## 1sgpea2019002 ## Source details **Canonical URL:** [1sgpea2019002](https://www.imf.org/-/media/files/publications/cr/2019/1sgpea2019002.pdf) ## Other formats - [Markdown version](/-/media/files/publications/cr/2019/1sgpea2019002.pdf.md) - [Structured JSON version](/-/media/files/publications/cr/2019/1sgpea2019002.pdf.json) --- ### Executive summary, context, and scope - Assessment undertaken during the IMF’s FSAP mission to Singapore from October 29 to November 14, 2018. - Scope: assessment of MEPS+ (focus on inter-bank funds transfer sub-system) using 18 of the 24 principles generally applicable for payment systems under the PFMI; MAS responsibilities assessed against Responsibilities A to E of the PFMI. - Sources used: MEPS+ operator self-assessment and disclosure framework, MAS self-assessment of responsibilities, Questionnaire on FMIs in Singapore, relevant laws and regulations, and discussions with MAS staff and private sector representatives. - Observance summary: - MEPS+: observes 17 Principles; broadly observes 1 Principle (operational risk); six Principles assessed as not applicable. - MAS responsibilities: most observed; Responsibility B (powers and resources) assessed as broadly observed. ### Key developments since FSAP 2013 - Capital market FMI recommendations addressed; remedial actions implemented or in progress for the two CCPs. - Privately-operated securities settlement system moved its SGD money settlements for equities and debt securities to settle at the MAS in December 2018. - Two additional CCPs and one trade repository entered the FMI landscape. - MAS signed a supervisory cooperation on crisis management arrangements with U.S. authorities. - Legal/regulatory reforms: - Payment and Settlement Systems (Finality and Netting) Act amended in 2018 to enhance insolvency protection, designation criteria, and administrative powers of MAS. - Payment Services Bill proposed in 2017 and expected to be introduced to Parliament in late-2018. - Foreign exchange settlement risks addressed via MAS supervisory expectations requiring banks to include such risks in counterparty risk management frameworks. - MAS co-chaired the CPMI/IOSCO Working Group on Cyber Resilience and established a Cyber Resiliency Framework for MAS-operated Critical Information Infrastructures (CIIs), including MEPS+. ### MEPS+ system overview and usage statistics - Launch and participants: - First RTGS (MEPS) launched July 1998; MEPS+ went live in December 2006. - As of December 2017, MEPS+ has 63 participants: MAS, 59 commercial banks and 3 FMIs (including CLS, CDP, and SGX-DC). - Structure and hours: - Two sub-systems: MEPS+ IFT (large value SGD interbank funds transfers) and MEPS+ SGS (custody and settlement of scripless SGS and MAS Bills). - Messaging backbone: SWIFT network, SWIFT services and message type messaging standards. - Operating hours: weekdays (excluding public holidays) from 9:00 a.m. to 7:00 p.m. - Throughput and concentration: - MEPS+ handled about 5 million transactions valued at SGD 18 trillion in 2017. - Average daily: about 22,000 transactions valued at about SGD 72 billion. - Transaction values peaked at SGD 19 trillion in 2008 (2006–2017 range). - Concentration ratios: around 60 percent (value) and 57 percent (volume). ### Legal framework and key agreements - Main legislation: MAS Act, Section 29A (Cap. 186); Payment Systems (Oversight) Act Cap (222A) (PS(O)A); Payment and Settlement Systems (Finality and Netting) Act (FNA); Electronic Transactions Act (Cap. 88). - Five governing agreements include MEPS+ Service Agreement and Terms and Conditions for current accounts, SGS/MAS Bills accounts, MAS Intraday Liquidity Facility (ILF), and PSA/ISMA GMRA. - MEPS+ Operating Rules (Rule 17.1) provide finality and irrevocability for transactions. ### MEPS+ design and settlement features - Queuing and gridlock resolution: - Same-day instructions settle instantaneously and irrevocably if sufficient balances exist; insufficient-funds payments are queued. - Gridlock detection and resolution mechanism operates every half hour; queued payments not settled by end of business day are cancelled. - DVP and securities settlement: - MEPS+ SGS earmarks securities and generates payment instructions to MEPS+ IFT; DVP Model 1 used for securities settlement (delivery-vs-payment). - Intraday liquidity and ILF: - MAS offers ILF for interest-free intraday collateralized borrowing of SGD; available only to participants who have executed the PSA/ISMA GMRA with MAS. - Eligible collateral: SGS and MAS Bills only (highest quality liquid assets domestically); collateral reviewed annually, marked to market daily, valued per established framework. - Haircuts determined by approved haircut framework, calibrated for stressed scenarios, subject to annual review. ### Risk management, operational resilience, and cyber security - Risk profile: - MEPS+ risk management framework addresses operational, credit, liquidity and legal risks; operational risk identified as most material. - MEPS+ capacity tested to process up to three times the average daily settlement volume or two times the peak settlement volume, whichever is higher. - Operational controls and testing: - Annual penetration test and system vulnerability assessment; DR tests every six months; annual contingency drills (including participants and CSPs); quarterly system health checks; near real-time monitoring. - Third-party critical service providers (CSPs): BCS Information Systems (MEPS+ ASP); NCS (DR site); SWIFT (messaging). - MEPS+ not affected by SGX trading disruptions in 2014 and 2016; MEPS+ functionality not reliant on SGX systems. - Cyber security leadership and initiatives: - MAS appointed a Board-level Risk Committee member with technology and cyber risk expertise and a Chief Cyber Security Officer (CCSO); established a Cyber Resiliency Framework for MAS-operated CIIs. - Enhancements: expand surveillance coverage, reinforce protection capabilities, reduce time to recover, develop cyber competencies, track SWIFT message sequence numbers for fraud detection. - IMF operational risk assessment: - Principle 17: Broadly observed. To achieve full observance, substantial enhancements to cyber resiliency for the central bank and MEPS+ are required. - Suggested considerations: - (i) enhance enterprise-level cyber resiliency with mandatory information security awareness training and course completion for all MAS staff on a regular basis; - (ii) apply ratings in annual self-attestations submitted by MEPS+ CSPs and ensure external audit is completed against acceptable national or international standards; - (iii) monitor compliance of MEPS+ participants with mandatory controls of the SWIFT Customer Security Program and ensure self-attestations are audited. ### Governance and institutional arrangements - Separation of functions: - Supervisory and operational functions are separated into different organizational units with distinct reporting lines to prevent conflicts of interest. - ITD and Finance Department: day-to-day operations; report to CIIC. - TRPD: supervision of MEPS+; not involved in operations; reports to MFSC. - RiMD: independent risk management unit; reports to EXCO and RC. - CIIC composition and role: - CIIC chaired by Deputy Managing Director (Corporate Development Group); includes Assistant MDs, heads of IT and Finance, and MAS CCSO. - CIIC tasks: oversee design, functionality, performance standards, policies, risk management and contingency plans for MAS-operated CIIs including MEPS+. - CCSO role and potential conflict: - CCSO role concurrently held by the Executive Director of TRPD (overseer/supervisor of MEPS+). IMF recommendation: clarify CCSO role and reporting line to ensure independence of TRPD and prevent perceived or potential conflicts of interest. - MAS may consider whether a full-time CCSO position is warranted. - Governance assessment: - Principle 2: Observed (recommendation to clarify CCSO role and reporting line). - Principle 3: Observed (recommendation to analyze DLT implications per CPMI analytical framework). ### Observance summary and prioritized recommendations - MEPS+ PFMI ratings: - Observed: 1, 2, 3, 4, 5, 7, 8, 9, 12, 13, 15, 16, 18, 19, 21, 22, 23 - Broadly observed: 17 - Not applicable: 6, 10, 11, 14, 20, 24 - Selected prioritized recommendations (relevant party: MAS; timeframe definitions: “Immediate” = within one year; “Near-Term” = 1–3 years; “Medium-Term” = 3–5 years): - Principle 2 — CCSO oversight and operational involvement: Clarify the role and reporting line to ensure separation of MEPS+ oversight and operational responsibilities. Relevant party: MAS. Timeframe: Immediate. - Principle 3 — DLT implications: Analyze and identify potential implications for MEPS+ safety against the CPMI analytical framework for DLT in payment, clearing and settlement. Relevant party: MAS. Timeframe: Near-Term. - Principle 17 — Cyber resiliency awareness and competencies: Enhance enterprise-level cyber resiliency with mandatory information security awareness training and course completion for all MAS staff on a regular basis. Relevant party: MAS. Timeframe: Immediate. - Principle 17 — CSP assessments and audits: Apply ratings in annual self-attestations submitted by MEPS+ CSPs and ensure external audit is completed against acceptable national or international standards. Relevant party: MAS. Timeframe: Immediate. - Principle 17 — Endpoint security of participants: Monitor compliance of MEPS+ participants with mandatory controls of the SWIFT Customer Security Program and ensure self-attestations are audited. Relevant party: MAS. Timeframe: Immediate. - Principle 23 — Disclosure: Disclose additional information on system availability, average daily liquidity, and throughput time in the MEPS+ disclosure framework. Relevant party: MAS. Timeframe: Near-Term. - Responsibility B — Resources: Increase resources for the payment systems oversight and supervision unit of the TRPD to support detailed annual assessments of MEPS+ and other DPSs (particularly FAST). Relevant party: MAS. Timeframe: Near-Term. - Responsibility C — Independent assessment disclosure: Enhance independent review of MEPS+ with an annual assessment report with ratings prepared by the TRPD, endorsed by the MFSC, and publicly disclosed. Relevant party: MAS. Timeframe: Near-Term. - Responsibility D — PFMI application to SWIPS: Revise the Monograph on Supervision of FMIs to describe standards used for designated SWIPS and assess annually the need to apply the PFMI to SWIPS based on horizon-scanning and changes in risk profiles. Relevant party: MAS. Timeframe: Near-Term. ### MAS responsibilities, powers, and resource considerations - Legal powers and information access: - Section 6 of PS(O)A empowers MAS to collect payment system-related information; Section 27 allows inspections; Part V/VI set notification, reporting and enforcement obligations. - PS(O)A empowers designation of DPSs and grants powers to impose access regimes, restrictions and conditions, establish standards, issue directions, inspect operations, and assume control under emergency situations. - Section 22 of the MAS Act provides immunity to MAS officers for actions done in good faith. - MAS oversight practice and disclosures: - MAS publishes the Monograph on Supervision of FMIs and Standards for MAS-operated FMIs; MEPS+ PFMI Disclosure updated every two years (last published June 2018). - MAS conducts annual assessments of SWIPS operators and provides ratings; possibility of SWIPS becoming SIPS discussed during assessments. - Resource gap detail: - As at July 2018, 5 staff in the payment systems oversight and supervision unit of TRPD involved in supervision of DPS. - Payments and Infrastructure Division of TRPD has 20 staff responsible for oversight and supervision of MEPS+, DPSs, CLS, credit bureaus, payment institutions and SWIFT. - Comparative staffing: 18 MAS staff oversee capital market FMIs; Bank of England FMI Directorate has 65 full time staff; another CPMI/IOSCO jurisdiction cited has around 50 staff. - IMF recommendation: increase resources for TRPD payment systems oversight and supervision unit. ### Cooperation with other authorities and cross-border arrangements - CLS cooperative oversight: - CLS is subject to cooperative oversight chaired by the United States Federal Reserve (USFR); MAS participates as a member of the CLS Oversight Committee (OC). - MAS contributes views and reviews CLS developments; USFR organizes and administers CLS OC per the Protocol for Cooperative Oversight of CLS. - Cybersecurity cooperation: - CSA oversees national cybersecurity strategy; Cybersecurity Act provides framework for oversight of essential services. - MAS works with CSA to strengthen cyber resilience of CIIs in banking and finance; CSA manages incident reporting through MAS as sector lead/regulator. ### MAS responses and planned actions (MAS remarks) - Governance (Principle 2): MAS will review need for greater clarity of the CCSO role to more fully achieve separation of operational and oversight responsibilities. - DLT implications (Principle 3): MAS will review and analyze potential implications of DLT on MEPS+ safety against the CPMI analytical framework before deciding on adoption or interfacing DLT-based systems with MEPS+. - Operational risk and cyber measures (Principle 17): - MAS requires all staff to complete a mandatory information security e-learning module with assessment; module will be continually updated; MAS will explore more frequent phishing exercises. - MAS agrees to apply ratings in annual self-attestations by MEPS+ CSPs and ensure external audits against acceptable standards. - MAS agrees to monitor MEPS+ participants’ compliance with mandatory SWIFT Customer Security Program controls and ensure participant self-attestations are audited. - Disclosure (Principle 23 & Responsibility C): MAS will review IMF recommendation on disclosing additional quantitative indicators in the MEPS+ PFMI Disclosure and will consider frequency, endorsement forum and presentation form for any overseer assessment disclosures. - Resources (Responsibility B): MAS agrees it is timely to review resource requirements for supervision of payment systems given the evolving payments landscape. - PFMI application (Responsibility D): MAS will revise the Monograph to describe standards used for designated SWIPS and will annually assess need to apply PFMI to SWIPS. *Source: EXECUTIVE SUMMARY and extracts, 1sgpea2019002 — IMF assessment of MEPS+ and MAS responsibilities.