Complete MAS TRM · 357 Obligations

Every TRM Duty, Cited and Ready.

Everything in Foundation, plus ProfytAI Regulatory Intelligence and the Fulfillment layer. What each duty means, why it exists, and the requirements and checklists that satisfy it.

$15,000one-time
Download the Sample

One-Time Purchase · Single-Org License · Enterprise via Private Offer

GuidanceMAS TRM
MAS.TRM.2021.Sec13.1.1.p45.OBL1
VerbatimSHOULDrecommendation
The FI should establish a process to conduct regular vulnerability assessment (VA) on their IT systems to identify security vulnerabilities and ensure risk arising from these gaps are addressed in a timely manner.

MAS TRM Guidelines, Section 13.1.1, p. 45 (2021)

ActorFI
ActionEstablish a process to conduct regular vulnerability assessments
ObjectIT systems, to identify security vulnerabilities and address the risks in a timely manner
Tagscyber-securityvulnerability-assessment
Cyber Security Assessment · Vulnerability Assessment · p.45medium severitysupervisory sanction

Non-adherence may attract MAS supervisory action; the TRM Guidelines set out the standards MAS expects financial institutions to meet.

Source · Technology Risk Management Guidelines

One record, straight from the full dataset

Every TRM Theme

The Complete MAS TRM Guidelines, Ready to Cite.

All 15 Themes, One Register

From board oversight to IT audit, every TRM theme arrives in one consistent schema. Nothing falls between owners, nothing gets read twice.

357 Duties, Cited to the Page

Each obligation is quoted word for word and page-anchored, so a TRM exam finding traces back to the exact clause in a single step.

Stand It Up the Same Day

The months of reading the Guidelines and re-keying every duty are already done. Load the register and start assessing, not transcribing.

Evidence on Every Duty

MAS Approved

An annotated capture of the source page ships with every obligation, all 357 of them. When the examiner asks, you show them the page.

Product Details

What You License.

Coverage
357 obligations across all 15 TRM themes, from board oversight to IT audit.
Instrument
MAS Technology Risk Management Guidelines (2021).
Schema
46 documented columns, measured from the shipped file. Source anchors, byte-exact verbatim text, the reading window, deontic classification, ProfytAI regulatory intelligence, and checklist coverage. The same flat width as the Free Sample.
Structure
On every record, the parsed duty with actor, action, modal, and conditions, plus regulatory context, hierarchy, and page-anchored citations into the official MAS PDF.
Evidence Captures
357 annotated source-page captures, one per obligation, each showing the duty highlighted on the page the regulator printed it on. Reproduced with MAS's written permission.MAS Approved
ProfytAI Regulatory Intelligence
On every record, a plain-language summary, the obligation kind, why the duty exists, interpretation notes, its relationship to the parent clause, and reader watchouts.
Fulfillment
On every duty, the fulfillment requirements and an evidence checklist, so a register moves from the obligation to what satisfies it.
Formats
Excel workbook, JSON, and CSV, plus the evidence capture pack. Official source document linked, not redistributed.
Updates
Point-in-time and versioned. The licence is perpetual for the edition you purchase, with no updates. A new edition, when published, is a separate product sold separately.
License
Single-organization commercial licence, one-time purchase, delivered by instant download.

Who It Is For

Bank and fintech compliance teams, technology risk officers, internal audit, and the consultancies that advise them. It suits any institution that must evidence its posture against MAS technology risk expectations.

Why It Exists

Published regulation is authoritative but unstructured. Hundreds of duties sit buried in prose across a long PDF. Building a usable, cited register by hand is slow, fragile and hard to prove. This dataset does that work once, correctly, and ships it as structured data.

Expected Business Outcomes

From Duty to Task

Derived requirements and checklist items turn each duty into work a team can assign, and every item quotes the source that supports it.

Proof Built In

Every record quotes the regulator byte-exactly and cites the exact pages of the published PDF. A certification script in the folder re-proves the whole package.

Audit-Ready Provenance

Every duty is quoted verbatim and page-anchored, so a finding traces to the source in one step.

