What are the five MAS IAC outcomes?
The five outcomes can be summarised as follows. MAS Guidelines, introduction, paragraph 3.
| Outcome | What it means in practice |
|---|---|
| 1 | Clearly identify the senior managers responsible for the firm’s core functions. |
| 2 | Ensure senior managers are fit and proper and accountable for their employees and the business under their responsibility. |
| 3 | Support senior managers through clear governance, management structures and reporting relationships. |
| 4 | Ensure Material Risk Personnel are fit and proper, with effective risk oversight, suitable incentives and conduct standards. |
| 5 | Maintain a framework that promotes and sustains proper conduct across all employees. |
The aim is an arrangement that works for the business. The practical examples below are my approach to applying that proportionality, rather than a universal checklist of documents every small FI must create.
Who counts as a senior manager in a small financial institution?
For a smaller fund manager, the senior managers will usually be the people who genuinely control core functions and make material top-down decisions. This commonly includes the CEO and executive directors involved in day-to-day management. A Head of Department does not automatically qualify because of the title. A non-executive director is not a senior manager merely through board membership. MAS Guidelines, definitions and paragraphs 1.2 to 1.6.
A useful practical question is whether a person’s absence or one seriously poor decision could cause significant financial, regulatory, legal, operational or reputational damage. That flags a role for closer review; the actual senior-manager assessment still turns on principal responsibility for day-to-day management, oversight and decision-making authority.
In a small LFMC, responsibilities may be divided across investment and frontline business, compliance and risk management, and operations. Ancillary responsibilities such as technology risk, outsourcing, business continuity and administration may sit with the same COO.
What if one senior manager holds several roles?
A CEO may also be an executive director and Chief Investment Officer. A COO may oversee operations, outsourcing, business continuity and technology risk. The firm does not need to pretend these are six different people.
The important separation is between frontline business and independent compliance or risk oversight. The person taking commercial risk should not also be responsible for independently challenging that same decision. Other combinations need attention to conflicts and whether the person can perform all the duties effectively. MAS FAQs, section II, A6, and section IV, A3.
For a small firm, an organisation chart, role descriptions, written delegations and acknowledgements can make responsibilities clear. Keep evidence showing which senior manager approved or reviewed important decisions. An elaborate responsibility-mapping system adds little if simpler records accurately explain how the company operates.
Who should be treated as Material Risk Personnel?
Material Risk Personnel, or MRPs, have authority to make decisions or carry out activities that could materially threaten the FI’s safety and soundness, or harm a significant segment of its customers or other stakeholders. The assessment can cover front, middle and back office roles. MAS Guidelines, definitions and paragraph 4.1.
Look at actual authority and potential harm, including financial, regulatory, legal and reputational consequences. A Head of Investment or senior portfolio manager can create material risk through investment decisions. A compliance officer may warrant MRP treatment where the role has significant authority over regulatory controls, high-risk onboarding or the response to serious breaches.
Technology is context-dependent. Someone controlling a significant client-facing platform, customer-money systems or critical bespoke infrastructure may hold a material-risk role. Someone administering staff laptops and Microsoft 365 is not automatically an MRP merely because the job involves IT. Access rights, dependencies and the possible consequences still matter.
The assessment should follow the actual risk. Being difficult to replace is a useful warning about continuity, but is not by itself the MAS test for MRP status.
What does proportional IAC governance look like?
MAS does not prescribe particular management committees. Succession arrangements can also reflect the firm’s circumstances. MAS FAQs, section III, A6 and A11 to A12.
Consider a five-person fund manager where the CEO is also CIO and majority shareholder. A large disciplinary committee or a list of three internal CEO successors may be unrealistic when the firm has only one junior investment analyst. It still needs a workable way to address conduct and leadership continuity.
| Large FI approach | Possible smaller-FI approach |
|---|---|
| Formal senior-management responsibility framework | Clear organisation chart, role descriptions and written responsibilities. |
| Dedicated conduct or disciplinary committee | Board or unconflicted directors review serious incidents, with another escalation route where needed. |
| Large succession pipeline | Board records leadership-continuity arrangements and considers external recruitment. |
| Complex performance scorecards | Simple annual assessment combining business results and conduct measures. |
| Dedicated IAC system | Compliance manual, personnel files, training and annual review records. |
| Multiple governance committees | Documented management or board discussions covering the relevant risks. |
A CEO’s review might consider investment results, complaints, breaches and action on control findings. No reported complaints should not automatically mean good conduct. The point is to make a reasoned assessment that the firm can explain.
Proportionality also does not mean dismantling useful controls when headcount falls. The FAQs encourage retaining existing arrangements that remain appropriate. MAS FAQs, section I, A4.
How should senior management show that it is actually accountable?
Having the CEO’s name on an organisation chart is not enough. There should be evidence that management makes, reviews or challenges decisions within its responsibility. The updated delegation FAQ reinforces the distinction between delegating work and retaining accountability. MAS FAQs, section III, A13, updated 30 September 2026.
For example, where the CEO retains responsibility for AML/CFT, the compliance team can handle onboarding procedures, screening results, periodic reviews, monitoring and reporting. The CEO need not personally check every screening result. Management should remain involved in significant matters under the applicable sector requirements and the firm’s approval arrangements, such as material AML/CFT policy changes, escalated high-risk customer cases, approval of the enterprise-wide risk assessment and decisions to outsource important compliance or screening work.
Emails, acknowledgements, approvals, signed documents, management reports and minutes can provide the audit trail. Putting important decisions down in black and white is often more useful than building an elaborate system that nobody uses.
