Technology-neutral powers under the FSMA
Beyond Part 9, the FSMA gives MAS powers that affect every digital asset firm it regulates. Part 3 allows MAS to impose technology risk management requirements on any financial institution and to set penalties of up to S$ 1 million for breaches. It is the basis on which the technology risk Notices under the various Acts have been harmonised.1 Part 4 provides for prohibition orders against individuals across the financial sector, so that a person banned for misconduct at a DPT licensee can be prevented from taking a role at a bank or a fund manager.2 Part 7 provides for the sharing of information with foreign regulators, which underpins the cooperation between MAS and FINMA described in Part H, Chapter VI.
The harmonisation matters because digital asset groups frequently hold more than one licence. A group with an MPI for DPT services and a CMS licence for tokenised securities previously answered to two sets of technology requirements with different wording. Under the FSMA the requirements converge, so that a single technology risk framework can satisfy both. The same applies to the fit and proper criteria, which the FSMA Guidelines FSG-G01 state once for all licensees.
Notes
- FSMA 2022, Part 3 (technology risk management), ss 19 ff., commenced 31 July 2024, including the maximum financial penalty for breaches of technology risk requirements. ↩
- FSMA 2022, Part 4 (prohibition orders), ss 27 ff., commenced 28 April 2023. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.