[OR] [MAS] [E1] [C3] Key Principles of Operational Resilience

eBook 1: Chapter 3

 Monetary Authority of Singapore's (MAS) Key Principles of Operational Resilience

Purpose of the Chapter

This chapter outlines the core principles of operational resilience expected of financial institutions in Singapore, guided by the framework established by the Monetary Authority of Singapore (MAS).

Drawing from MAS’s guidance on “Achieving Operational Resilience for Financial Institutions in Singapore” and the Business Continuity Management (BCM) Guidelines (2022), this chapter focuses on four foundational pillars:

• Identification of Critical Business Services (CBS)
• Establishment of Recovery Time Objectives (RTO / SRTO)
• Dependency mapping across the operating ecosystem
• Adoption of a risk-based and proportional implementation approach

Together, these principles form the backbone of a service-centric resilience framework.

Identification of Critical Business Services (CBS)

Service-Centric Approach

MAS requires financial institutions to identify Critical Business Services (CBS)—services whose disruption would:

• Impact customers significantly
• Affect the institution’s safety and soundness
• Cause systemic disruption to the financial sector

This represents a shift from focusing on internal functions to external service outcomes.

Criteria for Identifying CBS

Financial institutions should assess criticality based on:

• Customer impact (e.g., inability to access funds)
• Financial impact (e.g., revenue loss or liquidity issues)
• Systemic importance (e.g., interbank dependencies)
• Regulatory obligations

MAS emphasises that CBS identification must be dynamic, requiring periodic review and updates when there are material changes in operations or dependencies.

Prioritisation of Services

Once identified, CBS must be:

• Prioritised for recovery during disruptions
• Supported by targeted resilience strategies
• Assigned clear ownership and accountability

This ensures that resources are directed towards maintaining continuous delivery of the most critical services.

Setting Recovery Time Objectives (RTO / SRTO)

Definition and Purpose

MAS requires financial institutions to establish a Service Recovery Time Objective (SRTO) for each CBS.

• SRTO: Target time to restore a service to a minimum acceptable level
• RTO: Recovery time for underlying processes or systems

SRTO provides a time-based benchmark for resilience and recovery planning.

Alignment Between SRTO and RTO

MAS emphasises alignment:

• The RTOs of underlying systems and processes must support the SRTO of the CBS
• Recovery planning must ensure end-to-end service restoration, not isolated system recovery

This ensures that the service as experienced by customers is restored within acceptable limits.

Factors in Setting SRTO

Financial institutions must consider:

• Customer expectations and service obligations
• Dependencies on other financial institutions
• Regulatory requirements
• Severity and type of disruption

SRTOs guide:

• Resource allocation during crises
• Decision-making under stress
• Measurement of resilience effectiveness

Dependency Mapping (People, Process, Technology, Third Parties)

End-to-End Mapping Requirement

MAS requires financial institutions to identify and map end-to-end dependencies supporting each CBS, including:

• People (key personnel, skills, staffing levels)
• Processes (business workflows and procedures)
• Technology (applications, infrastructure, data)
• Third parties (vendors, cloud providers, outsourcing partners)

This mapping must reflect real operational interconnections, not just organisational structures.

Purpose of Dependency Mapping

Dependency mapping enables institutions to:

• Identify single points of failure
• Assess concentration risks
• Understand interdependencies across services
• Design targeted recovery strategies

Given the increasing reliance on shared infrastructure and third-party providers, MAS highlights the importance of understanding the risks of cascading failures.

Third-Party and Ecosystem Risk

Financial institutions must:

• Ensure third parties can meet SRTO requirements
• Establish backup arrangements and exit strategies
• Continuously monitor vendor resilience

This reflects MAS’s expectation that outsourcing does not transfer accountability.

Risk-Based and Proportional Implementation

Proportionality Principle

MAS adopts a risk-based and proportional approach, requiring financial institutions to implement resilience measures based on:

• Size and scale of operations
• Complexity of services and systems
• Risk exposure and systemic importance

This ensures that resilience frameworks are practical and tailored, rather than overly prescriptive.

Risk-Based Decision Making

Institutions must:

• Prioritise high-impact services and risks
• Allocate resources based on risk severity and likelihood
• Focus on areas with the greatest potential disruption impact

This approach ensures efficient use of resources while maintaining robust resilience capabilities.

Continuous Review and Improvement

Operational resilience is not static. MAS expects:

• Regular reviews of CBS, SRTOs, and dependencies
• Continuous testing and validation
• Updates to reflect emerging risks and changing environments

Resilience must be embedded into business-as-usual operations, rather than treated as a one-off compliance exercise.

Integrated View of Key Principles

The four key principles are interdependent:

Together, they form a cohesive framework that enables financial institutions to maintain continuous service delivery under stress.

The key principles outlined by the Monetary Authority of Singapore establish a structured and service-centric approach to operational resilience in Singapore’s financial sector.

By identifying critical business services, defining recovery expectations through SRTOs, comprehensively mapping dependencies, and adopting a risk-based implementation approach, financial institutions can build robust and adaptive resilience frameworks.

These principles ensure that resilience is not merely about recovering operations, but about sustaining essential services, protecting customers, and maintaining trust in the financial system, even in the face of increasingly complex and unpredictable disruptions.

Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.