Financial institutions regulated by the Monetary Authority of Singapore operate under two parallel security frameworks that interact in ways most compliance teams do not fully address together.
The MAS Technology Risk Management (TRM) guidelines govern how institutions test the security of their own systems. The MAS Guidelines on Outsourcing govern how institutions manage and oversee the security of material third-party service providers. Together, they create a security testing obligation that extends well beyond the institution's own perimeter.
The gap most institutions carry is in the second half. They have a penetration testing program for their own applications. They have a vendor register and a due diligence questionnaire process for third parties. What they frequently lack is a structured approach to security testing of material outsourced systems, which the Outsourcing Guidelines require but which most VAPT programs are not scoped to satisfy.
This post explains what the MAS Outsourcing Guidelines require from a security testing perspective, where most institutions fall short, and what a testing program looks like that satisfies both the TRM and Outsourcing obligations together.
MAS Technology Risk Management Guidelines (2021)
The TRM guidelines govern the technology risk management practices of MAS-regulated financial institutions. They require penetration testing of the institution's own systems, specify frequency requirements that scale with system criticality, mandate post-change testing, and require that findings be remediated within defined timelines with retesting to confirm.
The MAS TRM penetration testing requirements post covers the nine specific gaps most institutions have in their own-systems testing program. This post addresses the separate and additional obligation created by the Outsourcing Guidelines.
MAS Guidelines on Outsourcing
The Outsourcing Guidelines govern how financial institutions select, contract with, monitor, and oversee third-party service providers handling material functions. They apply to banks (under MAS Notice 654), capital markets intermediaries (under MAS Notice 658), and other regulated financial institutions under institution-type-specific notices.
The guidelines define material outsourcing as outsourcing arrangements where adverse developments could significantly impact the institution's business operations, reputation, or ability to comply with laws. Cloud service providers, core banking system vendors, payment processors, and technology service providers hosting critical infrastructure all typically qualify as material outsourcing arrangements.
The MAS Outsourcing Guidelines contain several provisions that directly affect how financial institutions must approach security testing of outsourced systems.
Before entering a material outsourcing arrangement, institutions are required to conduct due diligence on the service provider's security controls, including their security testing practices. This is not a one-time checkbox. The guidelines specify ongoing due diligence, which means the institution must have a process for maintaining current knowledge of the service provider's security posture throughout the relationship.
In practice, this means relying solely on a third-party questionnaire completed at contract signing is insufficient. Institutions need evidence of the service provider's penetration testing practices, the recency and scope of their testing, and the findings and remediation status from recent assessments.
The Outsourcing Guidelines require institutions to secure the right to audit material service providers, either directly or through independent third parties. This audit right must be exercisable, not merely documented. MAS examiners have asked institutions to demonstrate that they have exercised audit rights, not just that the right exists in the contract.
Security testing is a form of technical audit. For institutions whose material service providers host systems that store or process customer data or execute critical financial functions, the audit right provision creates a legal basis for requiring the service provider to undergo penetration testing and to share results.
The guidelines require institutions to identify and manage concentration risk where multiple critical functions are outsourced to the same provider or where a single provider's failure could cause systemic operational disruption. They also require that sub-outsourcing arrangements be governed with equivalent rigor.
This provision extends the security testing obligation across the full outsourcing chain. An institution that outsources core banking to a technology vendor who sub-outsources infrastructure to a cloud provider retains responsibility for understanding the security posture of the full chain. A penetration testing program that covers the bank's own systems but not the critical vendor systems that handle banking transactions does not satisfy this obligation.
The Outsourcing Guidelines require that material outsourcing arrangements include provisions for business continuity planning and incident response, including regular testing. Security incidents at service providers that affect the institution's operations fall under this provision, which means the institution's security testing program should include scenarios that model disruption originating from outsourced systems.
Gap 1: Outsourced systems are not in pentest scope
The most common gap is the simplest: the institution's annual penetration test is scoped to its own infrastructure and applications, and the systems managed by material service providers are explicitly or implicitly out of scope. When the core banking system is a vendor-hosted SaaS platform, the customer portal is managed by a fintech partner, and payment processing is handled by a third-party processor, a penetration test that covers only the institution's own perimeter is testing a small fraction of the attack surface that matters.