What should a practical IAC framework contain?
Much of the starting framework may already exist in compliance and personnel records. A practical baseline could include:
- an organisation chart and clear ownership of core functions;
- identification of relevant MRPs and the reasons for the assessment;
- fit-and-proper assessments, recurring screening and annual reminders;
- an IAC or conduct section in the compliance manual;
- incident reporting, escalation, investigation and disciplinary procedures;
- staff conduct training and annual performance reviews; and
- records of significant decisions, conduct issues and follow-up actions.
An auditor or MAS reviewer should be able to understand who owns what, how issues reach the right person, and what happens when someone breaches the firm’s standards. A separate 80-page manual is rarely the best starting point.
What does conduct management actually look like?
Establish the standards expected of employees, explain them through policies and training, provide a way to raise concerns and respond when misconduct occurs. These are practical ways to give effect to Outcome 5. MAS Guidelines, paragraphs 5.1 to 5.4.
Suppose an employee trades a security on the firm’s restricted list. Having a personal account dealing policy is only the beginning. Management should consider how quickly the breach was detected and escalated, whether it was assessed properly, what disciplinary action followed, and whether it should affect performance assessment or remuneration, especially for a senior employee or MRP.
Severity matters. A minor procedural lapse may warrant additional training; deliberate or repeated misconduct may require a much stronger response. Record the reasoning, remediation and any applicable regulatory reporting assessment. Do not ignore an incident because dealing with it is uncomfortable.
Small firms have a particular problem when misconduct involves the boss
In a large FI, employees may have access to independent HR, whistleblowing or disciplinary functions. In a small company, the CEO and executive directors may also be the owners and paymasters. A junior compliance officer can find it difficult to challenge the person who controls their employment, particularly without a head office or independent committee.
There is no perfect structural solution for every five-person company. Recognise the conflict and establish a credible route beyond the person implicated. Depending on the structure, this could involve another unconflicted director, the board, an appropriate non-executive director or an external reporting channel. Simply directing every complaint back to the accused CEO does not solve the problem. Staff should understand the route and the protections against retaliation. MAS FAQs, section V, A6.
Do smaller financial institutions need MAS IAC software?
Usually, no. Firms searching for a “MAS IAC solution” or an “individual accountability and conduct solution” may assume that compliance requires specialised software. For most firms below 50 employees, I would struggle to justify dedicated MAS IAC software purely for this purpose.
A larger organisation may benefit from a system that tracks responsibilities, performance, conduct metrics, remuneration and misconduct across many divisions and personnel changes. At 50, 100 or 200 employees, it may already have an HR platform that can support much of this workflow without buying a separate IAC product. Those numbers are practical illustrations, not software thresholds prescribed by MAS.
For a 10-person LFMC, a maintained compliance framework, proper personnel records and a sensible annual review process may be adequate. Design the workflow first, then decide whether software adds useful control or saves enough work to justify its cost.
What does IAC look like for an eight-person LFMC?
Consider an illustrative fund manager with a CEO who is also CIO, one executive director, a compliance officer, an operations manager and four junior investment and operations staff. Core functions might be divided between investment, compliance and operations.
The CEO and executive director actively involved in management would be senior managers. Assess whether the compliance and operations roles also carry principal day-to-day responsibility for core functions. The CEO/CIO, compliance officer and operations manager deserve consideration as possible MRPs based on their actual authority and potential impact. The categories can overlap.
Losing the operations manager tomorrow might immediately affect clients if juniors cannot take over. That exposes continuity risk and prompts a closer look at the role’s authority. A junior analyst’s short absence may be inconvenient without the same institutional impact, although junior status alone does not rule out MRP treatment.
The firm may not need a disciplinary committee, remuneration committee, HR department or IAC platform. It could maintain an organisation chart, conduct policy, fit-and-proper records, annual training and performance assessments, documented approvals and a workable incident-escalation process. That is proportionality in practice.
The biggest IAC mistakes smaller firms make
The first mistake is treating fewer than 50 employees as permission to ignore IAC. The opposite mistake is copying a large bank’s framework and creating committees and reporting structures that make no sense for a small team.
Another common problem is implementing the documents once and forgetting the recurring work. Fit-and-proper checks lapse, performance reviews go undocumented because business was quiet, and responsibility records stop matching the organisation chart. Put the annual review cycle in the calendar and revisit it when roles or risks change. MAS FAQs, section III, A1 to A2, and section IV, A1.
These gaps become more consequential when a senior manager faces a misconduct allegation, a client complains or an auditor asks what prevented or detected the problem. The quality of the framework then stops being theoretical.
What is the simplest way for a smaller FI to approach IAC?
Start with the people who actually control the firm. Identify core functions, decide who owns them and assess whose decisions or activities create material risk. Maintain basic conduct rules, fit-and-proper records, training, performance reviews and a way to handle incidents.
You do not need to build a bank inside a ten-person company. You should be able to show who is accountable, what standards apply and what management does when those standards are breached.
Need help implementing a proportionate IAC framework?
Advisors Assemble can help smaller Singapore financial institutions review responsibilities, identify relevant MRPs, update conduct policies and organise fit-and-proper and annual review records. We can also consider which existing controls already support the IAC outcomes. Contact us to discuss a practical IAC workflow that your firm can operate without unnecessary systems or committees.
This guide provides general regulatory information and does not constitute advice on a particular financial institution. Appropriate arrangements depend on regulatory status, activities, size, management structure and risk profile. Reviewed on 29 October 2026.