ASIA-PACIFIC · SINGAPORE & AUSTRALIA
Singapore's MAS Technology Risk Management Guidelines and Australia's APRA CPS 230 both expect financial institutions to keep critical services running when a technology provider fails. Compare the two frameworks and see where custody and signed Proof of Recovery evidence fit.
Regional evidence map
Asia-Pacific
MAS TRM
Technology and vendor risk governance, secure software delivery and IT business continuity
APRA CPS 230
Critical operations within tolerance and the risks of material service-provider arrangements
One evidence set for both
Signed Proof of Recovery
FRAMEWORKS IN THIS REGION
Each framework page covers the issuing body, exact requirement, scope, timeline, consequences and how Castler's custody and recovery artefacts map to it.
SIDE BY SIDE
Regulator
Monetary Authority of Singapore (MAS)
Instrument
Technology Risk Management Guidelines
Status
In force as supervisory guidance
Applies to
Banks, merchant banks, insurers, capital-markets intermediaries, payment-service providers and other MAS-supervised institutions
Focus
Technology and vendor risk governance, secure software delivery and IT business continuity
Regulator
Australian Prudential Regulation Authority (APRA)
Instrument
Prudential Standard CPS 230 Operational Risk Management
Status
In force from 1 July 2025
Applies to
Authorised deposit-taking institutions, general, life and private health insurers, and RSE licensees
Focus
Critical operations within tolerance and the risks of material service-provider arrangements
Summaries support orientation. For exact operative wording, use the current official text and advice applicable to your supervisory perimeter.
WHAT THE FRAMEWORKS SHARE
The wording differs by regulator. The operational question is the same: can the critical service keep running if the vendor behind it fails?
MAS expects sound governance of technology and vendor risk. CPS 230 requires board oversight of operational resilience and material service providers.
Per-release seals give the board current, examinable evidence for each critical vendor.
MAS TRM covers IT business continuity and recovery capability. CPS 230 asks for credible plans to respond to the failure or exit of a provider.
Vendor software is rebuilt and deployed independently, so the exit plan is a tested procedure.
MAS expects recovery capability to be documented and tested. CPS 230 requires critical operations to stay within tolerance through disruption.
A signed Proof of Recovery records that the system was restored without the original vendor.
HOW CASTLER FITS
A stored deposit gives you a legal path to the materials. Independent verification shows the recovery path has been exercised. Castler separates the two so you can start with custody and add verification when the framework or your board asks for it.
FAQ
This hub covers Singapore's MAS Technology Risk Management Guidelines and Australia's APRA CPS 230. Each framework has its own evidence page with scope, status, consequences and a requirement-by-requirement mapping.
Yes. CPS 230 took effect on 1 July 2025 for APRA-regulated entities, including authorised deposit-taking institutions, insurers and RSE licensees.
The MAS TRM Guidelines set expectations for third-party technology controls and tested IT continuity rather than one specific mechanism. Software escrow provides custody of source code and build materials. Independent rebuild and a signed Proof of Recovery show that continuity can actually be executed.
Yes. The same custody, verification and Proof of Recovery artefacts are mapped to each framework's language, so a group operating in both markets keeps one evidence set per critical application.
KEEP EXPLORING
ASIA-PACIFIC
Bring your Asia-Pacific perimeter. We'll map the critical systems, current custody and Proof of Recovery evidence each framework expects.
Book a 15-min Demo