The Outsourcing Guidelines do not require institutions to conduct penetration tests of service providers' infrastructure at will. They do require institutions to have mechanisms for assessing and maintaining knowledge of the security posture of material outsourced systems. In practice, this means either conducting penetration tests of the interface layers that connect the institution to the service provider, requiring the service provider to produce recent third-party penetration test results under the audit right provision, or conducting targeted security assessments of the APIs and integration points through which the institution interacts with outsourced systems.
Gap 2: API and integration security is not tested
Even institutions that conduct thorough internal penetration testing frequently do not test the API connections between their own systems and material service providers with the same rigor they apply to internal surfaces.
API connections to third-party systems present distinct security risks: authentication tokens with broad permissions, data flows that expose customer information in transit, and integration endpoints that may have weaker security controls than the core systems they connect to. API vulnerabilities standard penetration tests miss covers the eight specific API vulnerability classes that fall outside standard web application testing methodology, all of which are directly relevant to the integration layers that most material outsourcing arrangements create.
Gap 3: Due diligence evidence becomes stale
A service provider's penetration test report produced at contract signing describes the security posture of that provider's systems at that moment. Twelve months later, the provider's systems have changed, new vulnerabilities have been disclosed, and the evidence that satisfied due diligence when the contract was signed is no longer current.
The Outsourcing Guidelines' ongoing due diligence requirement means institutions need a process for maintaining current security evidence from material service providers, not just onboarding documentation. Annual questionnaire refresh without updated penetration testing evidence does not satisfy the ongoing requirement for material outsourcing arrangements where the security of outsourced systems is critical to the institution's operations.
A penetration testing program that satisfies both MAS TRM and the Outsourcing Guidelines has four components.
Own-systems testing at TRM frequency. Penetration testing of the institution's own systems, applications, and infrastructure at the frequency the TRM guidelines specify, with post-change testing following significant deployments. This is the foundation that most institutions have in some form.
Integration layer testing. Penetration testing of the API and integration surfaces that connect the institution to material service providers. This covers the authentication mechanisms, data flows, and authorization boundaries that govern what service provider systems can access within the institution's environment and what the institution's systems can access within the provider's environment.
Material service provider assessment program. A structured process for obtaining, reviewing, and maintaining current penetration testing evidence from material service providers. This includes exercising audit rights, requiring third-party penetration test results as a contractual obligation, reviewing findings and remediation status, and escalating where providers cannot produce current evidence.
Incident response and business continuity testing. Periodic testing of scenarios that model security incidents originating from outsourced systems, including the institution's ability to detect, contain, and respond to incidents that begin with a compromise of a service provider's systems.
A continuous agentic penetration testing model addresses several of the Outsourcing Guidelines obligations more effectively than periodic manual engagements.
For own-systems testing, continuous agentic testing provides the post-change coverage that MAS TRM's post-deployment testing requirement demands. When infrastructure changes, the system tests automatically, producing evidence that the updated environment was assessed before subsequent deployments. The continuous penetration testing model covers how deployment-triggered testing eliminates the detection gaps that periodic engagements leave open.
For integration layer testing, agentic systems can test the API and integration surfaces connecting the institution to service providers continuously, flagging changes in the security of integration points as service providers update their systems on their own deployment schedules.
For compliance evidence, continuous agentic testing produces a running timestamped record that satisfies MAS examiners' expectations for ongoing security validation rather than point-in-time reports. How autonomous pentesting produces a continuous compliance evidence record covers what this looks like in practice and how it maps to the documentation expectations in both MAS TRM and the Outsourcing Guidelines.
The agentic pentesting and continuous security validation model is the operational foundation that makes the frequency and coverage requirements of both frameworks achievable without proportionally scaling the security testing budget.
For compliance and risk officers reviewing whether their penetration testing program satisfies both MAS TRM and the Outsourcing Guidelines:
Map material outsourcing arrangements against the testing program. List every material outsourcing arrangement. For each, confirm whether the institution has current (less than twelve months old) penetration testing evidence from the service provider and whether the integration layer is within the institution's own pentest scope.
Review outsourcing contracts for audit right language. Confirm that contracts with material service providers include explicit language granting the right to audit security controls, and that this right can be exercised to require penetration testing results.