Lower Key-Person Risk

The regulator's expectations are captured as structured data, not held in one analyst's spreadsheet.

The whole of the TRM Guidelines as a defensible register, so you start from finished, cited obligations rather than a blank page.

In Every Format

Excel

Cover, Obligations, Requirements and Checklist on intelligence tiers, Data Dictionary, Methodology, Change Log

JSON

Versioned, checksummed envelope for pipelines and AI

CSV

Flat table for spreadsheets, BI, and SQL

Evidence Pack

MAS Approved

One annotated source-page capture per obligation, stamped with its ID and citation

Official regulator source document linked, not redistributed.

Licensed Under the ProfytAI Commercial Data License · View Licensing Terms

What It Solves.

A Blank-Page TRM Register

Standing up a Technology Risk Management register from the Guidelines is weeks of reading and re-keying. This is the finished, cited set.

Themes Reviewed in Isolation

All 15 themes, from board oversight to IT audit, arrive in one consistent schema so nothing falls between owners.

Findings You Cannot Trace

Every obligation is quoted verbatim and page-anchored, so a TRM exam finding traces to the exact clause in one step.

Interpretation Bottlenecks

Regulatory intelligence on every record explains what a duty requires and how teams implement it, without waiting on one analyst.

A Real Record

A TRM Record, in Full.

A real record pulled straight from this dataset. The regulator's exact words beside the parsed duty, the generated intelligence, and the evidence checklist, on every one of the 357.

Get 20 Records in the Free Sample

MAS.TRM.2021.Sec5.1.1.p15.OBL1

IT Project Management and Security-by-Design
SHOULDmedium priorityMAS TRMp.15
Source TextVerbatim · Guidance
A project management framework should be established to ensure consistency in project management practices, and delivery of outcomes that meets project objectives and requirements.
In Plain Language

A project management framework should be established that delivers consistent project management practice and outcomes meeting project objectives and requirements.

Parsed Duty
ActorFI
Actionestablish a project management framework
Objectproject management framework
Structured FieldsDeontic · recommendation

Deontic

recommendation

Type

Process

Strength

Recommended

Frequency

Ongoing

Status

In Force

Sanction

supervisory

IT & Technology RiskProject Management
Duties and Evidence Checklist3 Duties
1

Establish and approve a project management framework.

Done WhenAn approved project management framework document exists, carrying an approval record that names the approver and the date.

EvidenceProject management framework

2

Show projects are run consistently against the framework.

Done WhenFor a sample of projects, each project's practices can be mapped to the framework, and every deviation is recorded with a reason.

EvidenceProject records

3

Check delivered outcomes against the stated project objectives and requirements.

Done WhenFor each closed project there is a record comparing the outcomes delivered with the documented objectives and requirements, and stating whether each was met.

EvidenceProject closure record

ProfytAI Regulatory IntelligenceAnalysis · governance

Why This Exists

Projects run to individual habit produce uneven controls, and weaknesses introduced during delivery surface later as production risk. A common framework makes project behaviour predictable and reviewable across the firm.

Relationship

It is the opening sentence of paragraph 5.1.1 and the governing duty for section 5.1. The rest of the section builds on it, starting with the coverage requirement in the next sentence.

Interpretation

A guideline "should", so this is a supervisory expectation rather than a binding notice requirement. Two outcomes are stated and both shape what an adequate framework looks like. Consistency of practice, and delivery of outcomes that meet project objectives and requirements. The provision names no methodology, no external standard and no project size threshold, so the firm chooses the approach. The second sentence of the same paragraph sets the framework's minimum coverage, and the following paragraphs then add specific content requirements for individual project plans.

Watchouts

The framework is treated as the deliverable, so its existence is read as compliance. The stated purpose is consistency in practice and delivery of outcomes meeting objectives, both of which are properties of projects rather than of the document, so a framework nobody follows does not meet it.

Generated regulatory intelligence, traceable to the citation below. The verbatim source text remains the authority you cite.

MAS TRM, Section 5.1.1, p. 15 (2021)

Consequence. Non-adherence may attract MAS supervisory action; the TRM Guidelines set out the standards MAS expects financial institutions to meet.

