the Monetary Authority of Singapore ("MAS"), such as the MAS Guidelines on Outsourcing, the MAS Guidelines on Technology Risk Management and the Business Continuity Management Guidelines, do not have statutory force in that the contravention of guidelines is not a criminal offense and does not result in civil penalties. They are intended to be a set of principles or best practice standards that govern the conduct of specified institutions or persons. However, how well an institution observes the guidelines may have an impact on MAS' overall risk assessment of that institution.
Particularly where MAS is not satisfied with an institution's observance of the relevant guidelines, it may require the institution to take additional measures to address the deficiencies noted. MAS may also take noncompliance into account in its assessment of the institution, depending on various factors and the circumstances of the case. MAS may also directly communicate with the home or host regulators of the institution and the institution's service provider about their ability and willingness to cooperate with MAS in supervising the risks that outsourcing poses to the institution. In addition, MAS may require an institution to modify its outsourcing arrangements, make alternative arrangements or reintegrate an outsourced service into the institution.
Unlike guidelines, notices issued by MAS (such as the MAS Notice on Technology Risk Management) are legally binding, i.e., contravening a notice would be a criminal offense and would result in penalties/sanctions.