Assess API and integration coverage. Review whether the current penetration testing scope includes the authentication and authorization mechanisms governing API connections to material service providers, the data flows that pass customer information to and from outsourced systems, and the endpoints through which service providers access the institution's infrastructure.
Build an ongoing due diligence cadence. Establish a process for annual refresh of penetration testing evidence from material service providers, aligned to the MAS TRM frequency requirements that apply to critical systems.
For Singapore-based financial institutions seeking VAPT services in Singapore that are structured to address both TRM and Outsourcing Guidelines obligations, or PTaaS services in Singapore for continuous coverage of own-systems and integration layers, and agentic penetration testing in Singapore for the continuous deployment-triggered model, the 10x Pentest team can map your current program against both frameworks and identify where gaps exist.
See the 10x Pentest platform for how the continuous agentic model is structured, review pricing for what comprehensive coverage costs at your institution's scale, or get in touch to discuss how to build a penetration testing program that satisfies both MAS TRM and the Outsourcing Guidelines together.
Q1. What are the MAS Guidelines on Outsourcing?
The MAS Guidelines on Outsourcing are issued by the Monetary Authority of Singapore and govern how regulated financial institutions manage material outsourcing arrangements with third-party service providers. They apply to banks under MAS Notice 654, capital markets intermediaries under MAS Notice 658, and other regulated entities under institution-type-specific notices. The guidelines cover due diligence requirements, contractual protections, audit rights, sub-outsourcing oversight, business continuity requirements, and ongoing monitoring obligations. Material outsourcing is defined as arrangements where adverse developments could significantly impact the institution's business operations, reputation, or regulatory compliance.
Q2. Do the MAS Outsourcing Guidelines require penetration testing of service providers?
The guidelines do not mandate that institutions conduct penetration tests of service providers' infrastructure directly. They do require that institutions exercise ongoing due diligence over the security posture of material service providers, that audit rights be contractually secured and exercisable, and that institutions maintain current knowledge of the security controls protecting outsourced systems. In practice, satisfying these obligations for material service providers hosting critical systems means either requiring service providers to produce regular third-party penetration test results, conducting targeted security assessments of integration layers, or exercising audit rights through independent security testing where the arrangement warrants it.
Q3. How do the Outsourcing Guidelines interact with MAS TRM?
MAS TRM governs how financial institutions test the security of their own systems. The Outsourcing Guidelines extend oversight obligations to cover the security posture of material service providers. Together, they create a security testing obligation that spans the institution's own perimeter and the third-party systems that handle material functions on its behalf. An institution with a strong internal penetration testing program that satisfies TRM requirements but has no structured approach to service provider security assessment has addressed one framework and left the other substantially unmet.
Q4. What is material outsourcing under MAS guidelines?
Material outsourcing is defined as outsourcing where adverse developments would significantly impact the institution's business operations, reputation, or ability to comply with applicable laws and regulations. MAS guidance indicates that cloud hosting of core systems, payment processing, core banking platforms, and technology services essential to customer-facing operations typically qualify. Institutions are expected to classify their outsourcing arrangements and apply the full suite of Outsourcing Guidelines obligations to those classified as material.
Q5. What should a penetration testing scope include to satisfy both MAS TRM and the Outsourcing Guidelines?
A scope that satisfies both frameworks covers: own-systems testing at TRM-specified frequency with post-change testing following significant deployments; API and integration layer testing covering the authentication, authorization, and data flow mechanisms between the institution and material service providers; evidence maintenance from material service providers through contractual audit rights and periodic third-party penetration test result review; and incident response testing that models scenarios originating from service provider compromise. What is inside a VAPT report and how evidence should be structured for MAS examiner review is covered in what a VAPT report should contain for MAS examiner review.
MAS-regulated institutions in Singapore face layered VAPT obligations under TRM guidelines, outsourcing rules, and sector notices. This guide maps exactly what is required.
Tejas Dhokane Aug 3, 2026 
AI penetration testing works by deploying reasoning agents against your application surface. This buyer's guide covers how it works and the 7 vendor evaluation criteria that matter.
Tejas Dhokane Jul 31, 2026 
Continuous penetration testing runs security validation at the pace of development instead of once a year. Here is how it works, what it costs, and when it replaces annual pentests.
Tejas Dhokane Jul 31, 2026 Schedule a free consultation and see how teams like yours are strengthening their security posture — continuously.
