Independent Singapore VCC guidance
Direct answer
MAS consulted in March 2026 on proposed third-party risk guidelines, but its current operational-resilience page still describes them as not finalised. Do not present the proposal as binding final guidance. A fund manager can prepare safely by inventorying third-party services, mapping critical fund and VCC dependencies, strengthening due diligence, contracts, monitoring, incident response and exit evidence, and preserving the controls already required under current applicable guidance.
At a glance
- Label the March paper as a proposal, not final law.
- Inventory services before deciding materiality.
- Map subcontractors and concentration dependencies.
- Connect manager controls to VCC oversight evidence.
Who this is for
- MAS-regulated fund managers and VCC teams reviewing service-provider dependencies
Important exclusions
- A conclusion that every proposal applies now or applies directly to every VCC
Separate current guidance from the proposal
MAS public materials show that the consultation on proposed Guidelines on Third-Party Risk Management opened in March 2026 and closed in April 2026. The MAS operational-resilience page says that, when finalised, the guidelines will address controls for third-party services whether or not an arrangement is outsourcing. That wording means the proposal should not be described as final or given an invented commencement date. Financial institutions should continue applying the current instruments that actually govern them, including applicable outsourcing, technology risk, business continuity and internal-control guidance. Keep a regulatory status field in the project plan and update it only from a published MAS response or final instrument.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeBuild the third-party inventory now
| Field | Purpose | Evidence |
|---|---|---|
| Service and owner | Identify the business service, contract owner and accountable executive | Current contract and service map |
| Fund dependency | Connect the service to each VCC, sub-fund, class and critical process | Process and data-flow map |
| Risk and concentration | Assess disruption, data, cyber, legal, country and provider concentration | Documented risk assessment and rationale |
| Subcontractors | Identify material fourth parties and approval or notification routes | Provider disclosure and monitoring record |
| Exit readiness | Show data return, transition resources, alternatives and termination steps | Tested exit or contingency plan |
Inventory third-party services broadly before filtering for deeper review. Include administrators, transfer processes, custodians, pricing and market-data vendors, cloud and software providers, cybersecurity services, screening tools, distributors, consultants and intragroup services where relevant. Record the legal entity, service, countries, data handled, subcontractors, connected fund processes and business owner. Do not copy a bank register template without adapting it to the fund manager activities and applicable rules. The goal is a reliable dependency map that supports proportionate assessment. A provider supporting several sub-funds or critical processes may create concentration even when each contract appears modest in isolation.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeAssess the arrangement through its life cycle
- Need and selectionDefine the service outcome, data, criticality, conflicts, alternatives and due-diligence evidence before appointment.
- Contract and onboardingSet service, access, audit, incident, subcontracting, continuity, data and termination expectations appropriate to risk.
- Ongoing monitoringReview service performance, risk changes, incidents, control evidence, concentration exposure and material subcontractor developments.
- Change or exitControl migration, data return or deletion, records, open issues, parallel running and service continuity.
Use one lifecycle record to connect due diligence, approval, contract, onboarding, monitoring, change and exit. Material changes should trigger reassessment rather than wait for an annual review. Examples include a new subcontractor, data-location change, acquisition, repeated incident, financial deterioration, control qualification or expanded service scope. Contract clauses are not controls by themselves; test whether the provider can supply records, support incident response and execute an exit. For critical fund operations, perform tabletop or technical tests appropriate to the service. Where the provider cannot meet a desired clause, document the residual risk, compensating control and authorised decision instead of silently accepting the gap.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeRelated guidance: fund-manager incident bridge guide
Connect manager controls to VCC oversight
The proposed guidance is directed at financial institutions, while a VCC has its own board and service-provider relationships. Preserve that distinction. The manager should own its regulatory risk framework and provide fund-specific evidence that supports appropriate VCC oversight. The board pack can identify critical providers, concentration, material incidents, unresolved findings, exit readiness and changes affecting the VCC or a sub-fund. It should not imply that directors operate the manager vendor programme. Where the VCC contracts directly with a provider, align the contract owner, information rights and escalation route with the manager control framework. Reconcile provider lists so a critical direct dependency is not absent from manager or VCC reporting.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Accounting and Corporate Regulatory AuthorityRelated guidance: VCC manager and director roles · Singapore VCC guide
Prepare without overclaiming
- Mark every March 2026 consultation item as proposed until MAS publishes final guidance.
- Maintain the current applicable outsourcing and operational-resilience control set during preparation.
- Create a complete service inventory before applying materiality or deeper due diligence.
- Map subcontractors, data, concentration, critical fund processes, incidents and exit dependencies.
- Assign remediation owners, evidence and realistic completion dates without claiming planned controls are live.
- Monitor MAS for a response, final text, scope, transition period and effective date.
Preparation should produce usable controls even if the final text changes. A complete inventory, accountable ownership, current risk assessments, contract evidence, incident routes and exit tests improve resilience under the existing framework. Maintain a proposal-to-control mapping that distinguishes current requirement, prudent preparation and unresolved final-text question. Avoid publishing a transition period, reporting frequency or scope statement unless MAS has finalised it. When final guidance appears, compare the final text with the consultation, update the applicability analysis and approve a dated remediation plan. Do not assume that silence after the consultation means the proposal took effect unchanged.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeRelated guidance: VCC compliance checklist
Frequently asked questions
Are the proposed MAS third-party risk guidelines final?
Not according to the current MAS operational-resilience page, which describes the consultation and states what the guidelines will do when finalised. Monitor MAS for the response, final text, scope, transition period and effective date before treating proposals as binding.
Should a fund manager wait before building a provider inventory?
No. A reliable service inventory and dependency map support current outsourcing, operational resilience, technology, continuity and internal-control work. Label proposal-specific fields clearly and avoid claiming that an unpublished final requirement already applies.
Does the proposed framework apply directly to the VCC?
The consultation concerns financial institutions. The manager should assess its applicability and obligations. A VCC board may need fund-specific oversight evidence, especially for direct providers and critical operations, but the article does not treat the VCC as the regulated manager.
What is the most useful first preparation step?
Inventory every relevant third-party service and connect it to legal entities, VCCs, sub-funds, critical processes, data, countries, subcontractors, contracts and owners. A complete map is necessary before materiality, concentration, monitoring and exit decisions can be reliable.
Official sources and further reading
- Third-Party Risk Management (Monetary Authority of Singapore)
- Regulations and guidance on risk management practices (Monetary Authority of Singapore)
- Achieving operational resilience for financial institutions in Singapore (Monetary Authority of Singapore)
- Overview of managing a VCC (Accounting and Corporate Regulatory Authority)
Discuss your fund, family office or trust structure
Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.
- Email: hello@rafflescorporateservices.com
- WhatsApp: +65 8501 7133
- WhatsApp: +65 9018 0072
Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.