* ### EXECUTIVE SUMMARY __________________________________________________________________________ 6 ### EXECUTIVE SUMMARY ### Overview and context - Assessment undertaken in the context of the IMF’s FSAP mission to Singapore from October 29 to November 14, 2018. - Scope: assessment of MEPS+ (focus on inter-bank funds transfer sub-system) using 18 of the 24 principles generally applicable for payment systems under the PFMI; MAS responsibilities assessed against Responsibilities A to E of the PFMI. - Sources used: MEPS+ operator self-assessment and disclosure framework, MAS self-assessment of responsibilities, Questionnaire on FMIs in Singapore, relevant laws and regulations, and discussions with MAS staff and private sector representatives. ### Key developments since FSAP 2013 - Capital market FMI recommendations addressed; remedial actions implemented or in progress for the two CCPs. - Privately-operated securities settlement system moved its SGD money settlements for equities and debt securities to settle at the MAS in December 2018. - Two additional CCPs and one trade repository entered the FMI landscape. - MAS signed a supervisory cooperation on crisis management arrangements with U.S. authorities. - Legal/regulatory reforms: - Payment and Settlement Systems (Finality and Netting) Act amended in 2018 to enhance insolvency protection, designation criteria, and administrative powers of MAS. - Payment Services Bill proposed in 2017 and expected to be introduced to Parliament in late-2018. - Foreign exchange settlement risks addressed via MAS supervisory expectations requiring banks to include such risks in counterparty risk management frameworks. - MAS co-chaired the CPMI/IOSCO Working Group on Cyber Resilience and established a Cyber Resiliency Framework for MAS-operated Critical Information Infrastructures (CIIs), including MEPS+. ### MEPS+ assessment findings (observance and gaps) - Observance summary: - MEPS+ observes 17 principles and broadly observes one principle (operational risk). - Six principles were not applicable. - Areas identified for improvement relative to international best practices and evolving risks: - Governance (Principle 2): - Chief Cyber Security Officer role is held concurrently by the Executive Director of the Technology Risk and Payments Department (TRPD), which oversees and supervises MEPS+. Clarification of the role and reporting line recommended to ensure independence of TRPD and to prevent perceived or potential conflicts of interest between oversight and operational responsibilities for MEPS+. - TRPD head is a member of the Management Financial Supervision Committee (governing oversight body of MEPS+). The Chief Cyber Security Officer is also a member of the Management Critical Information Infrastructure Committee (responsible for operations of MEPS+). - MAS may consider whether a full-time Chief Cyber Security Officer position is warranted as the role and responsibilities evolve. - Comprehensive risk management framework (Principle 3): - MAS should analyze and identify potential risks for MEPS+ guided by the CPMI analytical framework for distributed ledger technology in payment, clearing and settlement (areas to consider include legal basis, governance, settlement finality, financial risk, and operational risk). - Operational risk (Principle 17): - With heightening cyber risks, MAS should: - (i) enhance enterprise-level cyber resiliency with mandatory information security awareness training and course completion for all MAS staff on a regular basis; - (ii) apply ratings in the annual self-attestations submitted by MEPS+ critical service providers to support continuation of critical services for MEPS+ and ensure that the external audit is completed against acceptable national or international standards; - (iii) monitor compliance of MEPS+ participants with the mandatory controls of the SWIFT Customer Security Program, and ensure that self-attestations are audited. - Disclosure of rules, key procedures and market data (Principle 23): - MAS should consider public disclosure of additional information on material developments and quantitative indicators such as MEPS+ system availability, average daily liquidity, and throughput time in the MEPS+ disclosure framework, particularly given operational incidences, FMI interdependencies, and MEPS+ critical service providers. ### MAS responsibilities assessment (observance and gaps) - Observance summary: - Most responsibilities are observed. - Responsibility B (powers and resources) assessed as broadly observed because of resource constraints relative to the broad scope of responsibilities and the evolving payments landscape. - Potential opportunities for improvement relative to international best practices: - Regulatory, supervisory, and oversight powers and resources (Responsibility B): - In view of broad mandate and increased responsibilities, MAS should increase resources for the payment systems oversight and supervision unit of the TRPD. - The unit oversees and supervises MEPS+, five privately-operated designated payment systems, and credit bureaus; participates in cooperative oversight of a cross-border payment system and SWIFT; and has a limited number of staff working on payment systems oversight and supervision. - Sufficient resources would support detailed annual assessments of MEPS+ and other payment systems, which could evolve in systemic importance. - Disclosure of policies with respect to FMIs (Responsibility C): - To enhance transparency, MAS should consider: - (i) enhancing independent review of MEPS+ with an annual assessment report with ratings prepared by the TRPD, endorsed by the Management Financial Supervision Committee, and publicly disclosed; - (ii) publishing an annual report on FMI and payments for Singapore, including policies, assessment results, and risk analysis for MEPS+. - Application of the PFMI (Responsibility D): - To clarify PFMI application, MAS should consider: - (i) revising the Monograph on Supervision of Financial Market Infrastructures to describe the standards used for designated system-wide important payment systems and the associated risks assessed relative to the PFMI; - (ii) assessing on an annual basis the need to apply the PFMI to system-wide important payment systems with respect to horizon-scanning and changes in their risk profiles (such as value limit increases, cross-border features). ### Operational resilience and cyber security leadership - MAS has taken pioneering steps that are above minimum PFMI requirements to strengthen cyber resiliency for FMIs and the payment system, including: - Appointment of a Board-level Risk Committee member with specialist expertise in technology and cyber risk management. - Appointment of a Chief Cyber Security Officer to senior management. - Establishment of a Cyber Security Advisory Panel including international cyber security thought leaders. - Ongoing efforts to expand surveillance coverage, reinforce protection capabilities, reduce time to recover, and develop cyber competencies. ### Concluding observations - Singapore’s FMIs have continued to operate safely and efficiently since the FSAP of 2013. - MAS is justified in aiming for higher standards than the minimum PFMI standards given Singapore’s role as a modern financial center with a systemically important financial system and given evolving technologies and risks. - Most MEPS+ principles and MAS responsibilities are observed, with targeted recommendations to address resource constraints, governance and cyber-resilience arrangements, disclosure and transparency, and preparedness for emerging technologies such as distributed ledger technology. *Source: EXECUTIVE SUMMARY, 1sgpea2019002 — IMF assessment of MEPS+ and MAS responsibilities.* ### 7. MEPS+ is a systemically important payment system and has a key role in fostering ### 7. MEPS+ is a systemically important payment system and has a key role in fostering ### MEPS+ overview and participants - First RTGS system (MEPS) launched in July 1998; enhanced and relaunched as MEPS+ and went live in December 2006. - As of December 2017, MEPS+ has 63 participants, comprising MAS, 59 commercial banks and 3 FMIs (including CLS, CDP, and SGX-DC). - Participants access MEPS+ through SWIFT terminals and interfaces to submit payment instructions, manage queued transactions and perform online enquiries. ### MEPS+ structure, messaging, and operating hours - MEPS+ operates as two sub-systems settling funds and securities: - MEPS+ IFT: settlement of large value SGD interbank funds transfers. - MEPS+ SGS: custody and settlement of scripless SGS and MAS Bills transactions. - MEPS+ utilizes the SWIFT network, SWIFT services and message type messaging standards as its messaging backbone. - MEPS+ operates on weekdays (excluding public holidays) from 9:00 a.m. to 7:00 p.m. - Prior to operating hours, funds in participants’ current accounts with MAS are transferred to their RTGS accounts for settlement; if an intraday minimum cash balance requirement applies, only funds in excess of that requirement are transferred to the RTGS account for intraday settlement. ### Queuing, gridlock resolution, and delivery-versus-payment (DVP) - Queuing and gridlock resolution mechanisms ensure sufficient funds and securities are available for settlement. - Funds: - Same day payment instructions settle instantaneously and irrevocably subject to sufficient balances in the paying participant’s RTGS account. - Participants unable to settle due to insufficient funds are queued. - Queued instructions are settled according to assigned priority levels on a first-in-first-out basis when funds are available. - A gridlock detection and resolution mechanism operates every half hour to allow payments to be settled simultaneously on a multilateral gross basis, provided that the resulting positions of all accounts are positive. - Queued payments not settled by end of business day are cancelled by MEPS+ and affected participants are informed via SWIFT messages. - Securities: - If the seller lacks sufficient SGS or MAS Bills, the transaction is queued in MEPS+ SGS until sufficient SGS or MAS Bills are available. - Once sufficient securities exist, MEPS+ SGS earmarks the securities and generates a payment instruction to MEPS+ IFT on behalf of the buyer. - If the buyer lacks sufficient funds in its RTGS account, the payment is queued in MEPS+ IFT; when funds become available, the amount is debited from the buyer’s RTGS account, credited to the seller’s RTGS account, and transfer of SGS or MAS Bills to the buyer is effected on a delivery-vs-payment (DVP) (Model 1) basis. ### Usage statistics and concentration - MEPS+ handled about 5 million transactions valued at SGD 18 trillion in 2017. - This translates to an average of about 22,000 transactions valued at about SGD 72 billion daily. - During 2006–2017, transaction values peaked at SGD 19 trillion in 2008. - The concentration ratio in terms of value and volume were around 60 percent and 57 percent, respectively. ### Legal underpinnings and agreements - Main legislation providing legal basis for MEPS+: - MAS Act, Section 29A (Cap. 186) - Payment Systems (Oversight) Act Cap (222A) (PS(O)A) - Payment and Settlement Systems (Finality and Netting) Act (FNA) - Electronic Transactions Act (Cap. 88) - Five main agreements governing MEPS+ relationships: - MEPS+ Service Agreement - Terms and Conditions Governing the Operation of the Current Account of the Specified Institution - Terms and Conditions Governing the Operation of the Accounts for SGS and MAS Bills - Terms and Conditions Governing the MAS Intraday Liquidity Facility (ILF) - PSA/International Securities Market Association (ISMA) Global Master Repurchase Agreement (GMRA) - Rights and obligations of MAS (as operator) and MEPS+ participants are set out in the MEPS+ Service Agreement. ### Regulatory, supervisory, and oversight framework - MAS is empowered by the PS(O)A and the Securities and Futures Act (SFA) and has primary responsibility for supervision of payment systems, CSDs, SSSs, CCPs and Trade Repositories (TRs) in Singapore. - MAS oversees CLS on a cooperative basis as a member of the CLS Oversight Committee (OC); the CLS OC is chaired by the United States Federal Reserve (USFR). - Key MAS publications and frameworks: - Monograph on Supervision of Financial Market Infrastructures in Singapore (revised October 2018; issued January 2013; revised January 2015) - Standards for MAS-operated FMIs (issued January 2015; revised November 2017) - MAS Framework for Impact and Risk Assessment of Financial Institutions (issued April 2007; revised September 2015) - MAS supervises payment systems with a risk-based approach, subjecting more systemically important systems to closer supervision. ### Designation categories and regulatory powers - The PS(O)A empowers MAS to designate payment systems for closer supervision and grants MAS powers to: - collect payment system-related information from operators, settlement institutions or participants; - subject designated payment systems (DPSs) to closer supervision with regulatory powers including imposing access regimes, restrictions and conditions, establishing standards, making regulations, approving and removing CEOs and directors, approving control of substantial shareholding, issuing directions, inspecting operations, and assuming control under emergency situations. - Designation categories: - Systemically important payment system (SIPS): disruption could trigger systemic disruption to Singapore’s financial system. MEPS+ is the only SIPS in Singapore. All SIPS are subject to the PFMI. - System-wide important payment system (SWIPS): disruption could affect public confidence or have system-wide implications but negligible risk of systemic impact to financial stability. FAST, SGDCCS, USDCCS, IBG system and NETS EFTPOS are SWIPS and designated under PS(O)A. SWIPS are not subject to the PFMI; instead they are subject to an internal risk assessment framework for designated payment systems. ### Cybersecurity and resilience - The Cyber Security Agency of Singapore (CSA) oversees national cybersecurity strategy and the Cybersecurity Act establishes a legal framework for oversight of essential services. - MAS works with CSA to strengthen cyber resilience of critical information infrastructures (CIIs) in banking and finance. - MAS established the Cyber Resiliency Framework for MAS-operated CIIs covering protection, detection, response and recovery. - A dedicated Technical Risk and Assurance Unit is being set up. - MEPS+ enhancements for cyber resilience: - Ensuring necessary data is available for resumption of settlement operations after a cyber-attack. - Expanding surveillance coverage, reinforcing protection capabilities, reducing time to recover, and developing cyber competencies. - Enhanced tracking and monitoring of input and output sequence numbers of SWIFT messages in MEPS+ to enable more timely detection of possible fraudulent messages. - MAS representatives co-chaired and drafted parts of the CPMI/IOSCO Guidance on Cyber Resilience for FMIs of June 2016. ### Major changes, reforms, and initiatives - Payment and Settlement Systems (Finality and Netting) Act amended in 2018 to: - enhance insolvency protection across three areas (transfer orders/netting/settlement protection for one business day beyond insolvency; protection for designated systems utilizing collateral; protection from liability for operators/settlement institutions/collateral holders and their officers/employees acting with reasonable care and in good faith); - provide greater clarity on designation criteria focusing on critical systems; - strengthen administrative powers to obtain information and issue directions; - impose an obligation on participants, operators, settlement institutions and collateral holders of a designated system to notify MAS of potential insolvency. - MAS intends to designate the FAST and NETS EFTPOS debit card system. - A Payment Services Bill (PSB) proposed in 2018 to: - streamline payment services under a single legislation by combining the PS(O)A and the Money-Changing and Remittance Businesses Act (MCRBA); - enhance scope of regulated activities to consider developments in payment services; - calibrate regulations according to activity risks via a modular regulatory regime. - PSB expected to be introduced in Parliament in late-2018. - Project Ubin (DLT initiative): - MAS has collaborated with industry on distributed ledger technology (DLT) for clearing and settlement since 2016. - First phase completed in March 2017 tested digital central bank issued tokens for domestic interbank payments, considering privacy, deterministic