Outsourcing and third-party risk
Read the PDF edition (2 pages)
Most DPT licensees outsource core parts of their compliance stack: identity verification, sanctions screening, transaction monitoring, blockchain analytics and travel-rule messaging are all typically provided by vendors. MAS's Guidelines on Outsourcing, first issued in 2016 and revised in 2018, apply to payment service providers. They require a register of outsourcing arrangements and due diligence on the service provider before engagement and periodically thereafter. Written agreements must give audit and access rights to the firm and to MAS. Business-continuity arrangements are required, as is notification to MAS for material outsourcing.1 The guidelines also address cloud services and offshore outsourcing, which matter for a group whose compliance systems may be hosted in Switzerland or elsewhere.
The responsibility for the outsourced function remains with the licensee. In inspection, MAS asks the firm to show that it understands how the vendor's screening or monitoring works and that it has tested the vendor's output. The firm must show that it has tuned the vendor's rules to its own risk assessment and that it would detect a vendor failure. A firm that cannot explain why its analytics vendor attributes an address to a sanctioned cluster, or how its monitoring rules were set, has outsourced its judgement as well as its processing. MAS does not permit that.
Choosing and governing a blockchain-analytics vendor
The vendor decision that most affects a DPT licensee's AML outcomes is the choice of blockchain-analytics provider. Chainalysis, Elliptic, TRM Labs and a few others dominate the market, and their attributions differ. The same address may be rated high-risk by one and unrated by another. Attribution depends on each vendor's proprietary clustering and intelligence. MAS has not endorsed any vendor and does not require any particular one. It does expect the firm to have assessed the vendor's coverage of the chains the firm supports and the vendor's attribution methodology and error rates. The latency of updates, the data-protection arrangements and the vendor's own sanctions compliance belong in the same assessment.2 Larger firms run two vendors in parallel and investigate discrepancies, which is good practice but costly. Smaller firms should at least document why they chose their vendor and test a sample of attributions against public sources. Their risk thresholds should be set with an understanding of the vendor's false-positive and false-negative behaviour.
Checklist
A blockchain-analytics arrangement that will withstand a MAS inspection should include the following. - A written assessment of the vendor's chain coverage against the firm's supported assets, updated when a new asset is listed. - Documented risk-scoring thresholds for direct and indirect exposure, by category (sanctions, darknet, mixer, scam, hack, gambling), with the business rationale for each. - Evidence of periodic testing of the vendor's attributions against a sample of known addresses. - A procedure for handling attributions the firm disputes, including escalation to the vendor and documentation of the outcome. - Integration evidence showing that every inbound and outbound transfer is screened before crediting or broadcast, with logs retained for five years. - A data-processing agreement that satisfies the PDPA transfer-limitation rules if the vendor processes data outside Singapore. - Confirmation that the vendor itself is not subject to sanctions and has not been named in enforcement actions.
Notes
- MAS, Guidelines on Outsourcing, 27 July 2016, revised 5 October 2018, applicable to all MAS-regulated financial institutions; MAS has consulted on and issued successor instruments for third-party risk management for certain sectors. ↩
- Guidelines to Notice PSN02, section on the use of technology and third-party tools in CDD and transaction monitoring; MAS Information Paper on DPT service providers' AML/CFT controls, observations on blockchain analytics governance. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.