Compliance

Cloud storage for regulated documents: what MAS guidance actually says.

MAS's own outsourcing guidance notes that more and more financial institutions are adopting cloud services, and the accounting firms, corporate service providers and advisers who work alongside them use the cloud too. The question is rarely whether the cloud is allowed. It is what the regulator expects you to do before and while you use it.

This article walks through what the Monetary Authority of Singapore says about cloud services in its outsourcing guidance, and the record-keeping rules from IRAS and ACRA that apply to every company. It explains, it does not advise. Your legal adviser should confirm how any of this applies to you.

Get started See security

Cloud is treated as outsourcing

MAS publishes Guidelines on Outsourcing in two versions, one for banks and one for financial institutions other than banks. The non-bank version, updated in January 2025, contains an annex on cloud computing. Its starting position is clear: MAS considers cloud services operated by service providers to be a form of outsourcing.

That framing matters more than it first appears. It means a cloud data room, a cloud file store or a hosted accounting system is not a special category with its own rulebook. The guidelines say the types of risk in cloud services are not distinct from those in other outsourcing arrangements, so the same due diligence, governance and risk management apply.

The annex also asks institutions to be aware of characteristics typical of cloud services: multi-tenancy, data commingling and a higher propensity for processing to be carried out in multiple locations. Those three points are, in practice, the questions a careful buyer should put to any provider. Who else shares the environment? How is my data kept apart from theirs? Where, physically, is my data processed and stored?

What the guidelines ask of the agreement

For material outsourcing arrangements, the guidelines say the outsourcing agreement should include clauses that allow the institution to conduct audits on the service provider and its sub-contractors, and to obtain copies of audit reports and findings. They also say customer information should be used by the service provider and its staff strictly for the purpose of the contracted service, and disclosed to the provider only on a need-to-know basis.

Even if you are not a financial institution, these are sensible questions to borrow. They describe what good control over an outside provider looks like, and many firms that serve financial institutions find their clients asking them the same things.

Who is accountable

The guidelines place oversight with the institution's board and senior management. The board, or a committee it delegates to, approves the framework for evaluating outsourcing risks, and senior management runs it. Responsibility for managing the risk stays with the institution, not the provider.

A change on the horizon

In March 2026 MAS published Consultation Paper P004-2026 proposing Guidelines on Third-Party Risk Management. According to the paper, the proposed guidelines would supersede both versions of the outsourcing guidelines and extend the expectations that currently apply to outsourced services to all third-party services. At the time of writing this is a consultation, not final guidance, so check the MAS website for its current status before relying on it.

The direction is worth noting either way. The focus is widening from outsourcing in the narrow sense to every outside service an institution relies on. A tool used to share documents with auditors or counterparties is exactly the kind of third-party service that sits inside that wider view.

Record keeping applies to every company

Outside the financial sector, the rules most companies meet first are about keeping records. IRAS says a company must keep its source documents, accounting records and schedules, and bank statements for at least five years from the relevant Year of Assessment. IRAS also says source documents can be kept in physical or electronic form, and that a company must still be able to retrieve its records for the full period, even after it changes accounting software. Failing to keep proper records can lead to penalties of up to S$5,000.

ACRA sets out a parallel duty for directors. Its guidance on directors' duties says all companies must keep accounting records for at least five years after the end of the financial year in which the transactions or operations were completed, and that the records must be capable of supporting true and fair financial statements.

Neither rule says where records must be kept or forbids the cloud. What both imply is that records must survive, stay retrievable and stay complete for years. A sharing tool should not become the only copy of anything you are required to keep, and anything you do keep in it should be exportable in an organised form.

Where personal data is involved

Many regulated documents contain personal data: customer files, KYC records, payroll. The Personal Data Protection Act's Transfer Limitation Obligation, explained in the PDPC's Advisory Guidelines on Key Concepts in the PDPA, requires an organisation to ensure personal data transferred outside Singapore is protected to a standard comparable with the PDPA. The guidelines are explicit that this stays the organisation's responsibility even when a service provider moves the data on its behalf. Their own example is a cloud storage provider in Singapore that transfers data to servers in London and Hong Kong: the customer company must still comply.

So the location question is not only for financial institutions. Any company that stores personal data with a provider should know where that provider keeps it.

How ShareAndGo fits

ShareAndGo is a virtual data room. It is built for the moment you hand documents to people outside your business, such as an auditor, a buyer or a lender, and need to control and record what they do. Here is what it does that maps onto the questions above.

Your documents, records and files are stored in Singapore. Some services, such as sign-in, run elsewhere, and our privacy page lists them.
Each group of recipients sees only the folders you allow, which supports need-to-know sharing.
View-only recipients see documents rendered on our side with their name, email address and the date watermarked on every page. The original file is never sent to their browser.
Every view, upload, download, invitation and change is written to an audit log that is chained so alterations are detectable, and it exports as CSV.
You can export a room as a ZIP that keeps its folder structure, with an index of every document as PDF and CSV, so a shared room never becomes a trap for your records.

None of this settles your regulatory obligations for you. It gives your risk and legal advisers facts they can assess against those obligations.

Questions people ask

Does MAS allow financial institutions to use cloud services?

MAS's outsourcing guidance treats cloud services operated by providers as a form of outsourcing and expects the same due diligence and risk management as any other outsourcing. Your legal or risk adviser should assess any specific arrangement.

How long must a Singapore company keep its records?

IRAS says at least five years from the relevant Year of Assessment for source documents, accounting records and bank statements. ACRA's guidance says accounting records must be kept for at least five years after the end of the relevant financial year. Ask your adviser how this applies to you.

Where does ShareAndGo store documents for Singapore workspaces?

Your documents, records and files are stored in Singapore. Some services, such as sign-in, run elsewhere, and our privacy page lists them.

Share regulated documents with control and a record.

Open a room, choose who sees which folders, and keep a chained log of everything that happens.

Get started