finality, and liquidity saving mechanisms such as netting. - Second phase focused on developing liquidity saving mechanisms; DVP phase demonstrated delivery versus payment capabilities for tokenized digital currencies and securities on different blockchain platforms. - MAS worked with the Bank of Canada and the Bank of England to assess alternative models for cross-border payments and settlements. - Future phases to include developing payment versus payment models to link Project Ubin with Project Jasper in Canada. ### Foreign exchange settlement risk practices - Banks in Singapore participated in the survey on foreign exchange settlement risk practices in response to international supervisory guidance issued in 2013. - The last survey was completed in July 2001, prior to onboarding the SGD to CLS. - MAS incorporated the BCBS Supervisory Guidance for Managing Risks associated with the Settlement of Foreign Exchange Transactions into its supervisory framework (MAS Credit Risk Management Guidelines and MAS Notice 637). - MAS expects banks to manage foreign exchange settlement risk as part of counterparty risk management; supervisory recommendations are communicated where practices do not align. - Supervisory expectations encourage use of payment-versus-payment arrangements (such as CLS) where practicable. ### Summary assessment of observance of the Principles - MEPS+ observes 17 Principles and broadly observes one Principle (operational risk). - Six Principles were assessed as not applicable. - To achieve full observance for operational risk, enhancements to cyber resiliency of the central bank and MEPS+ would need to be substantially implemented. - While MEPS+ has observed most minimum standards of the PFMI, opportunities for improvement were identified considering rapid technological changes, evolving risks, and international best practices. ### Governance, organization, and risk management observations - Legal basis is sound with enhancements for insolvency protection, designation criteria, and administrative powers for MAS. - MEPS+ is designated under the FNA, providing settlement finality and protection from the “zero-hour” rule in participant default. - MEPS+ Operating Rules (Rule 17.1) provide finality and irrevocability for transactions. - Governance arrangements: - Supervisory and operational functions are separated into different organizational units with distinct reporting lines to prevent conflicts of interest. - MAS appointed a member to its Board-level Risk Committee (Chief Defense Scientist at the Singapore Ministry of Defense) with specialist technology and cyber risk expertise. - MAS appointed a Chief Cyber Security Officer (CCSO) to senior management to strengthen cyber resiliency; CCSO is a member of the Management Critical Information Infrastructure Committee (CIIC). - The CCSO role is currently held concurrently by the Executive Director of TRPD (the overseer and supervisor of MEPS+); MAS should review role clarity and reporting line of CCSO to ensure independence of TRPD and prevent perceived or potential conflicts of interest. - The TRPD head is a member of the Management Financial Supervision Committee (MFSC), the governing oversight body of MEPS+. - MAS may consider whether a full-time CCSO position is warranted as responsibilities evolve. - Risk management: - MEPS+ has a risk management framework addressing operational, credit, liquidity and legal risks. - The MAS Board established the MEPS+ risk management framework, identifying operational risk as most material. - Recommendation: review and analyze potential DLT-related risks guided by the CPMI analytical framework for DLT in payment, clearing and settlement, covering legal basis, governance, settlement finality, financial risk and operational risk. *International Monetary Fund — Assessment of MEPS+ (extract).* ### 26. MAS does not face credit risk as the operator of MEPS+. As the central bank, MAS ### 1sgpea2019002 - 26. MAS does not face credit risk as the operator of MEPS+. As the central bank, MAS ### Credit risk, collateral, and ILF - MAS does not face credit risk as the operator of MEPS+ because participants provide collateral against borrowing from MEPS+ participants. - MAS offers the ILF which allows MEPS+ participants to borrow SGD on an intraday and collateralized basis to facilitate the settlement of SGD payments and help prevent system gridlocks owing to timing mismatches. - The ILF is available only to participants who have executed the PSA/ISMA GMRA with MAS. - MAS accepts SGS and MAS Bills as collateral in exchange for SGD cash via the ILF. - Eligible collateral under the ILF is limited to SGS and MAS Bills, described as the highest quality liquid assets available domestically. - Collateral is: - reviewed annually for eligibility, - marked to market daily, - valued based on an established framework with management approval sought for exceptions. - Haircuts: - determined based on the approved haircut framework which analyses the value-at-risk of debt securities in each class; - calibrated taking into consideration price movements under stressed scenarios to ensure sufficiency under stressed market conditions; - subject to annual reviews or as and when the need arises. ### Liquidity risk management and system features - MAS does not face liquidity risk as the operator of MEPS+; MAS does not act as the central counterparty or guarantee the settlement of transactions entered into MEPS+. - ILF supports liquidity needs by allowing interest-free intraday collateralized borrowing of SGD to settle SGD payments. - MEPS+ features: - automatic gridlock detection and resolution; - monitoring tools for intraday liquidity management, including daily maximum liquidity usage, available intraday liquidity at the start of the business day, total payments, and time-specific obligations. - MAS conducts annual stress tests on banks, reviewing impacts on banks’ settlement and knock-on impacts on other participants under different scenarios including: - the failure of a key participant; - the failure of multiple key participants from a country or region. - Results of stress tests are shared with management and other relevant departments. ### Settlement finality and RTGS in central bank money (Principles 8–9) - Settlement finality is clear and certain in MEPS+ under the FNA which provides for finality and irrevocability where system rules provide that transactions are final and irrevocable. - MEPS+ processes payment and securities transfer instructions for settlement on a real-time basis. - Settlement takes place continuously throughout the day whenever a payment is accepted and participants have sufficient funds and SGS and MAS Bills in their MEPS+ accounts. - Unsettled payments and securities transfers at the end of day are automatically cancelled. - Payments in MEPS+ settle in SGD only on a real-time gross settlement basis in central bank money. - MAS does not act as the central counterparty or guarantee settlement of transactions by MEPS+ participants. ### Exchange-of-value settlement (Principle 12) - Principal risks from settlement of securities transactions are eliminated through delivery versus payment (DVP) capabilities in MEPS+. - For RTGS of SGS trades and MAS Bills, MEPS+ has implemented DVP processing. - Each leg of a DVP trade is accorded finality under the FNA upon settlement; linked obligations are settled on a gross basis. - MEPS+ has implemented DVP Model 1 for processing securities transfer instructions from participants and payment of SGD corporate bonds traded by participants in the CDP. - The FNA provides legal certainty that all transactions settled by MEPS+ are final and irrevocable notwithstanding the insolvency of a participant. ### Default management (Principle 13) - MEPS+ has clearly defined rules and procedures to manage a default by a participant and conducts an annual contingency drill and testing of its default procedures. - The MEPS+ Service Agreement sets out the definition of default and procedures for handling a participant default. - Annual contingency drills cover, among others: - the failure of the largest net debit bank in meeting its check/Inter-Bank GIRO obligations; - the failure of a participant bank; - recasting of the check/Interbank GIRO obligations. ### General business and operational risk management (Principles 15–17) - MAS manages general business risks of operating MEPS+ based on enterprise-wide budgeting and accounting processes to monitor, manage and control operating expenses, including those arising from MEPS+ operations. - MAS does not use commercial custodian services for its own or participants’ assets (cash, SGS and MAS Bills). - MAS monitors and manages operational risks based on international and national standards and MAS-issued guidelines and notices on financial institutions. - Operational risk documentation includes the MEPS+ Operational and Risk Management Framework, ITD manuals, and annual MEPS+ risk assessments. - MAS reviews MEPS+ outsourcing arrangements annually and requires critical service providers (CSPs) to submit self-attestations covering financial strength, operational controls and processes, and physical and information security. - To achieve full observance for operational risk, enhancements to cyber resiliency would need substantial implementation. - Suggested considerations for MAS given global cyber risk heightening: - (i) enhancing enterprise-level cyber resiliency with mandatory information security awareness training and course completion for all MAS staff on a regular basis; - (ii) applying ratings in annual self-attestations submitted by MEPS+ CSPs to support continuation of critical services for MEPS+ and ensuring external audit is completed against acceptable national or international standards; - (iii) monitoring compliance of MEPS+ participants with mandatory controls of the SWIFT Customer Security Program, and ensuring self-attestations are audited. - Historical note: MEPS+ was not affected by the SGX trading disruptions reported in 2014 and 2016; MEPS+ functionality is not reliant on SGX systems. ### Access and tiered participation (Principles 18–19) - MEPS+ access and participation requirements include publicly disclosed risk-based criteria permitting fair and open access. - Access is open to all banks and regulated entities of systemic importance such as the CDP and SGX-DC that meet MAS’ prudential standards. - Participation requirements consider appropriate licensing and supervision by MAS or a competent authority in the applicant’s jurisdiction. - MAS assesses applicants’ creditworthiness and risks posed to the system and other participants among other strict admission criteria. - Participants must demonstrate continuous capacity to operate the technical equipment of the electronic payment system. - MAS monitors risks from tiered participation: direct participants must submit an annual return on total volume and value of MEPS+ transactions performed on behalf of indirect participants. - MAS may require indirect participants whose average daily value of MEPS+ payments through their direct participants exceed SGD 500 million to participate in MEPS+ directly. ### Efficiency (Principles 21–22) - MEPS+ efficiency and effectiveness are measured against qualitative and quantitative operational standards and targets documented in the MEPS+ Operational and Risk Management Framework. - Performance against operational standards and targets is reported monthly to the CIIC. - MEPS+ adopts a full cost recovery policy: - fees are set to achieve within 90 percent to 110 percent of the three-year average actual cost recoverability ratio. - operational, development and capital costs that meet recognition criteria as fixed assets are capitalized and depreciated over a period of three to five years. - fixed assets are reported in MAS financial statements. - MEPS+ fee schedules are reviewed annually by ITD, which seeks approval from the CIIC and MAS’ Executive Committee (EXCO). - MEPS+ uses the SWIFT network and SWIFT messaging standards for all funds settlement and securities transfer instructions; MAS is in the process of consultations with the banking industry on adoption of ISO 20022. ### Transparency (Principle 23) - MEPS+ operating rules and procedures are documented in the MEPS+ Service Agreement and the Operations and Contingency Manual, which are made public. - The last disclosure for MEPS+ was published in June 2018 and includes statistics on transaction volume and value. - MEPS+ participants are disclosed on the MAS website; the disclosure is updated every two years. - Recommendation: MAS should consider public disclosure of additional information on material developments and quantitative indicators such as MEPS+ system availability, average daily liquidity, and throughput time in the MEPS+ disclosure framework, particularly given operational incidences, FMI interdependencies, and MEPS+ CSPs. ### Ratings and prioritized recommendations - Table 1. Ratings Summary of MEPS+: - Observed: 1, 2, 3, 4, 5, 7, 8, 9, 12, 13, 15, 16, 18, 19, 21, 22, 23 - Broadly observed: 17 - Partly observed: (none listed) - Not observed: (none listed) - Not applicable: 6, 10, 11, 14, 20, 24 - Prioritized recommendations (selected): - Principle 2 — Chief Cyber Security Officer oversight and operational involvement: Clarify the role and reporting line to ensure separation of MEPS+ oversight and operational responsibilities. Relevant party: MAS. Timeframe: Immediate. - Principle 3 — Potential implications for safety from DLT: Analyze and identify potential implications for safety for MEPS+ against the CPMI analytical framework for DLT in payment, clearing and settlement. Relevant party: MAS. Timeframe: Near-Term. - Principle 17 — Cyber resiliency awareness and competencies: Enhance enterprise-level cyber resiliency with mandatory information security awareness training and course completion for all MAS staff on a regular basis. Relevant party: MAS. Timeframe: Immediate. - Principle 17 — Critical service providers assessments and audits: Apply ratings in annual self-attestations submitted by MEPS+ CSPs and ensure external audit is completed against acceptable national or international standards. Relevant party: MAS. Timeframe: Immediate. - Principle 17 — Endpoint security of MEPS+ participants: Monitor compliance of MEPS+ participants with mandatory controls of the SWIFT Customer Security Program and ensure self-attestations are audited. Relevant party: MAS. Timeframe: Immediate. - Principle 23 — Disclosure of material changes and quantitative indicators: Disclose additional information on system availability, average daily liquidity, and throughput time in the MEPS+ disclosure framework. Relevant party: MAS. Timeframe: Near-Term. - Timeframe definitions: “Immediate” is within one year; “near–term” is 1–3 years; “medium-term” is 3–5 years. ### Summary assessment of MAS responsibilities - Overall assessment: most responsibilities are observed. - Responsibility B (powers and resources) assessed as broadly observed due to resource constraints relative to the broad scope of responsibilities amid an evolving payments landscape. - Regulation, supervision, and oversight: - MEPS+ is subject to appropriate and effective regulation, supervision, and oversight by MAS. - Section 7(1) of the PS(O)A empowers MAS to designate and subject a payment system to closer supervision and various regulatory requirements. - Criteria for DPSs are defined and disclosed in the PS(O)A and the Monograph on Supervision of FMIs in Singapore. - All relevant PFMI principles applicable to MEPS+ are stated in the Standards for MAS-Operated FMIs. - Within MAS, the TRPD is responsible for supervision of payment systems in Singapore. - Regulatory powers and resources: - MAS is the sole authority in Singapore responsible for regulation, supervision and oversight of all payment systems. - MAS’ regulatory powers over DPSs include powers to impose access regimes, impose restrictions and conditions, establish standards, make regulations, approve and remove chief executive officers and directors, approve control of substantial shareholding, issue directions, inspect operations, and assume control of a DPS under emergency situations. - The PS(O)A mandates external audits of a DPS and imposes the obligation to notify MAS of significant operational changes. - Section 6 of the PS(O)A empowers MAS to collect information from all payment systems in Singapore. - Section 22 of the MAS Act provides immunity to MAS officers discharging their responsibilities. - Resource gap details: - As at July 2018, there were 5 staff in the payment systems oversight and supervision unit of the TRPD involved in supervision of DPS. - Specialist staff from technology risk and business continuity management teams also support supervision during inspections. - Organizational changes (e.g., set-up of the MAS Fintech and Innovation Group in 2015) shifted some experienced staff and payments policy work from TRPD to FTIG. - The payments oversight unit’s responsibilities include oversight of MEPS+, DPSs (FAST, SGDCCS, USDCCS, IBG, NETS EFTPOS), CLS, credit bureaus, and SWIFT. - Recommendation: MAS should increase resources for the payment systems oversight and supervision unit of the TRPD to support detailed annual assessments of MEPS+ and other DPSs which could evolve in systemic importance (particularly FAST). - Comparative staffing notes: The Payments and Infrastructure Division of TRPD has 20 staff and is responsible for oversight and supervision of MEPS+, DPSs, CLS, credit bureaus, payment institutions and SWIFT; 18 MAS staff are responsible for oversight and supervision of capital market FMIs for comparative purposes; Bank of England has 65 full time staff in its FMI Directorate; another CPMI/IOSCO jurisdiction cited has around 50 staff working on FMI oversight and supervision. *International Monetary Fund — Assessment extract.