MAS TRM Notice Explained: The 4-Hour Downtime and 1-Hour Reporting Rules When Systems Go Down
For most Singapore offices, a morning without email is an irritation. For a financial institution, any system outage raises a sharper question: does this fall under MAS's technology risk rules, and has a clock started?
The quick answer: MAS's Notices on Technology Risk Management set four numbers for critical systems: no more than 4 hours of unscheduled downtime in any 12 months, a recovery time objective of no more than 4 hours, notification to MAS within 1 hour of discovering a relevant incident, and a root cause report within 14 days. Whether a particular system is "critical" is for each institution to determine under the Notice's definition.
This article explains what the Notice says, using MAS's own text. It does not say whether the Microsoft 365 outage of 13 November 2026 triggered these rules for any institution. That is a judgement for each firm's compliance and technology risk teams.
What is the MAS Notice on Technology Risk Management?
MAS issues Notices on Technology Risk Management to different classes of financial institution, including banks, merchant banks, finance companies, insurers, credit and charge card licensees and payment service providers. The Notices are legally binding requirements, and each class has its own numbered Notice with the same core rules.
The quotations in this article are drawn from MAS Notice FSM-N13, issued on 9 May 2024, which applies to operators and settlement institutions of designated payment systems and to digital payment token service providers. Check the Notice that applies to your own licence.
Source: MAS, Notice FSM-N13 on Technology Risk Management.
What is a "critical system" under the MAS TRM Notice?
| Term | What the Notice says, paraphrased |
|---|---|
| Critical system | A system whose failure will cause significant disruption to the entity's operations or materially impact its service to customers, such as a system that processes time-critical transactions or provides essential services to customers |
| System malfunction | A failure of any of the entity's critical systems |
| IT security incident | A security breach against a critical system, such as hacking, intrusion or a denial-of-service attack, or one that compromises the security, integrity or confidentiality of customer information |
| Relevant incident | A system malfunction or IT security incident that has a severe and widespread impact on operations or materially impacts service to customers |
Note the word "critical". Email and collaboration tools may or may not meet that definition in a given institution. The Notice leaves that identification to the institution.
What are the 4-hour and 1-hour rules?
| Requirement | What the Notice requires |
|---|---|
| Availability | Make all reasonable effort to maintain high availability for critical systems. Maximum unscheduled downtime for each critical system that affects operations or service to customers must not exceed a total of 4 hours within any period of 12 months |
| Recovery time objective | An RTO of not more than 4 hours for each critical system, validated and documented through recovery testing at least once every 12 months |
| Notification | Notify MAS as soon as possible, but not later than 1 hour, upon the discovery of a relevant incident |
| Root cause report | Submit a root cause and impact analysis report within 14 days, or such longer period as MAS may allow, covering an executive summary, the root cause, the impact and the remedial measures |
In June 2026, MAS consulted on proposed amendments to these Notices. According to law firm Allen & Gledhill's summary, one proposal would make explicit that partial or intermittent disruption counts towards unscheduled downtime. Check MAS's website for the current status of that consultation.
Source: MAS, Notice FSM-N13; Allen & Gledhill, MAS consults on proposed amendments to Notices on Technology Risk Management.
What should a financial institution check after a cloud outage?
This checklist is SourceIT's general guidance, not a regulatory interpretation.
- Check your critical systems register. Was any system on it affected, directly or through a dependency on the cloud service?
- Record the timeline: when the disruption was discovered, how long each affected system was unavailable, and when it was restored.
- Ask compliance whether the incident is a relevant incident under your Notice. That decision belongs to them.
- Keep the provider's incident references and report. For the 13 November incident, Microsoft's references are EX1550543 and MO1550821.
- Review third-party dependencies. Note which critical processes rely on a single cloud service and what the fallback is.
- Test recovery against your RTO if the incident exposed a gap.
Four hours a year is a small allowance. It pays to know in advance which of your systems are spending it.
Does this apply to non-financial businesses?
No. These Notices apply to MAS-regulated financial institutions. Other Singapore businesses have no equivalent downtime rule, though the same discipline is useful: know which systems matter most, set a recovery target and test it. See backup is not disaster recovery and what CSA Cyber Essentials says about backup and incident response.
Getting help in Singapore
For resilient infrastructure, backup and UPS, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
What is the MAS 4-hour downtime rule? Under MAS's Notices on Technology Risk Management, maximum unscheduled downtime for each critical system must not exceed a total of 4 hours within any period of 12 months.
How quickly must a financial institution notify MAS of an incident? As soon as possible, but not later than 1 hour, upon the discovery of a relevant incident.
When is the root cause report due? Within 14 days of discovering the relevant incident, or such longer period as MAS may allow.
What is a critical system? A system whose failure will cause significant disruption to the institution's operations or materially impact its service to customers.
This article is general information compiled from the MAS sources linked above as at 13 November 2026. It is not legal or regulatory advice and is not a statement by or on behalf of MAS or Microsoft. Refer to the Notice that applies to your institution and consult your compliance team.
SourceIT Approved
Researched and verified by the SourceIT team for Singapore buyers.
