MAS P004-2026 · Singapore · Readiness before final guidance
MAS P004-2026 Third-Party Risk Readiness Checklist
The Guidelines are still proposed, but gaps in third-party records and ownership can already be found.
Work through one material arrangement with the people and records you have today.
Key takeaway
Record what you can show, what is missing, who owns each gap and which decisions must wait for MAS's final text.
What to Check Before MAS Finalises P004-2026
Status, 24 September 2026: MAS P004-2026 is a consultation whose submissions closed on 20 April 2026. The proposed Guidelines, register cadence and six-month transition should be checked against MAS's final publication before they are treated as settled.
Begin with What Already Exists
Choose one material arrangement and bring together its business owner, provider relationship, service description, materiality decision, contract, incident contacts and continuity information. These records may live in different teams and systems. The first question is whether the people who need them can find and reconcile them when an arrangement changes or fails.
The consultation proposes that institutions should be able to identify changes in arrangement materiality, understand concentration by provider or geography, and map dependencies for material arrangements where possible. It does not require all those records to sit in one product. Separately, pending issuance, MAS expects institutions to manage operational, technology and cyber risks associated with third-party services. Review current gaps on their merits, while keeping proposed details subject to change.
Follow One Arrangement Through Real Decisions
Ask the responsible teams to work through a recent provider change or disruption. The point is to show how the institution reaches a decision today, not to draw an ideal process that has never been tested.
For a practical tabletop check, let a material provider report a recovery estimate longer than the institution's own objective for a supported service. Trace the affected services, continuity owner, escalation and record of decisions. The times are the institution's test inputs, not MAS-prescribed limits. A technology gap is only one possible finding: missing ownership, incomplete data and unclear escalation rules also need to be identified.
Leave the Review with a Decision Log
Document each finding as confirmed, assumed or unknown. Record the evidence, accountable owner, likely remedy and whether the decision depends on MAS's final wording. Address an existing exposure now if the current arrangement requires attention; avoid locking in a speculative register design.
Keep the instruments distinct: Proposed paragraph 4.2 asks institutions to consider an internal record where possible and practicable. Proposed paragraph 4.3 separately sets out a MAS register, semi-annually and on request, with material arrangements at minimum and material subcontractors where possible. For banks and merchant banks, Notices 658 and 1121 would remain in effect. Check the separate template and final text before designing the report.
When MAS finalises the Guidelines, compare the final scope, exemptions, record and register expectations, template and transition period with this decision log. Assign the confirmed work to its owners. Only if existing arrangements cannot meet an established need should the team turn that gap into a software requirement.
Centvra's view
The useful preparation is a short, evidence-backed list of what your institution can and cannot explain today. A named owner and an understood cause for each gap will make the final publication a decision point rather than the start of a search for missing information.
Planning reference: This guidance helps assess current third-party risk arrangements. What changes after the consultation will depend on MAS's final publication and your institution's circumstances.
Six Readiness Checks for Current Third-Party Arrangements
01 · Establish the Arrangement Population and OwnersCoverage
Third-party services may sit across procurement, contracts, technology and business units. Choose a sample of material arrangements and check whether the institution can name the service, contracting entity, accountable owner and current status. Record which services sit outside the existing outsourcing inventory and why. Do not assume the proposed Guidelines apply to every service in the same way; confirm the final scope and exemptions when published.
Check your current arrangementsCompare the sample against procurement, contract and business-owner records. Note missing relationships and assign an owner to reconcile them.
02 · Reassess Materiality After a Significant ChangeMateriality
A change in service scope, location, provider condition or a significant incident may alter an arrangement's risk. Review how current teams hear about those changes, decide whether to reassess and retain the prior decision. The consultation identifies monitoring materiality changes as a proposed capability; a specific automated trigger is Centvra's possible implementation method, not an MAS requirement.
Check your current arrangementsSelect one recent change. Find the notification, reassessment, approver and reason for the resulting decision. Identify where the trail stops.