Source · Technology Risk Management Guidelines

The record shows the key fields for readability. Every delivered record carries the complete schema: verbatim, normalized, parsed, context, ProfytAI regulatory intelligence, and fulfillment.

ProfytAI Regulatory Intelligence

The Rule, and What It Means.

Every TRM obligation ships with generated regulatory intelligence beside the regulator's exact words. Here is the configuration-management duty from IT Service Management.

One Record From This Dataset

SHOULDGuidanceMAS TRMMAS.TRM.2021.Sec7.2.1.p23.OBL1
Section 7.2.1Page 23

Verbatim

The FI should implement a configuration management process to maintain accurate information of its hardware and software to have visibility and effective control of its IT systems.

ProfytAI Regulatory Intelligence

The FI should implement a configuration management process that keeps accurate information about its hardware and software so it has visibility and effective control of its IT systems.

Requirement Type

process

Relationship

The second sentence of 7.2.1. The first sentence defines configuration management, and this sentence turns that definition into a duty on the FI.

Why This Exists

A firm cannot patch, refresh or restore what it cannot accurately describe. Wrong configuration data quietly undermines every downstream process that depends on knowing which version of what is running where.

Reader Watchouts

The examples in the definition are prefixed 'e.g.', so model, version and specifications illustrate rather than complete the field list. Scoping the repository to only those three attributes rarely delivers the visibility the sentence asks for.

Interpretation Note · The definition sits in the same paragraph. Configuration management means maintaining key information about the configuration of the hardware and software that makes up each IT system, with model, version and specifications given as examples. 'Accurate' is the quality standard, and the stated purpose, visibility and effective control, is how adequacy is judged. No tool, repository type or data model is named. It is a guideline 'should', a supervisory expectation rather than a binding notice requirement.

Why It Matters on Every Record

From Raw Regulation to Operational Knowledge.

Interpretation Already Done

A plain-language read of what the regulator is actually requiring, on every record.

Traceable to the Source

Each explanation stays anchored to the citation and the verbatim clause it came from.

Ready to Operationalize

Structured for registers, control libraries, policy drafting, and AI grounding from day one.

On Every Record

summary
The plain-language read of the duty
obligation_kind
Requirement, prohibition, or permission
relationship_to_parent
Where the clause sits among its siblings
why_this_obligation_exists
The regulator's purpose behind it
reader_watchouts
Where readers commonly over- or under-read it
interpretation_notes
Scope, force, and how to read it

The intelligence is generated from the structured obligation and preserves traceability back to the citation and the supporting evidence. It accelerates understanding, and the byte-exact verbatim text remains the authority you cite.

Compare

Start Small, or Take the Whole Perimeter.

Every tier is the same structured data, cited the same way. The only question is how much of the Singapore technology-risk perimeter you need today.

MAS TRM Foundation
$4,800
Obligations
357 (all TRM)
TRM Themes
All 15
Parsed Duty & Context
Evidence Captures
One per obligation
Regulatory Intelligence
Fulfillment (Requirements + Checklists)
Policy Statements
License
One-time
Formats
Excel · JSON · CSV
View MAS TRM Foundation
You Are HereCompliance Intelligence
$15,000
Obligations
357 (all TRM)
TRM Themes
All 15
Parsed Duty & Context
Evidence Captures
One per obligation
Regulatory Intelligence
Fulfillment (Requirements + Checklists)
Policy Statements
License
One-time
Formats
Excel · JSON · CSV
Policy Suite
$28,000
Obligations
357 (all TRM)
TRM Themes
All 15
Parsed Duty & Context
Evidence Captures
One per obligation
Regulatory Intelligence
Fulfillment (Requirements + Checklists)
Policy Statements
License
One-time
Formats
Excel · JSON · CSV
View Policy Suite

The Entire MAS TRM Guidelines, on Day One.

357 obligations across 15 themes, cited and structured. Buy the license, or prove the depth with the free sample first.

Start With the Free Sample
Sample→Consultation→Register→Platform→Subscription