Independent Singapore VCC guidance
Direct answer
A fund manager should build VCC business-continuity evidence around critical services, not a generic disaster-recovery binder. Identify the VCC and sub-fund outcomes that must continue, set disruption tolerances, map people, data, systems, premises and third parties, and document tested recovery arrangements. Include valuation, dealing, custody, payments, investor records, compliance and board decisions. Exercise scenarios that remove major providers or data, record actual results and reconcile backlogs after recovery. Directors should receive service impact, exceptions and remediation, while the regulated manager retains responsibility for its own current MAS obligations and notification assessment.
At a glance
- Start with critical fund services and investor outcomes.
- Map shared providers and data dependencies across all VCC mandates.
- A plan is evidence only after realistic testing and reconciliation.
- Board reporting should show tolerance breaches, residual risk and remediation.
Who this is for
- Fund managers and VCC boards mapping current MAS business-continuity expectations into fund-specific evidence.
Important exclusions
- A substitute for the manager licence conditions, cyber incident response or professional regulatory advice.
Translate the MAS service view into VCC outcomes
MAS business-continuity guidance takes an end-to-end service-centred view, and its operational-resilience material links business continuity with operational, technology and third-party risk. For a VCC mandate, define outcomes such as accurate valuation, controlled dealing, protected assets, authorised payments, reliable investor ownership records, required filings and board decision capability. Avoid naming a system as the service. Investors and directors depend on the result even when the manager, administrator, custodian, bank and data vendors deliver different parts.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Singapore Statutes Online · Accounting and Corporate Regulatory Authority- Name each critical VCC or sub-fund service.
- Describe the investor, asset, regulatory and governance outcome.
- Identify the service owner and decision authority.
- Record the maximum tolerable disruption and data-loss assumption.
- State the degraded level that remains safe and useful.
Related guidance: VCC manager and officer framework
Map dependencies across the whole service
For each outcome, map people, premises, applications, data, interfaces, manual records, providers, telecommunications, authorities and upstream services. Show concentration where several VCCs use the same administrator, cloud, pricing source, bank or operations team. Include the dependencies of third parties, not only the direct contract. A provider recovery target does not prove that the end-to-end fund service can resume. Connect the manager, VCC board and every provider to one service map with clear accountability and escalation.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Singapore Statutes Online| Service | Dependencies to map | Evidence to retain |
|---|---|---|
| NAV and valuation | Positions, prices, models, administrator, manager review and approvals | Last good state, workaround, test output and reconciled release. |
| Dealing and register | Requests, cut-offs, transfer agent, investor data and bank details | Accepted population, contingency record and restored register. |
| Custody and payments | Custodian, bank, signers, cash, assets and settlement messages | Authority, positions, payment test and exception reconciliation. |
| Governance and compliance | Board access, records, advisers, filings and decision papers | Alternate meeting, document access and completed obligation. |
Related guidance: VCC compliance checklist
Set tolerances and stop conditions
Define tolerances in business terms: how long the service can be unavailable, how much data can be lost, which deadlines are fixed, what investor impact is unacceptable and which degraded activities are permitted. Add stop conditions for missing positions, unverified bank data, stale prices, broken segregation, unavailable signers or incomplete investor records. Tolerances should reflect the fund documents, dealing model, asset liquidity and provider cut-offs. If the plan only says recover as soon as possible, it cannot drive an objective incident decision or test result.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Singapore Statutes Online- Within tolerance with reliable dataContinue through the approved degraded process, record every item and reconcile after full restoration.
- Within time but data integrity is uncertainStop the affected release or transaction and escalate because elapsed time alone does not establish safety.
- Tolerance exceeded but investor harm is containedEscalate to directors, coordinate communications and complete the regulatory assessment while controlled recovery continues under named ownership.
- Asset, cash or investor harm may be occurringUse the incident route immediately, preserve evidence and apply the relevant reporting and protection assessment.
Related guidance: VCC sub-fund guide
Test scenarios that remove real dependencies
Run exercises that remove a critical provider, data source, office, signer, communication channel or shared technology. Include conditions where two dependencies fail together if the map shows concentration. Use controlled data and prevent accidental live transactions. Require participants to operate the contingency, make fund decisions, communicate and restore records rather than discussing what they would do. Capture start times, evidence, capacity, manual errors, unavailable data, approval gaps and the actual point at which the service became safe again.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore- DesignSelect a credible failure, affected VCC services, test data, controls, observers, success measures and stop conditions.
- ExerciseRun the approved contingency through real roles and decision paths without moving investor assets unexpectedly.
- RecoverRestore the service, replay controlled backlogs, remove temporary access and reconcile records end to end.
- ImproveClassify defects, assign owners, retest material weaknesses and update contracts, maps, training and governance.
Challenge third-party recovery evidence
Ask providers for evidence relevant to the VCC service: tested recovery, capacity, data integrity, communication, subcontractor dependencies, location risks, cyber separation and exit support. Do not treat a certification or summary slide as proof that the fund workflow works. Join provider tests with the manager and VCC steps. If the administrator recovers but the custody feed cannot be reconciled, the NAV service is not restored. Record contractual gaps and alternative arrangements, and prioritise providers whose failure would breach several tolerances at once.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Singapore Statutes OnlineGive directors a decision-ready BCM pack
Report the service inventory, tolerances, major dependencies, latest tests, observed recovery, tolerance breaches, workaround capacity, open defects and remediation dates. Separate management-owned and provider-owned actions while keeping one accountable manager owner. Explain which VCCs and sub-funds share the same vulnerability. Directors should challenge whether tests used realistic data and decisions, whether backlogs were reconciled and whether repeated exceptions require a structural change. Preserve the evidence supporting closure rather than reporting only that the exercise passed.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Singapore Statutes Online · Accounting and Corporate Regulatory Authority- Show every critical service and owner.
- Identify concentration and untested dependencies.
- Compare actual recovery with approved tolerance.
- Record data, decision and backlog reconciliation results.
- Track material defects to retest and board closure.
Related guidance: Singapore VCC operating guide
Frequently asked questions
Do the MAS BCM Guidelines apply to fund managers?
The MAS page lists licensed fund managers and venture capital fund managers among the covered financial institutions. The firm should confirm its exact current obligations and licence context.
Is a provider business-continuity report enough?
No. It helps assess one dependency, but the manager needs end-to-end evidence that the VCC service, decisions, data and records can continue and recover across providers.
Should every VCC use the same recovery tolerance?
Not automatically. Dealing frequency, assets, investor terms, leverage, settlement and provider models differ materially. Set each fund-service tolerance from actual impact, contractual obligations, data dependencies and approved governance, then test it against credible disruption scenarios.
Can a tabletop exercise satisfy the testing need?
A tabletop can test roles and decisions, but it may not prove data, capacity, access, interfaces, manual processing or reconciliation. Combine exercise types according to the risk.
What should happen after a failed BCM test?
Contain any live risk, classify the defect, assign an accountable owner, set remediation and retest criteria, update the plan and escalate material residual risk to directors and the regulated manager.
Official sources and further reading
- Guidelines on Business Continuity Management (Monetary Authority of Singapore)
- Achieving Operational Resilience for Financial Institutions in Singapore (Monetary Authority of Singapore)
- Variable Capital Companies Act 2018 (Singapore Statutes Online)
- VCC features, eligibility and requirements (Accounting and Corporate Regulatory Authority)
Discuss your fund, family office or trust structure
Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.
- Email: hello@rafflescorporateservices.com
- WhatsApp: +65 8501 7133
- WhatsApp: +65 9018 0072
Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.