ShareAndGoShareAndGo

Compliance

MAS technology risk guidance, and the providers that hold your documents.

If you work in or with a Singapore financial institution, you will have heard of the Monetary Authority of Singapore's Technology Risk Management Guidelines. They shape how banks, insurers, fund managers and others think about technology, including the outside services that store or process their data.

This article summarises what the guidelines say about third parties, data security and access, quoting MAS's own text, and turns that into practical questions to ask any provider that will hold confidential documents. It is not regulatory advice. Your compliance team decides how the guidance applies to you.

Get startedSee security

What the guidelines are

MAS issued its revised Technology Risk Management Guidelines in January 2021. In MAS's words, they set out technology risk management principles and best practices for the financial sector. The guidelines say their aim is to promote the adoption of sound and robust practices for the management of technology risk.

Two points about their status are worth noting. The guidelines say the extent and degree to which a financial institution implements them should be commensurate with the level of risk and complexity of its services and technologies. And they say they provide general guidance, are not intended to be comprehensive, and should be read with the relevant legislation, notices and other guidelines MAS issues. They sit alongside, not in place of, binding requirements.

What they say about third parties

Section 3.4 of the guidelines deals with the management of third party services. It notes that the use of certain third party services may not always constitute outsourcing, but that because many of these services involve confidential or sensitive customer information being stored or processed by the third party, an institution's operations and customers may be affected if there is a system failure or security breach at the third party.

The guidelines say an institution should assess and manage its exposure to technology risks that may affect the confidentiality, integrity and availability of IT systems and data at the third party before entering into a contractual agreement or partnership. On an ongoing basis, they say the institution should ensure the third party employs a high standard of care and diligence in protecting data confidentiality and integrity, and in ensuring system resilience.

Outsourcing arrangements have their own MAS guidance, which this article does not cover. The point here is narrower: a document-sharing tool that holds confidential information is a third party service in this sense, and should be assessed as one.

What they say about data security and access

Section 11.1 asks institutions to develop data loss prevention policies covering data in motion, data at rest, including in storage platforms such as cloud, and data in use. It says systems managed by an institution's service providers should be accorded the same level of protection and be subject to the same security standards. It also says security measures should be implemented to prevent and detect the use of unauthorised internet services that allow users to communicate or store confidential data, giving cloud storage and file sharing, emails and messaging applications as examples.

That last point matters in practice. When staff share deal documents or client files through whatever tool is to hand, they may be using exactly the kind of unapproved service the guidelines describe. An approved, assessed way of sharing documents with outsiders reduces that temptation.

On access, section 9.1 says the principles of never alone, segregation of duties and least privilege should be applied when granting access to information assets, and that records of user access and user management activities should be uniquely identified and logged for audit and investigation purposes.

Binding notices sit alongside

Some requirements are set by notice rather than guideline. For example, MAS Notice FSM-N06 on Cyber Hygiene, issued to banks in Singapore in May 2024 under the Financial Services and Markets Act 2022, requires a bank to ensure multi-factor authentication is implemented for administrative accounts on critical systems and for all accounts on any system used to access customer information through the internet. Each type of institution should check the notices that apply to it.

Questions to ask a document-sharing provider

Drawing those threads together, these are reasonable questions to put to any provider that will hold confidential documents:

  1. Where are documents stored, and which parts of the service run elsewhere?
  2. How is access granted to outside readers, and how do they prove who they are?
  3. Can access be limited to specific folders for specific people, and ended on a date?
  4. Can readers be prevented from downloading, printing or copying, and how is view-only enforced?
  5. Is every view, download and change logged against a named person, and can the log be exported?
  6. How is the log protected against alteration?
  7. How do your own staff sign in, and is two-step verification required?
  8. How are uploads checked for malware?
  9. What happens to documents when they are deleted?

How ShareAndGo answers them

Your documents, records and files are stored in Singapore. Some services, such as sign-in and sending email, run elsewhere, and our privacy page lists them. Outside readers are invited by email address and confirm it with a six-digit code before they see anything. Groups see only the folders you allow, and invitations can carry an end date and be revoked at any time.

You set download, print, copy and watermark controls per room and per group. For view-only readers, PDFs and Word, Excel and PowerPoint files are rendered on our side and the original file is never sent to their browser. Every view, upload, download, invitation and change goes into an audit log, chained so alterations are detectable, exportable as CSV.

Your team signs in through MyAndGo with Google, Microsoft or email, with two-step verification and session timeouts you set. Every upload is scanned for viruses, and nothing is served until the scan is clean. Deleting removes stored files and their previews. We do not claim any certification, and whether ShareAndGo fits your institution's risk framework is your compliance team's decision.

Frequently asked questions

Do the MAS guidelines apply to my business?
They are written for financial institutions regulated by MAS. If you are unsure whether you are covered, ask your compliance adviser.
Is ShareAndGo approved by MAS?
No. We do not claim any regulatory approval or certification. Under the guidelines, an institution assesses the third party services it uses against its own risk framework.
Can we see the audit log during an assessment?
Yes. You can export the audit log as a CSV file for your compliance or audit team.

Keep reading

Zero trust for document sharing

Least privilege and logging, applied to outside readers.

Why tamper-evident audit trails matter

What makes an access record trustworthy.

ShareAndGo security

The controls behind every room.