03 · Reveal Concentration and Shared DependenciesDependencies
Several arrangements may depend on one provider, location or known material subcontractor. See whether existing information can show those shared dependencies across business services. Where subcontractor information is unavailable, record the gap and who could obtain it rather than treating an incomplete map as a complete view.
Check your current arrangementsTake one provider or location and list the material services it supports. Mark relationships confirmed, assumed and unknown.
04 · Trace a Provider Incident to Affected ServicesResponse
An incident at a provider may affect several teams before the third-party register changes. Check whether responders can identify the supported services, recovery assumptions, escalation owner and people authorised to decide on continuity and notifications. The review tests an existing response path; it does not ask a tool to make a regulatory decision.
Check your current arrangementsUse a past event or tabletop scenario. Time how the team finds the affected services and show the decision and communication record.
05 · Reconcile Records Behind the Proposed RegisterReporting
Paragraph 4.2 asks institutions to consider maintaining an internal record where possible and practicable. Paragraph 4.3 separately proposes a MAS register. Review whether current records can identify material arrangements, available material subcontractor information and the additional outsourced relevant services captured by Notices 658 or 1121 for banks or merchant banks. Do not build an exact final export from an unfinished proposal.
Check your current arrangementsReconcile a sample across existing lists. Keep the source, classification decision and reason for each unresolved difference.
06 · Assign Evidence Gaps to the Right RemedyAction plan
A missing answer may reflect an unclear owner, incomplete provider information, an undocumented rule, inaccessible evidence, weak integration or a technology limitation. Those problems need different remedies. Record what is confirmed now, what depends on final MAS wording and who will make the decision when it arrives.
Check your current arrangementsFor each gap, note evidence, owner, proposed remedy, dependency on final wording and review date. Escalate any current risk that needs attention now.
Fit-based software matching
Find software that fits how your organisation operates
Tell us what the software must support, how your teams work and which delivery constraints matter. Centvra uses those inputs to build a focused supplier shortlist.
Your operating brief
Fit-based shortlist
Walk away with documents, not a feature grid
Describe your institution and Centvra produces three working documents, a ranked, evidenced supplier evaluation, a demo preparation guide, and a buying journey plan mapped to your profile.
Try it with your requirements
Describe your institution in plain language. Only three minutes, no signup to see your matches.
Common questions
- Does preparing for P004-2026 mean we need a new TPRM platform?
No. Start by testing whether current processes, records and systems can answer a few material third-party risk questions reliably. Some gaps may need clearer ownership, better data or a changed process. Consider a software purchase only after identifying a genuine technology limitation and defining what the existing environment cannot support.
- What should we check in one material third-party arrangement?
Identify the contracting entity, provider, service, accountable owner and current materiality decision. Then trace changes, key locations and known material subcontractors, affected business services, incident response contacts and supporting evidence. Mark each relationship as confirmed, assumed or unknown. The exercise should reveal which gaps need attention now and which depend on the final Guidelines.
- Does P004-2026 already require an internal record or a MAS register?
These are proposals in a consultation. Proposed paragraph 4.2 says an institution should consider maintaining a record of arrangements to the extent possible and practicable. Proposed paragraph 4.3 separately describes a register submitted to MAS every six months and on request, covering material arrangements at minimum and material subcontractors where possible. Check the final wording and the separate MAS template before committing to an export design.
- Would P004-2026 replace MAS Notices 658 and 1121?
No. The consultation says the existing Notices would remain in effect for banks and merchant banks. Review whether your current classification of outsourced relevant services can be retained within a wider third-party arrangement view. The proposal contemplates one register for the population in scope, subject to the final Guidelines.
- What should the team do when MAS publishes the final Guidelines?
Compare the final scope, proportionality, record and register provisions, template, submission frequency and transition arrangements with the assumptions recorded in your readiness review. Confirm what applies to your institution, assign owners and update the workplan. If current tools cannot support an established need, define that specific gap before starting a software evaluation.