* ### 46. To further enhance transparency in its oversight and supervisory responsibilities, MAS ### To further enhance transparency in its oversight and supervisory responsibilities, MAS ### Recommendations to enhance transparency and disclosure - Enhance the independent review of MEPS+ with an annual assessment report with ratings prepared by the TRPD, endorsed by the MFSC, and publicly disclosed.14 - Enhance the transparency of MAS FMI responsibilities, including MEPS+, by publishing an annual report on FMI and payments for Singapore, which could include analysis of associated risks for MEPS+.15 ### Application of the Principles for FMIs (Responsibility D) - MAS adopts the PFMI in its supervision of SIPS. MEPS+ is currently the only SIPS in Singapore. - MAS may impose higher or more specific requirements on FMIs in the context of specific risks or wider financial sector stability. - For MEPS+, all relevant principles are fully adopted by MAS and included in the standards document. - MAS conducts annual assessments to understand the risk profile of each operator of SWIPS, highlight areas of concern and remedial actions, and gives ratings for each assessment. - The possibility of SWIPS becoming a SIPS is discussed during annual assessments. - Authorities should consider: - Revising the Monograph on Supervision of Financial Market Infrastructures to describe the standards used for designated SWIPS and the associated risks assessed relative to the PFMI. - Assessing on an annual basis the need to apply the PFMI to SWIPS with respect to horizon-scanning and changes in their risk profiles (such as value limit increase, cross-border features). ### Cooperation with Other Authorities (Responsibility E) - CLS is the only SIPS subject to cooperative oversight with MAS participation. - The USFR chairs the CLS OC; MAS participates alongside other central banks whose currencies are included in CLS. - The USFR organizes and administers the CLS OC, which operates in accordance with the Protocol for Cooperative Oversight of CLS. - MAS contributes to cooperative oversight of CLS by reviewing, providing views, and raising questions on CLS oversight matters, such as operations and risk management practices. - MAS, as a sector lead, works with the CSA to strengthen cyber resilience of CIIs in the banking and finance sector. - The Cybersecurity Act allows the Minister to appoint officers from the sector regulator as Assistant Commissioner to assist the Commissioner to oversee and enforce cybersecurity requirements on CII Owners (CIIOs). - CSA manages incident reporting through MAS as CSA’s sector lead / regulator, in fulfilment of the Cybersecurity Act by the CIIOs. ### Ratings summary (Table 2) — assessment categories - Observed: A, C, D, E - Broadly observed: B - Partly observed: (no entries) - Not observed: (no entries) - Not applicable: (no entries) ### Prioritized recommendations (excerpt) - B — Insufficient resources for the payment systems oversight and supervision unit - Recommended action: Increase resources for the payment systems and oversight unit of the TRPD, which is responsible for oversight and supervision of MEPS+, designated payment systems, CLS, credit bureaus, and major MEPS+ participants. - Relevant party: MAS - Timeframe: Near-Term - C — MEPS+ independent assessment and disclosure - Recommended action: Enhance the independent review of MEPS+ with an annual assessment report with ratings prepared by the TRPD, endorsed by the MFSC, and publicly disclosed. - Relevant party: MAS - Timeframe: Near-Term - C — Transparency of MAS FMI oversight responsibilities, including MEPS+ - Recommended action: Enhance the transparency of MAS FMI responsibilities, including MEPS+, by publishing an annual report on FMI and payments for Singapore, which could include analysis of associated risks for MEPS+. - Relevant party: MAS - Timeframe: Near-Term - D — Application of the PFMI to designated payment systems - Recommended action: Revise the Monograph on Supervision of FMIs to describe the standards used for designated system-wide important payment systems and the associated risks which are assessed relative to the PFMI. - Relevant party: MAS - Timeframe: Near-Term - D — Designated payment systems subject to the PFMI - Recommended action: Assess on an annual basis the need to apply the PFMI to system-wide important payment systems, based on horizon-scanning and changes in their risk profiles (value limit increase, cross-border features) and systemic importance. - Relevant party: MAS - Timeframe: Near-Term - Note: Timeframe definitions — “Immediate” is within one year; “near–term” is 1–3 years; “medium-term” is 3–5 years.1 ### Detailed assessment of MEPS+ — Principle 1: Legal Basis (Key findings) - Material aspects requiring legal certainty: - (i) finality in settlement for the transfer of funds, settlement of payment obligations and the transfer and settlement of book-entry securities and instruments between or among participants; and - (ii) enforceability of sale and repurchase (repo transactions) transactions, including in the event of a default or the insolvency of a participant. - Each material aspect is subject to the laws of Singapore; no other jurisdiction’s laws apply. - Legal basis and protections: - Issuance of dematerialised SGS and MAS Bills: Government Securities Act and the MAS Act; transfer by book-entry: FNA, Government Securities Act and MAS Act. - MEPS+ is a designated system under the FNA. The FNA provides settlement finality and protection from the application of the “zero-hour” rule in the event of a participant default. - FNA establishes that no court in Singapore shall recognize or give effect to an order of the courts in a foreign jurisdiction to reverse or unwind transactions settled in MEPS+ if such reversal would be prohibited under the FNA. - FNA and the MEPS+ Operating Rules provide that any transaction under the rules of a designated system is final and irrevocable and shall not be reversed, repaid or set aside; no order shall be made by any court for the rectification or stay of such transfer, netting or settlement. - MEPS+ Operating Rules (Rule 17.1) specify finality and irrevocability for: - (i) the transfer of funds into and out of an account of a participant of MEPS+; - (ii) the settlement of any payment obligation in MEPS+; and - (iii) the settlement and transfer of book-entry SGS and MAS Bills. - FNA (Section 12) limits finality and irrevocability for transfer orders entered into a designated system after the expiry of one business day following: (i) a court order for bankruptcy, judicial management or winding up in respect of the participant; or (ii) a resolution for the voluntary winding up of the participant. - Contracts and documents: - The MEPS+ Operating Rules are appended to the MEPS+ Service Agreement, which sets out rules for funds transfer, settlement of payment obligations and transfer and settlement of scripless SGS and MAS Bills in MEPS+. - Participants must enter the MEPS+ Service Agreement with MAS before access is granted; the Service Agreement is binding on the participant, between the participant and MAS and all other participants in MEPS+. - The MEPS+ Service Agreement is readily available and publicly disclosed on the MAS website. Operations and Contingency Manual and MEPS+ User Manuals are accessible to participants. - Legal articulation and enforceability: - Section 29A of the MAS Act provides MAS with legal authority to establish and operate MEPS+. - No court in any relevant jurisdiction has held MEPS+ activities or arrangements under its rules and procedures to be unenforceable. - Operations limited to Singapore; no identified cross-border conflicts of law to date. - Key conclusion: Legal basis assessed as Observed. ### Detailed assessment of MEPS+ — Principle 2: Governance (Key findings) - MAS objectives and performance tracking: - MAS has identified operational standards and targets and tracks and reports achievements to the CIIC monthly. - MAS performs an annual risk assessment of MEPS+ to assess performance against objectives. - Documented governance arrangements and separation of functions: - MAS roles with respect to MEPS+: (i) payment system operator; (ii) central bank monitoring banking system liquidity; and (iii) payment system regulator. - MAS Board oversight exercised through the Chairman’s Committee (CM); assisted by the Risk Committee (RC) in management of key risks in MEPS+. - Internal arrangement separates supervisory and operational functions with distinct reporting lines to different management fora. - Operational and risk management responsibilities: - Information Technology Department (ITD) and Finance Department (FD) are responsible for day-to-day operations of MEPS+ and report to CIIC. - Primary responsibility for risk management rests with ITD, supported by FD. - A dedicated unit within the Risk Management Department (RiMD) conducts independent risk management; RiMD is not a member of CIIC but sits in meetings as an observer and reports directly to EXCO and RC. - MEPS+ is subject to regular internal and external audits; Internal Audit Department reports to MD and Audit Committee. - Supervision and disclosure: - The TRPD is responsible for supervision of MEPS+ and carries out periodic inspections; TRPD is not involved in MEPS+ operations and does not participate in operational decisions, but may sit in CIIC meetings to be updated. - Amendments to the MEPS+ Service Agreement involve participant consultation and TRPD consultation to address supervisory concerns before changes are effected. - MAS disseminates MEPS+ information to participants via the MAS website and direct communications; up-to-date statistics and important documents are publicly available. - Governance arrangements are disclosed in the MEPS+ PFMI Disclosure, publicly available on the MAS website. - Board roles and responsibilities: - MAS Board appointed by the President of Singapore as required under section 7(3) and section 8(1) of the MAS Act. - MAS Board responsibilities set out in sections 7(1) and 7(2) of the MAS Act. - MAS may appoint committees pursuant to section 13A of the MAS Act; committees have clear terms of reference (e.g., CM approves major policies and strategies in relation to payment and settlement systems; RC provides oversight and guidance on risk management). - Section 8 of the MAS Act restricts directors from acting as delegates on boards of commercial, financial, agricultural, industrial or other interests with which they may be connected. *Source: 1sgpea2019002 - 46. To further enhance transparency in its oversight and supervisory responsibilities, MAS* ### Section 10(1) of the MAS Act ### Section 10(1) of the MAS Act ### Governance and Board Conduct - Section 10(1) of the MAS Act prohibits any member of the MAS Board of Directors from being a director or salaried official of any financial institution licensed or approved by MAS. - Under section 13 of the MAS Act, a director who is, directly or indirectly, interested in a contract made, or proposed to be made, by MAS shall disclose the nature of his interest at the first meeting of the MAS Board or Board Committee at which he is present after the relevant facts have come to his knowledge. - After disclosure, the director shall not take part in any deliberation or decision of the MAS Board or Board Committee with respect to that contract and shall be disregarded for the purpose of constituting a quorum of the MAS Board or Board Committee for any such deliberation or decision. - MAS Board members are required to abide by a Code of Conduct with specific requirements and procedures for managing conflicts of interest: - Gifts or entertainment accepted in a member’s capacity as a member of the MAS Board or MAS Board Committee should be disclosed as soon as practicable to the Chairman. - Investments or transactions that may pose a potential conflict of interest should be disclosed to the Chairman no later than two weeks after the transaction date. - Annually, the MAS Board of Directors must furnish a declaration of gifts and entertainment received in the past year, and an updated list of personal financial dealings that may present an actual or perceived conflict of interest. - MAS has established five MAS Board Committees: - (i) Chairman’s Meeting (CM) - (ii) Monetary and Investment Policy Meeting (MIPM) - (iii) Audit Committee (AC) - (iv) Risk Committee (RC) - (v) Staff Committee (SC) - The MAS Board conducts a biennial self-assessment survey covering structure, processes, and resources to review Board performance. ### Board Composition, Roles, and Remuneration - The MAS Board comprises members from both the public and private sectors to reflect MAS’ core functions (central banking, reserve management, integrated financial supervision, development of Singapore as a financial centre, and operation of the RTGS system). - Board composition aims to include relevant economic, policy, financial, legal and operational expertise. - MAS seeks candidates who possess experience and expertise relevant to MAS’ functions and who do not hold appointments presenting potential conflicts of interest (i.e., holding key positions in MAS-regulated entities). - Board members are paid a nominal fee; incentives are largely intrinsic (prestige). - Other than the Managing Director (MD), the MAS Board comprises non-executive and independent board members. - Independent board members are those who have independence from management (i.e., neither a serving employee nor an employee of MAS in the past three years). ### Management Structure and CIIC - Pursuant to section 9(6) of the MAS Act, the MD formed the CIIC to exercise MAS powers and duties in overseeing the CIIs operated by MAS, including MEPS+. - CIIC tasks include: - (i) overseeing the overall design and functionality of the CIIs, performance standards, policies and operating rules, compliance with legislative requirements and government policies, MAS’ risk management and operational guidelines, risk management of the CIIs, implementation of major system changes, and contingency plans; - (ii) recommending MAS management on CII strategic policies and key risk parameters; - (iii) providing regular assessments to MAS management on residual risks of the CIIs, including deviations from relevant policies and industry standards. - CIIC Terms of Reference clearly set out roles and responsibilities. - CIIC membership includes: - (i) Deputy Managing Director (Corporate Development Group), serving as the Chairman; - (ii) Assistant Managing Director (Corporate, HR and IT Services); - (iii) Assistant Managing Director (Finance, Risk and Currency); - (iv) heads of various departments such as IT and Finance and the MAS Chief Cyber Security Officer. - Assistant Managing Directors may serve as alternate chairperson. - Division heads for payment systems, applications, infrastructure, and security participate in CIIC meetings. - Representatives from RiMD, BD and IAD attend as observers. - MAS staff are bound by MAS Code of Conduct and Human Resource Operating Manuals; management appointment and removal procedures are set out in sections 9 and 10 of the MAS Act, and management staff can be removed based on assessment from the Staff Committee. ### Risk Governance and Framework (Board and MEPS+) - Pursuant to section 13A of the MAS Act, the MAS Board has formed the Risk Committee (RC) to assist in risk management responsibilities. - RC responsibilities (from Terms of Reference) include: - (i) advise the MAS Board on the framework, including components, definitions, methodology and measures; - (ii) advise the MAS Board on key risks identified, risk mitigating measures and priorities, including implementation time-frame; - (iii) advise the MAS Board on operational processes and accountability mechanisms within MAS; - (iv) provide the MAS Board with regular reports on MAS’ risk profile, risk areas of concern, and recommendations to strengthen risk management within MAS. - MEPS+ Operational and Risk Management Framework focuses on operational risks and includes: - (i) design and review to eliminate single point of failure and ensure sufficient capacity for expected or sudden surge in transaction load; - (ii) annual penetration test and system vulnerability assessment; - (iii) tight change management process for system changes; - (iv) real-time monitoring during MEPS+ operating hours and quarterly system health checks; - (v) annual contingency drills with participants and MEPS+ CSPs. - Annual risk analysis and assessment is conducted and results are presented to RC and management for endorsement and decisions on additional mitigation. - Defence-in-depth: - First line: line departments (risk owners). - Second line: RiMD provides additional checks, challenges assumptions, and escalates competing requirements or trade-offs to CIIC and EXCO. - Third line: IAD provides independent assessment of internal controls with a direct reporting line to AC. - Incident management protocol: - ITD assesses incident nature and severity; situation updates provided to CIIC Chairman and relevant department heads. - CIIC Chairman decides to activate Disaster Recovery or Offline Contingency Module (OCM). - For prolonged disruptions (i.e., multiple days), departments seek MD’s approval to convene MAS Crisis Management Team comprising the MD, Deputy Managing Directors, and Assistant Managing Directors — decision-making authority lies with this Team. - MEPS+ Operational and Risk Management Framework is jointly owned by ITD and RiMD, reviewed annually; major changes require CIIC and RC approval. - The audit and risk management functions are staffed by full-time dedicated personnel with appropriate skill-sets and resources. - As the operator for MEPS+, the main risk identified is operational risk; risk management models are not used for this risk. ### Stakeholder Consultation and Disclosure - MAS actively consults participants and relevant stakeholders on proposed changes to the MEPS+ Service Agreement, operating rules and enhancements unless changes have limited impact. - Feedback from participants and stakeholders is presented to CIIC for information and discussion before decisions are made. - Once a decision is made, participants are informed of the effective date via circulars and emails; changes are published on the MAS website. - MEPS+ participants’ feedback is elicited as part of the consultation process and shared with CIIC; participant feedback is presented to the MAS Board where decisions need referral. ### Key Conclusions and Assessments (Principles 2 and 3) - Governance arrangements are clear and transparent; supervisory and operational functions for MEPS+ are separated into different organizational units and have distinct reporting lines to prevent conflicts of interest. - Assessment of Principle 2: Observed - Recommendation/comment: Clarify the role and reporting line for the Chief Cyber Security Officer to ensure separation of MEPS+ oversight and operational responsibilities. - MEPS+ has a sound risk management framework identifying operational, credit, liquidity and legal risks; operational risk assessed as most material. - Assessment of Principle 3: Observed - Recommendation/comment: Analyze and identify the potential implications for safety for MEPS+ against the CPMI analytical framework for DLT in payment, clearing and settlement. ### Credit Risk and Intraday Liquidity Facility (ILF) (Principle 4) - MAS offers the ILF which allows MEPS+ participants to borrow SGD on an intraday and collateralized basis to facilitate settlement and help prevent gridlocks. - ILF eligibility: - Available only to participants who have executed the PSA/ISMA GMRA with MAS. - Credit exposure mitigation for ILF: - Collateral accepted: SGS and MAS Bills only. - Amount of liquidity extended equals the market value of collateral subject to a haircut. - Haircuts determined by a haircut framework calibrated based on time-to-maturity and risk characteristics; haircuts published on the MAS website and reviewed annually or as needed (i.e., significant changes in market volatility). - Collateral is marked to market daily. - Delivery versus payment (DVP) Model 1 settlement mechanism used in collateral exchange. - MEPS+ verifies execution of GMRA before processing ILF requests. - Online platform allows daily monitoring of participants and exposures. - ILF repo reversal and recovery: - Lending is automatically reversed at 5:30 p.m. in MEPS+. - MAS is entitled to reverse the repo transaction at end of day and secure funds from participant’s MEPS+ account or by selling the SGS or MAS Bills obtained in opening leg of the repo. - If shortfall persists, MAS may claim liquidated damages per Terms and Conditions Governing the MAS ILF and GMRA allows MAS to make claims against participant for any shortfall. - Assessment of Principle 4: Observed ### Collateral Practices (Principle 5) - Eligible collateral under the ILF is limited to SGS and MAS Bills (highest quality liquid assets domestically); list reviewed annually. - To avoid wrong-way risk, only SGS and MAS Bills are accepted; debt securities issued by other entities are not accepted. - Collateral valuation and haircuts: - Collateral is marked to market daily. - Valuation performed based on an established framework; management approval sought for exceptions. - Haircuts determined based on approved haircut framework analysing value-at-risk of debt securities in each class. - Calibration incorporates stressed market conditions; haircuts subject to annual reviews or as and when needed. - Collateral management system: - MEPS+ functions as collateral management system for ILF using DVP settlement for ILF transactions. - Securities in participant’s MEPS+ account are automatically earmarked and instantaneously transferred to MAS in exchange for liquidity. - MAS monitors pledged collateral in real time. - MAS’ rights to collateral are secured under GMRA; MAS does not reuse or allow participants to reuse collateral it receives under ILF. - Assessment of Principle 5: Observed ### Margin (Principle 6) - Not applicable to MEPS+; CCP-specific margin requirements and practices are not applicable. ### Liquidity Risk (Principle 7) - MAS, as operator of MEPS+, does not face liquidity risk as it does not act as central counterparty or guarantee settlement of transactions in MEPS+. - MEPS+ design and participant tools to manage liquidity: - Real-time access to MEPS+ account balances, securities holdings, and settlement status via MEPS+ Browse. - Participants can set bilateral limits, overall payment limits, earmark funds, prioritize or cancel payments. - Automatic gridlock detection and resolution mechanism runs every half hour. - Fee structure is time-based and encourages early settlement. - Graduated Payment Schedule adherence reported at end-of-day; reference to ABS Graduated Payment Schedule recommending at least 30 percent of transaction value by 10:30 a.m., 60 percent by 2:30 p.m., and remaining balance by 5:30 p.m. - Automatic liquidity reversal at 5:30 p.m.; if participants cannot return borrowed ILF funds, collateral will be held by MAS and participants may incur additional fees. - Monitoring and stress testing: - MEPS+ monitored near real-time via automated utilities and MEPS+ reports (daily, monthly, annual metrics). - MAS conducts annual stress tests on banks reviewing impact on banks’ settlement and knock-on impacts; scenarios include failure of a key participant and multiple key participants from a country or region. Results are shared with management and relevant departments. - Legal finality and continuity: - MEPS+ is a designated system under the FNA providing settlement finality and protection from the “zero-hour” rule, subject to section 12 and section 14 limitations around insolvency timing. - If a participant defaults during the day, transfer orders entered into MEPS+ will be effected provided transfer order was entered on or before the expiry of one business day after: (i) court made an order for bankruptcy, judicial management or winding up in respect of the participant; or (ii) a resolution for the voluntary winding up of the participant was passed. After that point, transactions involving the default participant will be rejected by MEPS+ while transactions among other participants continue to settle and are final and irrevocable. - Assessment of Principle 7: Observed ### Operational Resilience, Interdependencies, and Contingency Arrangements - MAS reviews interdependencies and material risks with other entities during annual risk assessments or when significant changes occur; focus on impact if MEPS+ services are unavailable and impact on MEPS+ from other entities’ disruptions. - Mitigants and contingency arrangements: - MEPS+ operating hours may be extended. - Offline contingency measures and regular business continuity drills with participants and other FMIs (e.g., annual offline contingency drills with CLS, semi-annual CLS full outage tests, annual contingency exercises with SWIFT). - Annual contingency drills with MEPS+ participants; findings reported to CIIC. - Incident protocol and escalation (see Risk Governance section). - Recommendation noted under Principle 3: Analyze DLT implications per CPMI framework. ### Key Conclusions and Recommendations Extracted - Governance arrangements, segregation of duties, and reporting lines are clear and transparent. - MEPS+ has a sound risk management framework with identified operational, credit, liquidity and legal risks; operational risk is the most material. - ILF and collateral frameworks provide full collateralization of intraday credit exposures using SGS and MAS Bills with daily mark-to-market and calibrated haircuts. - MEPS+ operational features (real-time monitoring, gridlock resolution every half hour, contingency drills, time-based fees, Graduated Payment Schedule reporting) support intraday liquidity management and reduce systemic risk. - Assessment summaries: - Principle 2: Observed — Recommendation: Clarify Chief Cyber Security Officer role and reporting line. - Principle 3: Observed — Recommendation: Analyze potential implications for MEPS+ safety against CPMI DLT analytical framework. - Principle 4: Observed. - Principle 5: Observed. - Principle 6: Not applicable. - Principle 7: Observed. *Source: 1sgpea2019002 - Section 10(1) of the MAS Act* ### Section 7 of the FNA provides for the finality and irrevocability ### 1sgpea2019002 - Section 7 of the FNA provides for the finality and irrevocability ### Finality and irrevocability under Section 7 of the FNA - Section 7 of the FNA provides for the finality and irrevocability of transactions carried out on MEPS+ and applies where the rules of a designated system provide that the transactions are final and irrevocable. - Rule 17.1 of the MEPS+ Operating Rules lists the following transactions as being final and irrevocable: - (i) the transfer of funds into and out of an account of a participant of MEPS+; - (ii) the settlement of any payment obligation in MEPS+; and - (iii) the settlement and transfer of book-entry SGS and MAS Bills. - "This means that notwithstanding anything to the contrary in any written law or rule of law, these transactions shall not be reversed, repaid or set aside and no order shall be made by any court for the rectification or stay of such transfer or settlement." ### Exclusions under Section 12 of the FNA - Section 12 of the FNA makes it clear that section 7 of the FNA shall not apply to any transfer order given by a participant which is entered into a designated system after the expiry of one business day after: - (i) a court made an order for bankruptcy, judicial management or winding up in respect of the participant; or - (ii) a resolution for the voluntary winding up of the participant was passed. ### Finality in the case of links and DVP processing - See responses to Principle 1, KC1 and KC4. - MEPS+ has implemented DVP processing. - Rules 12.1 to 12.13 of the MEPS+ Operating Rules provide the legal basis for this DVP processing. ### Final settlement timing (Key Consideration 2) - Key Consideration 2: "An FMI should complete final settlement no later than the end of the value date, and preferably intraday or in real time, to reduce settlement risk. An LVPS or SSS should consider adopting RTGS or multiple-batch processing during the settlement day." - Final settlement on the value date: - "Settlement in MEPS+ takes place continuously throughout the day whenever a payment is accepted by the system and participants have sufficient funds and SGS and MAS Bills in their MEPS+ accounts." - "Unsettled payments and securities transfers at the end of day are automatically cancelled." ### Intraday or real-time final settlement - "MEPS+ processes payment and securities transfer instructions for settlement on a real-time basis." - "Participants who originate the payments