IT partner governance in finance is the set of roles, rules and routines a bank or insurer uses to choose, oversee and, when needed, exit its technology partners. For banking and insurance technology leaders, it shapes how IT outsourcing and delivery partners for regulated financial institutions are assessed, from compliance controls and delivery oversight to the external capacity models used for cloud, data and AI work. In Singapore and Hong Kong it is also a regulatory expectation.
Why governance matters more now
In Singapore, MAS Notice 658 sets requirements for banks' outsourced services, especially material ongoing services and any service involving customer information. Banks must perform due diligence on providers and their subcontractors and keep an outsourcing register that is submitted to MAS.
In Hong Kong, the HKMA's SA-2 module covers outsourcing, and its OR-2 module asks banks to understand and manage reliance on third parties as part of operational resilience. The HKMA set 31 May 2026 as the date for banks to have their resilience frameworks in place.
The cost of weak oversight is high.
What insurers need to know
Insurers in Hong Kong follow the Insurance Authority's GL14 Guideline on Outsourcing, which covers material and overseas outsourcing arrangements. The IA has also issued GL20, a guideline on cybersecurity. Technology partners working with insurers should be ready to support both.
The four stages of IT partner governance
1. Selection
Decide how material the service is, then match the depth of due diligence to that. Cover regulatory fit, security, data handling, people vetting, subcontractors, continuity and exit. Record how the materiality decision was made.
2. Onboarding
Agree the contract terms regulators expect, including audit and access rights, incident notification, data location, and termination rights. Add the arrangement to your outsourcing register.
3. Ongoing oversight
Set a regular review rhythm, usually quarterly for material services. Track service levels, security incidents, staff changes and subcontractor changes. Repeat due diligence periodically and whenever the service changes significantly.
4. Exit
Keep a written exit plan from the start, covering how data, code, documentation and knowledge come back to you, and how long it would take to move the service elsewhere.
Assessing cloud, data and AI delivery partners in regulated environments
Cloud, data and AI work raises specific questions for regulated institutions. Where will data be stored and processed, and can that be proven? Who can access production data, and how is that access logged and removed? For AI, how are models documented and tested, and where does a person review the outputs? MAS has consulted on AI risk management guidelines that would apply to all financial institutions in Singapore, including inventories of AI use and risk assessments. A partner who can support these controls from the start saves a lot of rework later.
How a mid sized bank should evaluate IT outsourcing providers
Mid sized banks face the same rules as large ones with smaller risk and procurement teams. A proportionate approach helps. Classify each provider by materiality first, then apply a full review only where the service is material or involves customer information. Use one standard question set for every provider so answers can be compared. Ask for evidence rather than assurances: certifications with their scope, sample reports, and named contacts for incidents and audits.
Planning external IT capacity for transformation programmes
Regulated institutions often need outside help to deliver transformation without pausing compliance work. Plan the external capacity model as part of governance, not as an afterthought:
-
Staff augmentation adds specialists under your direction and keeps knowledge in house.
-
Dedicated teams suit long programmes where continuity matters.
-
Project delivery suits well defined builds with one accountable partner.
-
Managed services suit stable operations after go live.
For each model, decide in advance how it will be assessed, recorded in the outsourcing register and reviewed. Our article Capacity Planning for APAC Banking IT in 2026 covers how to size the gap.
How We+ Asia supports governance
We+ Asia places IT specialists and delivery teams with banks and other financial institutions in Singapore and Hong Kong, including through IT Expert On Demand for transformation programmes.
This article is general information, not legal or regulatory advice.
FAQ
+ What is IT partner governance?
The roles, rules and routines a bank or insurer uses to select, oversee and exit its technology partners.
+ How do banks and insurers in APAC evaluate partners for cloud, data and AI delivery?
They check data location, access control, AI model documentation and testing, human review of AI outputs, and the partner's ability to support regulatory requirements such as MAS Notice 658, HKMA SA-2 or the Insurance Authority's GL14.
+ How should a mid sized bank in APAC evaluate IT outsourcing providers?
Classify providers by materiality, apply full review where the service is material or involves customer information, use one standard question set, and ask for evidence rather than assurances.
+ How should regulated APAC institutions plan external IT capacity for transformation?
Choose the capacity model for each need, such as staff augmentation, dedicated teams, projects or managed services, and decide in advance how each will be assessed, recorded and reviewed.
+ Which regulations cover IT outsourcing for insurers in Hong Kong?
The Insurance Authority's GL14 Guideline on Outsourcing, alongside GL20 on cybersecurity.
Need a partner used to bank governance and onboarding? Talk to We+ Asia.
