Skip to main content

MAS TR

The Monetary Authority of Singapore (MAS) Technology Risk Management Guidelines (TRM, last updated January 2021, with addendums through 2024) define the expectations for financial institutions operating in Singapore on technology risk, cybersecurity, and operational resilience. MAS TR applies to all MAS-regulated financial institutions (banks, insurers, capital markets intermediaries, payment services, and the new digital token services regime). Falcon Veritas Intelligence (FVI) is built for MAS-regulated institutions and ships a TR-aligned control baseline out of the box.

Scope and applicability​

MAS TR applies to:

  • All banks licensed under the Banking Act (including full banks, wholesale banks, and merchant banks)
  • Licensed insurers (direct life and general)
  • Capital markets intermediaries (CMSLs)
  • Payment services licensees (PSLs)
  • Digital payment token services licensees (DPTSLs)
  • Recognised market operators and approved clearing houses

FVI's MAS TR module documents how FVI satisfies the 25 control families across Cyber Security, IT Risk Management, IT Service Management, and Third Party Risk Management, with control evidence stored in the FVI audit trail and surfaced via the FVI evidence pack generator.

Control families​

MAS TR groups expectations into 25 control families. The highest-leverage families for an FVI deployment are:

  1. Cybersecurity training — all staff with system access must complete annual cybersecurity training. FVI's SOC 2 evidence pack contains the training matrix and completion certificates per tenant member.

  2. Access controls — least-privilege, MFA, role-based. FVI implements role-based access via Supabase Auth with MFA, supports SAML SSO and SCIM, and enforces RLS policies on every Supabase table.

  3. Encryption — data in transit (TLS 1.2+) and at rest (AES-256 or equivalent). FVI uses Cloudflare's TLS 1.3 with strict transport security, and AES-256-GCM field-level encryption via Supabase Vault for sensitive fields.

  4. Incident response — documented plan, 72-hour MAS notification for major incidents. FVI ships an incident response runbook and the security_events table captures every security-relevant event for forensic analysis.

  5. Third party risk — vendor due diligence, exit plans, ongoing monitoring. FVI's third party risk module captures vendor SOC 2 reports, penetration test results, and quarterly attestation status.

  6. Business continuity — RTO/RPO targets, regular DR testing. FVI's runbooks document the RTO (4 hours) and RPO (1 hour) targets with quarterly DR test evidence.

How FVI supports MAS TR​

FVI's compliance evidence pack generator produces a MAS TR evidence pack with:

  • 25 control family narratives mapped to FVI features
  • Configuration snapshots of encryption, MFA, and RLS
  • Audit trail extracts from security_events for the review period
  • Quarterly DR test reports
  • Vendor due diligence evidence for FVI itself (SOC 2 Type II, ISO 27001)

Step-by-step: producing a MAS TR evidence pack​

  1. Map control families. In FVI, navigate to Compliance → MAS TR → Control mapping. FVI loads the 25 control families and presents FVI features that satisfy each. Confirm or override the mapping.

  2. Configure evidence sources. Connect FVI's audit trail, configuration snapshots, and DR test results. FVI automatically pulls the most recent 90 days of evidence for each control.

  3. Capture period. Set the evidence capture period (typically 12 months for a full review cycle). FVI queries all relevant tables and produces the evidence pack.

  4. Generate the pack. FVI produces a ZIP archive containing:

    • mas_tr_control_matrix.csv — control-by-control mapping with FVI feature references
    • evidence/audit_trail.csv — security-relevant events for the period
    • evidence/encryption_baseline.csv — encryption configuration per service
    • evidence/dr_test_2026_q1.pdf — most recent DR test report
    • evidence/vendor_soc2.pdf — FVI's SOC 2 report (under NDA)

  5. Review and sign off. The tenant compliance officer reviews the pack and signs off via FVI's electronic signature.

  6. Submit to MAS. FVI does not submit directly to MAS; the licensed institution submits the pack via MASNet under their own attestation.

Code samples​

curl​

curl -X POST https://api.falconveritas.com/v1/compliance/mas/evidence-pack \
  -H "Authorization: Bearer $FVI_JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "tenantId": "'$FVI_TENANT_ID'",
    "fromDate": "2025-08-01",
    "toDate": "2026-08-22",
    "idempotencyKey": "mas-fvi-$RANDOM"
  }'

TypeScript​

import { FVI } from '@falconveritas/sdk';

const fvi = new FVI({
  baseUrl: 'https://api.falconveritas.com',
  bearer: process.env.FVI_JWT!,
  tenantId: process.env.FVI_TENANT_ID!,
});

const pack = await fvi.compliance.mas.generateEvidencePack({
  fromDate: '2025-08-01',
  toDate: '2026-08-22',
});

console.log('Evidence pack URL:', pack.url);

Python​

from falconveritas import FVI

client = FVI(
  bearer=os.environ["FVI_JWT"],
  tenant_id=os.environ["FVI_TENANT_ID"],
)

pack = client.compliance.mas.generate_evidence_pack(
  from_date="2025-08-01",
  to_date="2026-08-22",
)
print("Evidence pack URL:", pack.url)

Troubleshooting​

Last updated: 2026-08-22 · Page owner: Documentation · Source: src/lib/compliance/mas/.