or securities transfers would receive notifications once their transactions are settled in MEPS+." - "They can also perform online inquiries on the transaction status." ### Point after which obligations may not be revoked (Key Consideration 3) - Key Consideration 3: "An FMI should clearly define the point after which unsettled payments, transfer instructions, or other obligations may not be revoked by a participant." *Source: 1sgpea2019002 - Section 7 of the FNA provides for the finality and irrevocability* ### Section 7 of the FNA provides for the finality and irrevocability ### Section 7 of the FNA provides for the finality and irrevocability ### Finality and irrevocability (Principle 8 — key findings) - Section 7 of the FNA provides for the finality and irrevocability of transactions in MEPS+ and shall apply where the rules of a designated system provide that the transactions are final and irrevocable. - Rule 17.1 of the MEPS+ Operating Rules lists transactions to be deemed final and irrevocable pursuant to Section 7 of the FNA. - Rule 4.3 of the MEPS+ Operating Rules: transactions pending settlement or execution may still be cancelled by participants who initiated the transactions. - Rule 4.4 of the MEPS+ Operating Rules: - For any transaction involving SGS and MAS Bills that is not matched, the participant that sent the instruction may unilaterally initiate its cancellation. - For any transaction involving SGS and MAS Bills that is matched, both participants that are parties to the transaction are required to initiate and confirm the cancellation. - Payment transactions pending settlement can only be cancelled by the participant that initiated them. - Queued and future-dated payment instructions in MEPS+ can only be cancelled by the initiating participant by sending in a SWIFT cancellation message to MEPS+. - No exceptions are allowed to revocation deadlines. - Rule 4 of the MEPS+ Operating Rules (appended to the MEPS+ Service Agreement) sets out circumstances for cancellation of messages in MEPS+. The MEPS+ Service Agreement is publicly available on the MAS website. - Key conclusion: Settlement finality is clear and certain in MEPS+. Assessment of Principle 8: Observed. ### Money settlements (Principle 9 — key findings) - Payments in MEPS+ settle in SGD only, on a real-time gross settlement basis in central bank money. - MAS does not act as the central counterparty or guarantee the settlement of transactions by MEPS+ participants; as operator MAS is not exposed to credit risk from participant transactions. - Intraday liquidity facility (ILF) arrangements: - Participants enter into repo transactions with MAS using their own unencumbered SGS or MAS Bills as collateral to obtain ILF. - Collateral (SGS and MAS Bills) are subjected to haircuts. - Safeguards include: - (i) MEPS+ automatically reversing the repo transaction at the end of the day if there are sufficient funds in the participant’s RTGS account; - (ii) MAS may instruct reversal on the next earliest business day where there are sufficient funds if reversal could not settle on the previous day; - (iii) MAS can return collateral only after repurchase price and liquidated damages (if any) have been duly returned to MAS; - (iv) MAS has the right to sell or dispose of eligible collateral and apply proceeds to offset outstanding amounts due to MAS, including liquidated damages. - Liquidity risks: - MEPS+ settles in real time and DVP basis (for securities transfers) only if participants have sufficient balances and securities; otherwise payments and securities transfers are queued. - The ILF is interest-free; participants must enter into a GMRA and have eligible collateral (SGS or MAS Bills) to access ILF. - MAS is not exposed to liquidity risk as it has unlimited amount of SGD liquidity. - Key conclusion: Payments in MEPS+ settle in SGD only, on a RTGS basis in central bank money. Assessment of Principle 9: Observed. ### Exchange-of-value / DVP (Principle 12 — key findings) - The FNA provides legal certainty that all transactions settled by MEPS+ are final and irrevocable notwithstanding the insolvency of a participant. - MEPS+ implements delivery-versus-payment (DVP) processing for real-time gross settlement of SGS trades and MAS Bills; Clauses 12.1 to 12.13 of the MEPS+ Operating Rules provide legal basis for DVP processing. - Linked obligations are settled on a gross basis. MEPS+ has implemented DVP Model 1 for: - processing securities transfer instructions from participants; and - payment of SGD corporate bonds traded by participants in the CDP. - Processing details: - For securities transfer instructions: MEPS+ earmarks seller securities after trade match, generates a payment order for buyer stored until settlement day; on settlement day, MEPS+ debits buyer (subject to sufficient funds) and instantaneously transfers earmarked securities to buyer. - For SGD corporate bonds: MEPS+ debits buyer (subject to sufficient funds) and instantaneously transmits a SWIFT message to CDP, which simultaneously transfers earmarked SGD corporate bonds within CDP’s Debt Securities Clearing and Settlement System. - Key conclusion: Principal risk from securities settlement is eliminated through DVP capabilities; each leg of DVP trades is accorded finality under the FNA. Assessment of Principle 12: Observed. ### Participant-default rules and procedures (Principle 13 — key findings) - Criteria for default and handling defined in Clause 9.1 of MEPS+ Service Agreement and Rules 11.8–11.12 of MEPS+ Operating Rules. - Clause 5 of Terms and Conditions Governing the MAS ILF addresses participant failure to repay ILF by 5:30 p.m. (cut-off for ILF reversal). - On participant winding up or receiver/manager appointment, participant must notify MAS; MAS may suspend or terminate MEPS+ services to the participant. - Upon suspension/termination MAS will notify participants via SWIFT and email; pending, queued, forward-dated transactions of the suspended/terminated participant will be cancelled or rejected except certain transactions (e.g., interbank funds transfers between affected participant and MAS, redemption of matured SGS and MAS Bills). - Use of financial resources: - MAS is not affected by liquidity pressures from participant default; MEPS+ is RTGS and there is no loss sharing arrangement. - Participants encountering liquidity strains due to failed payments from a defaulting participant may access ILF; ILF collateral subject to haircuts. - If collateral is insufficient, GMRA allows MAS to make claims against participant for shortfall. - Default preparedness: - Relevant MAS supervisory departments manage insolvent participant banks; MAS’ Crisis Management Team activated to minimize sector impact. - Communication via emails and telephone as necessary. Internal procedures endorsed by CIIC and reviewed annually or as needed. - MAS conducts an annual contingency drill including participants and stakeholders (e.g., BCS); drills cover failure of the largest net debit bank and participant bank failures, including recasting of check/Interbank GIRO obligations. - Key conclusion: MEPS+ has clearly defined default rules, annual contingency drills and testing. Assessment of Principle 13: Observed. ### Operational risk (Principle 17 — identification, controls, business continuity) - Operational risk identification: - Annual MEPS+ risk assessment uses MAS internal database of past operational risk events and external events. - Identified sources: (i) Insider; (ii) External linkage; (iii) Transaction load; (iv) CSPs; (v) Infrastructural resiliency; (vi) Cyber threat; (vii) Application defects; (viii) Operational disruption. - No known single point of failure in MEPS+ identified. - Management and governance: - MEPS+ Operational and Risk Management Framework documents systems, policies, procedures, controls (security-by-design, access reviews, near real-time alerts, change management, SDLC). - ITD and FD oversee day-to-day operations; RiMD conducts independent risk assessments and reviews controls; annual internal audit and Auditor-General’s Office audits. - MEPS+ Operational and Risk Management Framework endorsed by EXCO, RC and MAS Board (framework endorsed by the MAS Board in November 2014). - Controls and resilience measures: - Automated reconciliation of participants’ account balances and holdings against settled transactions. - Storage of critical MEPS+ data at a third site for continued processing and settling. - Enhanced oversight of MEPS+ ASP practices and code testing controls; near real-time monitoring of transaction flows; automation of contingency solution; enhanced monitoring of user and application logins; participant self-assessments against security guidelines. - MAS strengthening cyber resilience: expanding surveillance coverage, reinforcing protection, reducing recovery time, developing competencies. - Personnel controls: security screening, training (including SWIFT), documentation to mitigate key-person risk. - Authorization control for fraudulent payments during participant disruptions (payments require senior officer authorization depending on value). - Change management and testing: - Application change, system change, evaluation/approval, and post-implementation processes described; independent security consultants review source code; penetration testing and vulnerability assessments at least annually. - Near real-time monitoring, quarterly system health checks, annual contingency drills with participants and CSPs, DR tests every six months, live operations at alternate site. - Capacity: - MEPS+ capacity to process up to three times the average daily settlement volume or two times the peak settlement volume, whichever is higher; capacity tested annually through volume testing by independent test consultants. - Third-party and interdependencies: - CSPs: BCS Information Systems (MEPS+ ASP); NCS (DR site service provider); SWIFT (messaging service provider). Service level agreements and regular meetings maintained. - Contingency arrangements and drills with CLS and CDP. - Key conclusion: MAS monitors and manages operational risks based on international and Singapore standards; MEPS+ broadly observes Principle 17 but requires enhanced cyber resiliency to achieve full observance. - Assessment of Principle 17: Broadly Observed. - Recommendations and comments (operational/cyber): - Enhance enterprise-level cyber resiliency with mandatory information security awareness training and course completion for all MAS staff on a continuous basis. - Apply ratings in the annual self-attestations submitted by the CSPs to support continuation of critical services for MEPS+ and ensure external audit is completed against acceptable national or international standards. - Monitor compliance of MEPS+ participants with mandatory controls of the SWIFT Customer Security Program, and ensure self-attestations are audited. ### Access and participation requirements (Principle 18 — key findings) - Access to MEPS+ is open to all banks and regulated entities of systemic importance (e.g., CDP, SGX-DC) that meet MAS’ prudential standards. - MAS assesses applicant creditworthiness and risks posed to system and other participants; where MAS does not supervise the entity directly (e.g., CLS), access may be permitted subject to credible supervision by an international oversight committee or competent authority in home country. - Participants must maintain good track record on financial obligations (e.g., payment of fees) and demonstrate continuous capacity to operate technical equipment (SWIFT membership, hardware/software, capability to send/receive SWIFT messages). - Adequate disaster recovery facilities required of participants. - For non-bank participants, access criteria include supervision by an international oversight committee or competent authority (if not subject to MAS), SWIFT membership, and adequate disaster recovery. - MEPS+ Service Agreement publicly discloses access criteria on MAS website. - Monitoring and suspension: - MAS monitors compliance on an ongoing basis; MEPS+ Service Agreement sets out suspension/termination conditions. - MEPS+ is RTGS and as such there is no risk to MAS from providing access to participants whose risk profile has deteriorated; ILF haircuts reduce MAS’ credit exposure. - Fees due from participants are automatically debited from MEPS+ accounts before funds are available for interbank payments. - Participants breaching access criteria will have access terminated and will be notified; other participants will be informed. Procedures reflected in Operations and Contingency Manual. - Key conclusion: MEPS+ access and participation requirements are publicly disclosed, risk-based, and permit fair and open access. Assessment of Principle 18: Observed. ### Tiered participation arrangements (Principle 19 — key findings) - MEPS+ participant categories: direct participants (executed MEPS+ Service Agreement, direct MEPS+ accounts) and indirect participants (no RTGS account; submit via direct participants). - Direct participants must submit an annual return to MAS on total volume and value of MEPS+ transactions performed on behalf of indirect participants; MAS analyses returns to identify, monitor and manage tiered risks. - 2017 indicators (tiered participation risk assessment): - Indirect participants’ average daily MEPS+ payment transaction value comprised only 2 percent of the average daily MEPS+ payment transaction value. - Only one direct participant had 11 percent of its daily MEPS+ payment transaction value originating from its indirect participants. - Mitigants and thresholds: - Indirect participants whose average daily value of MEPS+ payments through direct participants exceed SGD 500 million may be required to participate in MEPS+ directly. - Key direct participants appointed as agent banks are required to have robust contingency arrangements for customer-indirect participants. - MAS reviews results at CIIC and may encourage direct participation or require contingency arrangements where appropriate. - Key conclusion: MAS monitors and manages material risks from tiered participation; assessment of Principle 19: Observed. ### Communication procedures and disclosure (Principles 22 and 23 — key findings) - Communication procedures and standards: - MEPS+ uses SWIFT network and SWIFT messaging standards for all funds settlement and securities transfer instructions; MEPS+ does not have cross-border operations. - Key conclusion: MEPS+ uses internationally accepted communication procedures and standards. Assessment of Principle 22: Observed. - Disclosure of rules, procedures and market data: - MEPS+ operating rules and procedures documented in MEPS+ Service Agreement and Operations and Contingency Manual; documents published on MAS website. - Functional specifications and user manuals provided to participants for each annual upgrade; MEPS+ system design and operations documented. - MAS’ discretionary powers are defined in the MEPS+ Service Agreement and Operating Rules (examples include termination of defaulting participants, modifying online information, suspending services, adjusting figures, changing system cut-off windows). - Participants can apply for exemptions from certain Operating Rules provisions per Clause 24. - MEPS+ pricing and fee incentives documented in the MEPS+ Service Agreement; participants given at least one month’s notice of fee changes; public notified via amendments published on MAS website. - MEPS+ PFMI Disclosure updated every two years; last disclosure published in June 2018. MEPS+ statistics (transaction volume and value) disclosed annually on MAS website; MEPS+ participants disclosed on MAS website. - Key conclusion: MEPS+ provides clear, comprehensive, and publicly disclosed rules and procedures and has disclosed MEPS+ PFMI Disclosure (last published June 2018). Assessment of Principle 23: Observed. - Recommendation (transparency): MAS should consider public disclosure of additional material developments and quantitative indicators such as MEPS+ system availability, average daily liquidity, and throughput time in the MEPS+ disclosure framework to enhance public understanding and confidence. ### Efficiency and effectiveness (Principle 21 — key findings) - MEPS+ design, rules and procedures customized to meet participant needs; major changes made after consultation with key participants. - Qualitative and quantitative operational standards and targets are defined and achievements tracked and reported monthly to CIIC; MEPS+ met operational targets in 2017. - MEPS+ adopts a full cost recovery policy: - Fees are set as a matter of practice to achieve within 90 percent to 110 percent of the three-year average actual cost recoverability ratio. - Operational, development and capital costs meeting fixed-asset recognition criteria are capitalized and depreciated over a period of three to five years. - MEPS+ fee schedules reviewed annually by ITD with approval from CIIC and MAS’ EXCO. - Key conclusion: MEPS+ measures efficiency and effectiveness via operational standards and targets; Assessment of Principle 21: Observed. ### Oversight, regulation and supervision responsibilities (Responsibility A & B — key findings) - Legal and designation framework: - PS(O)A Section 7(1) empowers MAS to designate and subject payment systems (DPSs) to closer supervision and regulatory requirements if: - (i) a disruption could trigger or transmit systemic disruption to Singapore’s financial system; - (ii) a disruption could affect public confidence in payment systems or the financial system of Singapore; - (iii) or otherwise in the interests of the public to do so. - Factors for identifying DPSs are in section 3.4 of the Monograph: (i) number and value of transactions processed; (ii) number and type of participants; (iii) markets served; (iv) market share; (v) interconnectedness with other payment systems and financial institutions; (vi) available alternatives at short notice. - PS(O)A and the Monograph are publicly accessible (PS(O)A on Singapore Attorney-General’s Chambers website; Monograph on MAS website). - MAS role and practices: - MAS designated six payment systems as DPSs: (i) MEPS+; (ii) FAST; (iii) SGDCCS; (iv) USDCCS; (v) IBG system; (vi) NETS EFTPOS. - MEPS+ is the only Systemically Important Payment System (SIPS) in Singapore and the only payment system subject to the PFMI. - MAS is an integrated regulator and central bank; MAS is sole authority for regulation, supervision and oversight of payment systems in Singapore. - MAS exempts itself under PS(O)A as operator, settlement institution and participant of MEPS+ (PS(O)A designed for commercial DPSs) but holds itself to similar standards and oversees MEPS+ through formalized oversight mitigating conflict of interest. - MAS’ supervisory objectives: promote safety and ensure efficiency of payment systems; FNA cited as legal framework reducing systemic risk by deeming payments final and irrevocable when conditions met. - Internal resources and governance: - TRPD within MAS responsible for supervision of payment systems; TRPD collects information via surveys and direct gathering; TRPD reports to MFSC and is represented on CPMI/IOSCO Steering Group. - MAS IT supervision uses on-site inspections and off-site reviews to assess technology risks; DPS operators participate in cybersecurity exercises run by MAS and CSA. - Key conclusion for Responsibility A: MEPS+ is subject to appropriate and effective regulation, supervision, and oversight by MAS. Assessment of Responsibility A: Observed. - Responsibility B (powers and resources): - MAS has powers under PS(O)A to collect information and regulate DPSs; MAS is sole authority for payment systems supervision in Singapore. - Key conclusion for Responsibility B: MAS has powers and resources consistent with responsibilities to supervise FMIs. *Source: 1sgpea2019002 - Section 7 of the FNA provides for the finality and irrevocability* ### section 6 of the PS(O)A empowers MAS to collect payment ### Section 6 of the PS(O)A empowers MAS to collect payment system-related information ### Powers to obtain timely information - Section 6 of the PS(O)A empowers MAS to collect payment system-related information from the operators, settlement institutions or participants of any payment system in Singapore. - Section 27 of PS(O)A provides MAS with powers to inspect, under conditions of secrecy, the books of an operator or a settlement institution of a DPS. - Part V of PS(O)A imposes obligations on the operators and settlement institutions of DPSs to: - (i) notify MAS of the acquisition of any corporation that does not carry on the business of operating a payment system; - (ii) notify MAS of certain events listed in the Act, including: an intention to make a material change to the operating rules, settlement procedures or activities of the DPS; an event or irregularity that impedes or prevents access to, or impairs the usual operations of the DPS or its settlement operations; the operator or settlement institution becoming or likely to become insolvent or unable to meet its financial statutory, contractual or other obligations; and other events that the Authority may prescribe by regulations; and - (iii) submit periodic reports. - Regulation 6 of the Payment Systems (Oversight) Regulations 2006 (“PS(O)R”) requires submission of financial statements and other reports as MAS may require for the proper administration of the PS(O)A (examples include annual submission of audited financial statements and audit reports). - Regulation 11 of PS(O)R requires notification to MAS as soon as practicable of any activation of BCP and, within 14 days or such longer period as may be permitted by MAS, inform MAS of any material change to the BCP and submit, at the request of MAS, a copy of the new plan. - Section 12(1) of the PS(O)A and the Notice on Technology Risk Management require reporting disruptions to operations or systems, including any IT security incidents, to MAS. - Section 11 of the PS(O)A requires a DPS to notify MAS as soon as practicable upon carrying on of any business or acquiring a substantial shareholding in a corporation which is not related to operating a payment system. - Section 12 of PS(O)A requires notification as soon as practicable after the occurrence of any significant event, such as intention to make a material change to the operating rules, settlement procedures or activities. - Section 6 of the PS(O)A may require submission of additional information such as quarterly and semi-annual transaction volume and value statements. ### MEPS+ oversight arrangements and information access - As MEPS+ is owned and operated by MAS, MAS has established a formal internal arrangement for segregation of the supervisory and operational functions, with distinct reporting lines to different management fora. - MFSC is the management forum responsible for the supervision of MEPS+ and has approved an internal oversight arrangement to ensure the safety and efficiency of MEPS+. These include adherence to PFMI, timely notification of significant incidents, quarterly reporting to TRPD, notification of significant changes in operations, and inspection of the system. - TRPD is empowered to request timely information from the function responsible for the operations of MEPS+. Such information includes quarterly reports on key MEPS+ developments (such as strategies, testing and incidents) and statistics of MEPS+. - TRPD is notified in advance of changes in the MEPS+ Service Agreement and collects and analyses transaction information on MEPS+ to understand payment trends and to identify payment flow anomalies and any risk that may arise in the system. - For MEPS+, departments responsible for MEPS+ operations are required to: - (i) notify TRPD as soon as possible, but no later than 1 hour, of significant incidents (i.e., an event which impairs the usual operations of MEPS+ including any IT security incidents, activation of disaster recovery or BCP); - (ii) notify TRPD in advance before the occurrence of any significant event, such as intention to make a material change to the operating rules, settlement procedures or activities; and - (iii) submit MEPS+ quarterly reports to TRPD. The quarterly reports consist of updates on key payment statistics, activities (i.e., industry testing) and decisions made by management committees (i.e., updates to Board Risk Committee). - TRPD has full access to all MEPS+ documents (such as MEPS+ Service Agreement and risk management framework), payment statistics, and transaction details. - TRPD obtains information through: - (i) requiring timely notification of significant incidents and changes to operations, submission of quarterly reports, and regular meetings with the operator; - (ii) attending, whenever useful, decision-making forums in which key MEPS+ operational policies and implementation issues are decided; - (iii) reviewing the Disclosure Framework and self-assessments done by the operations function against the PFMI and requesting supporting documents during reviews; and - (iv) inspecting MEPS+ to assess adherence to the PFMI and requesting supporting documents during inspections. - TRPD’s review of information helps it to understand and assess MEPS+’s functions and activities, risks borne or created by MEPS+, impact of MEPS+ on participants and the broader economy, and adherence of MEPS+ to the PFMI. TRPD does not review the financial condition of MAS. ### Powers to induce change or enforce corrective action - Part VI of the PS(O)A provides MAS with regulatory powers including the power to: (i) impose conditions; (ii) establish standards; or (iii) issue directions. - In the event of any breach of the PS(O)A, MAS is empowered to compound the offence, or prosecute the offender whereby fines or imprisonment terms on responsible persons may be imposed. (Composition is a procedure by which MAS gives a person who is reasonably suspected of committing an offence the chance to avoid conviction in court by paying a sum of money to MAS. On payment of the sum of money, MAS will not take any further criminal proceedings against the offender and the offender is taken not to have convicted of the offence.) - For MEPS+, TRPD will communicate concerns to the operational and risk management functions responsible for MEPS+ and require them to address the concerns in a timely manner for any non-observance of the PFMI or oversight standards. - Depending on severity, senior management’s attention and advice would be sought. Reviews of MEPS+ self-assessment against the PFMI are tabled to the Management CIIC, to whom TRPD can raise concerns directly. Supervisory concerns are highlighted at the MFSC and escalated to MAS’ MD, where relevant. - The chairs of CIIC and MFSC are chaired by different Deputy MDs with separate reporting lines to the MAS’ MD. In the event of any significant MEPS+ incident, TRPD conducts an independent review of the root causes and recommends corrective actions to the operating departments to address the issues. Such reviews are presented to the MFSC and MAS MD. - CIIC role: assist the MAS MD in overseeing the operations of the CIIs operated by MAS, including MEPS+. The CIIC is chaired by the Deputy MD from the Corporate Development Group and comprises Assistant MDs and heads of departments from the Currency, Finance, Information Technology, and Monetary and Domestic Management departments. Representatives from the Banking Department, the Internal Audit Department, and the Risk Management Department attend the CIIC meetings as observers. ### Resources, staffing, and training - MAS is a self-financing statutory board. The main sources of funding are license fees and imputed income from services provided by MAS as an agency of Government, for example, the management of exchange rate and monetary policy, and the management of national reserves. - Each MAS department is allocated an amount of funds each year based on its operational needs and strategic goals as discussed and agreed upon by MAS senior management and approved by the MAS Board. Departments may request additional funds during the year if needed. - Funds allocated to TRPD are deployed towards supervisory, policy making, standard setting, regional and international engagement (such as CPMI and Executives’ Meeting of East Asia-Pacific Central Banks (EMEAP)), and staff training activities. - For manpower, MAS exercises independence in determining its manpower resourcing levels and remuneration policies. Section 17 of the MAS Act provides that MAS may appoint employees as it thinks fit, and determine all matters relating to their remuneration and terms and conditions of appointment and employment. - MAS’ budget for staff remuneration is increased annually considering any increase in headcount as well as wage increases needed to keep the organization’s wages competitive. MAS may also engage the services of consultants and advisers and set the terms and conditions of such engagement as it thinks fit. - As at July 2018, there were 5 staff in TRPD involved in the supervision of DPS. Specialist staff from technology risk and business continuity management teams also supports the supervision of payment systems, such as during inspections. - Training: - MAS staff receives on-going and relevant training at the MAS Academy (Academy) to raise their professional competence. The Academy organizes the MAS Diploma in Central Banking for entry-level officers. - The Academy systematically rolls out various functional and general development training courses to equip MAS officers at various levels. - Functional skills and expertise are deepened through focused developmental interventions guided by the MAS functional competency framework (Professional Requisites and Outcomes Framework). - MAS sends supervisory staff for attachments at large international banks, international bodies and other financial sector regulators and staff attend relevant courses conducted by international bodies and central banks, such as the European Central Bank, the South East Asian Central Banks Research and Training Center, and IMF Singapore Regional Training Institute. - MAS officers engage experts from the private sector through formal class-room training or informal discussions, including study visits to other jurisdictions. - MAS provides scholarships to officers to pursue postgraduate studies, up to PhD levels. - MAS undertakes annual talent reviews and regular assessment on the expertise levels of staff to facilitate early identification of gaps in expertise levels and take appropriate follow-up actions. - MAS is the sole authority in Singapore responsible for the regulation, supervision and oversight of all the payment systems in the country. Departments in MAS plan their activities and resources as required in the new financial year budget on an annual basis. *Source: 1sgpea2019002 - section 6 of the PS(O)A empowers MAS to collect payment* ### Section 22 of the MAS Act provides immunity to MAS officers ### Section 22 of the MAS Act provides immunity to MAS officers ### Responsibility B — Regulation, supervision and oversight of payment systems - Key facts and powers: - MAS is the sole authority in Singapore responsible for the regulation, supervision and oversight of all the payment systems in the country. - MAS’ regulatory powers over DPSs include the power to impose access regimes, impose restrictions and conditions, establish standards, make regulations, approve and remove chief executive officers and directors, approve the control of substantial shareholding in an operator, issue directions, inspect operations, and assume control of the operations of a DPS under emergency situations. - The PS(O)A mandates external audits of a DPS and imposes the obligation on a DPS to notify MAS of significant changes in its operations. - Section 6 of the PS(O)A empowers MAS to collect information from all payment systems in Singapore. - Section 22 of the MAS Act provides immunity to MAS officers discharging their responsibilities: "No action, suit or other legal proceedings shall lie against MAS officers for anything done or omitted to be done in good faith in the course of work." - Operational resourcing: - As at July 2018, there were 5 staff in TRPD involved in the supervision of DPS. - Specialist staff from technology risk and business continuity management teams also supports the supervision of payment systems, such as during inspections. - Assessment: - Assessment of Responsibility B: Broadly Observed - Recommendations and comments: - Given its broad mandate and responsibilities, MAS should increase resources for the payment systems oversight and supervision unit of the TRPD. - The unit is responsible for the oversight and supervision of MEPS+, DPSs (FAST, SGDCCS, USDCCS, IBG, NETS EFTPOS), CLS, credit bureaus, and SWIFT. - Increasing resources would support the detailed annual assessment of MEPS+ and other DPSs, which could evolve in systemic importance (particularly for FAST). ### Responsibility C — Disclosure of policies with respect to FMIs - Key Considerations and practices: - Authorities should clearly define and disclose their policies with respect to FMIs, including objectives, roles, and regulations. - MAS’ approach in its supervision of FMIs in Singapore is described in the publicly available Monograph, which highlights MAS’ supervisory objectives of ensuring the safety and efficiency of FMIs. - The Monograph provides an overview of the regulatory framework for FMIs as set out by the PS(O)A. - The standards against which MEPS+ is supervised are set out in the Standards document. - The Cybersecurity Code of Practice specifies the minimum protection policies that a CIIO shall implement to ensure the cybersecurity of its CII. Any DPS identified to be designated as a CII must comply with the Cybersecurity Code of Practice, in addition to MAS’ Technology Risk Management regulations and guidelines. CIIOs are required to report cyber incidents to MAS, after which MAS will report to the CSA. - Public disclosure: - MAS’ policies for FMIs, which include its supervisory objectives and the scope of its supervision, are published in the Monograph. - MAS’ policies and objectives are publicly disclosed on MAS’ website in the Monograph as well as in the CPMI Red Book (Singapore Chapter) and the EMEAP Red Book (Singapore Chapter). - Key conclusions and assessment: - MAS’ approach in its supervision of FMIs in Singapore is described in the publicly available Monograph on the Supervision of FMIs in Singapore. The Monograph highlights MAS’ supervisory objectives of ensuring the safety and efficiency of FMIs and provides an overview of the regulatory framework for FMIs as set out by the PS(O)A. The standards against which MEPS+ is supervised are set out in the Standards for MAS-Operated FMIs document. - Assessment of Responsibility C: Observed - Recommendations and comments: - Enhance the independent review of MEPS+ with an annual assessment report with ratings prepared by the TRPD, endorsed by the MFSC, and publicly disclosed. - Enhance the transparency of MAS FMI responsibilities, including MEPS+, by publishing an annual report on FMI and payments for Singapore, which could include analysis of associated risks for MEPS+. ### Responsibility D — Application of the Principles for Financial Market Infrastructures (PFMI) - Adoption and application: - MAS adopts the PFMI in its supervision of SIPS. Specifically, all SIPS in Singapore are required to comply with the PFMI. - MAS may impose higher or more specific requirements on FMIs, as appropriate, in the context of specific risks, or in the context of wider financial sector stability. - For MEPS+, all relevant principles are fully adopted by MAS and included in the Standards document. - Supervisory practices: - MAS makes public the application of the PFMI to all SIPS in Singapore in the Monograph. - TRPD actively engages operations during discussions and inspections on implementation of PFMI. - MAS conducts annual assessments to understand the risk profile of each operator of SWIPS, highlight areas of concern and remedial actions, and provide ratings for each assessment; the possibility of SWIPS becoming a SIPS is discussed during such annual assessments. - Internal arrangements for MEPS+: - MEPS+ is the only SIPS in Singapore and is required to adhere to the PFMI. - Formal internal arrangement ensures segregation of supervisory and operational functions, with distinct reporting lines to different management fora. - ITD in MAS is responsible for the operations of MEPS+ and reports to the CIIC. An independent risk management unit resides in the RiMD with direct access to the EXCO and RC. - MEPS+ is audited by the IAD; TRPD is responsible for supervision. - ITD and RiMD perform self-assessments against the PFMI biennially, which TRPD reviews. Inspections on MEPS+ are conducted with the same rigor as those on other key financial institutions; results are highlighted to the MFSC and escalated to MAS MD where relevant. - Key conclusions and assessment: - MAS adopts the PFMI in its supervision of SIPS. MEPS+ is the only SIPS in Singapore. All relevant principles for MEPS+ are fully adopted and included in the Standards document. MAS conducts annual assessments with ratings for SWIPS operators. - Assessment of Responsibility D: Observed - Recommendations and comments: - Revise the Monograph on Supervision of FMIs to describe the standards used for designated SWIPS and the associated risks which are assessed relative to the PFMI. - Assess on an annual basis the need to apply the PFMI to SWIPS, based on horizon-scanning and changes in their risk profiles (such as value limit increase, cross-border features). ### Responsibility E — Cooperation with other authorities - Cooperative oversight and arrangements: - The only SIPS subject to cooperative oversight in which MAS participates is the CLS. - CLS is regulated and supervised by the USFR as an Edge corporation; the USFR chairs the CLS OC, in which MAS participates alongside other central banks whose currencies are included in the CLS. - The USFR organizes and administers the CLS OC, which operates in accordance with the Protocol for Cooperative Oversight of CLS. The Protocol avoids duplication of oversight, fosters consistent communications between central banks and CLS Bank, and enhances transparency among participating central banks. - The USFR provides regular oversight updates to members of the CLS OC, including key CLS developments and supervisory assessments. MAS reviews, provides views, and raises questions on CLS oversight matters, such as operations and risk management practices. - Changes proposed by CLS that may materially impact the nature or level of risks presented require the "no objection" of all CLS OC members, including MAS. - The CLS OC has an established crisis communication protocol; the CLS OC chair may initiate a daily conference call if necessary during a crisis. - Cybersecurity cooperation: - The CSA is the national agency overseeing cybersecurity strategy and the Cybersecurity Act establishes a legal framework for oversight of essential services in Singapore. - MAS as a sector regulator works with the CSA to strengthen the cyber resilience of the CIIs in the banking and finance sector. - The Cybersecurity Act allows the Minister to appoint officers from the sector regulator as Assistant Commissioner to assist the Commissioner to oversee and enforce cybersecurity requirements on the CIIOs. - CSA manages incident reporting through MAS as CSA’s sector lead / regulator, in fulfilment of Cybersecurity Act by the CIIOs. - Cross-border coordination and responsibilities: - The USFR is the lead overseer for CLS and is responsible for organizing and administering the CLS OC and coordinating cooperation between participating central banks and USFR supervisors. - The USFR is responsible for ensuring that CLS is periodically assessed against the PFMI and shares assessments with other relevant authorities via the CLS OC. - Through the CLS OC, the USFR provides regular updates to MAS on changes to payment and settlement arrangements and liquidity risk management procedures of CLS that may affect SGD; MAS may provide views or raise questions and would consider views of the USFR and other members. - Under the Protocol, MAS is expected to consult other participating central banks as timely as possible before implementing policies or taking actions that could materially affect CLS. Example: MAS provided advance notification to the CLS OC of improvements to the contingency measures of MEPS+. - Discretion and legal powers: - No DPS has to date been assessed to be imprudently managed to the point that it would warrant discouraging its use or provision of services. - The CLS cooperative oversight arrangement does not prejudice the statutory or legal powers of the MAS nor constrain MAS’ powers to fulfil its statutory or legislative mandate. - Key conclusions and assessment: - The only SIPS subject to cooperative oversight in which MAS participates is the CLS. MAS contributes to cooperative oversight and works with CSA on cyber resilience and incident reporting. - Assessment of Responsibility E: Observed - Recommendations and comments: - (No additional recommendations or comments provided in the source text.) *Source: 1sgpea2019002 - Section 22 of the MAS Act provides immunity to MAS officers* ### 51. MAS welcomes the IMF’s assessment of Singapore’s systemically important payment ### MAS welcomes the IMF’s assessment of Singapore’s systemically important payment system and authorities’ responsibilities against the PFMI ### Governance (Principle 2) - MAS notes IMF’s observation that the CCSO is a member of the CIIC, and the CCSO role is concurrently held by the Executive Director of TRPD which is the overseer and supervisor of MEPS+. - At the time of appointment of CCSO in October 2017, Executive Director of TRPD was assessed to be the most qualified person for the CCSO role. - MAS position: - There is no material conflict of interest as CCSO advises CIIC on adequacy and appropriateness of MEPS+’s cyber security arrangements and is not responsible for MEPS+ operations. - MAS will review the need for greater clarity of the CCSO role to more fully achieve the separation of operational and oversight responsibilities over MEPS+. ### Comprehensive risk management framework (Principle 3) - MAS agrees with IMF’s observation on the potential adoption of DLT by FMIs in the near to medium term, and its potential risks to MEPS+. - MAS action: - MAS will review and analyze the potential implications of DLT on the safety of MEPS+ against the CPMI analytical framework for distributed ledger technology in payment, clearing and settlement before it makes the decision to either adopt DLT for MEPS+ or interface DLT-based systems with MEPS+. ### Operational Risk (Principle 17) - IMF observation summarized: MAS’ ongoing efforts to manage potential operational risks that could stem from cyber risks include expanding surveillance coverage, reinforcing protection capabilities, reducing time to recover, and developing cyber competencies; assessors noted areas for improvement in MAS’ information and cyber security training to staff, oversight of MEPS+ critical service providers and monitoring of MEPS+ participants’ end-point security. - MAS responses and planned measures: - Enterprise-level information security: - MAS agrees it is critical for all MAS staff to be cyber vigilant. - Staff are apprised of latest developments in information security risks through regular advisories. - All staff are required to complete a mandatory information security e-learning module and pass the accompanying assessment test. - The mandatory e-learning module will be continually updated to reflect the evolving information security threat and risk landscape. - Additional initiatives will be explored, including the conduct of more frequent phishing exercises. - Oversight of MEPS+ critical service providers: - MAS agrees to apply ratings in the annual self-attestations submitted by the MEPS+ critical service providers that support the continuation of critical services for MEPS+. - All external audits will be completed against acceptable national or international standards. - MEPS+ participants’ end-point security: - MAS agrees to monitor the compliance of MEPS+ participants with the mandatory controls of the SWIFT Customer Security Program and ensure that the participants’ self-attestations are audited. ### Disclosure of rules, key procedures and market data (Principle 23) - MAS notes IMF’s observation that MEPS+ has met the disclosure requirements in Principle 23 and that assessors compared disclosure extent to international best practices. - MAS action: - MAS will review IMF’s recommendation on the disclosure of additional information on material developments and quantitative indicators on system availability, average daily liquidity, and throughput time in the MEPS+ PFMI Disclosure that is published on the MAS website to further enhance transparency and foster public understanding and confidence in MEPS+. ### Regulatory, Supervisory, and Oversight Powers and Resources (Responsibility B) - MAS agrees that in light of the evolving payments landscape, it is timely to review the resource requirements for the supervision of payment systems. ### Disclosure of Policies with Respect to FMIs (Responsibility C) - Clarification: - Responsibility C does not require overseers of payment systems to publicly disclose the results of their independent assessment of the systems or publish a consolidated report on FMI. - MAS stance and actions: - MAS acknowledges that publication of the overseer’s assessment of MEPS+ will enhance accountability to the public given that MEPS+ is also operated by MAS. - MAS will discuss the frequency of disclosure, the forum to endorse the report and the form in which such information would be best presented. - MAS publicly discloses important developments on FMIs supervised by MAS on a regular basis through various means, such as press releases, speeches and public documents, and considers the current approach adequate for transparency of MAS’ responsibilities over FMIs. ### Application of the Principles for FMIs (Responsibility D) - MAS agrees with IMF’s recommendation to revise the Monograph on Supervision of FMIs to: - Describe the standards used for designated system-wide important payment systems and the associated risks which are assessed relative to the PFMI. - MAS will also annually assess the need to apply the PFMI to system-wide important payment systems. *Source: 1sgpea2019002 - MAS welcomes the IMF’s assessment of Singapore’s systemically important payment system* --- _Source: https://www.imf.org/-/media/files/publications/cr/2019/1sgpea2019002.pdf_