Raymond Cheung
Chartered Actuary · CRO · Board Adviser · Singapore
MAS Notice 126 puts the enterprise risk management framework, the risk appetite and the annual ORSA squarely on the insurance board — not on the risk function by delegation. MAS Circular ID 01/26, issued in January 2026, made clear it is reading the submissions closely. A statutory CRO's guide to what directors are actually on the hook for.
The first ORSA report I signed as a statutory chief risk officer ran to about ninety pages. It went to the board with the pack, two working days before the meeting. At the meeting it got four minutes: the capital ratio was comfortably above requirement, the stress tests had "all passed", and the committee moved on. Nobody asked why the reserve stress looked so mild, or what the reverse stress test had actually found. The document met MAS Notice 126. The governance around it did not.
MAS Notice 126 — Enterprise Risk Management for Insurers — is the rule that requires every licensed Singapore insurer to run an enterprise risk management framework, set a risk appetite, and perform an Own Risk and Solvency Assessment at least once a year. The ORSA report goes to MAS. Most directors know the Notice exists and know their firm files something under it. Fewer are clear on what it asks of them personally, as distinct from what it asks of the risk function.
What the Notice actually puts on the board
Notice 126 is not neutral about where responsibility sits. The board — not the CRO, not a committee operating purely by delegation — owns the ERM framework and the risk appetite. The Notice expects the board to approve them, understand them well enough to challenge them, and satisfy itself that the framework is genuinely operating rather than merely documented. That is a higher bar than receiving an annual paper and noting it.
- Approve the ERM framework and the risk appetite statement, and review both at least annually — with enough understanding to push back, not just ratify.
- Ensure the risk appetite is expressed in terms that constrain real decisions — underwriting authority, investment limits, reinsurance retention — not as a page of qualitative sentiment.
- Deliberate the ORSA: its assumptions, its scenarios, and what it implies for strategy and capital planning — and have that deliberation visible in the minutes.
- Confirm the ORSA's time horizon matches the business plan's, so the solvency projection and the strategy are describing the same future.
- Own the management actions the ORSA relies on — including the credibility of the actions assumed in a reverse stress scenario.
The ORSA is the part boards under-use
The ORSA is meant to be the one document a year in which the firm asks itself, in its own words and for its own purposes, whether its risk management and its capital are adequate for the risks it is actually running and the strategy it is actually pursuing. Done well, it is the board's single best integrated view of the business. Done as a compliance return, it is ninety pages that confirm a capital ratio the board already knew.
“The ORSA is not a submission to MAS that the board happens to see. It is the board's assessment, which MAS happens to receive.”
The tell is in the minutes. When MAS and reviewers have examined board papers, they have repeatedly found deliberations that concentrate on the capital number, the pass or fail of the stress tests, and the fact of compliance — and skip the parts that carry the governance value: whether the scenarios are severe enough to be useful, whether the key assumptions still hold, how the results connect to next year's plan, and which emerging risks are not yet in the model at all.
What MAS flagged in January, and why it matters to directors
In January 2026, MAS issued Circular ID 01/26 to all licensed insurers, setting out lapses it had seen in recent ORSA submissions. It is worth directors reading directly, because the deficiencies are ones a board is well placed to catch without being actuaries.
- Missing stress tests. The four mandatory stresses — macroeconomic, material counterparty, liquidity and reserve — must all be performed. Some insurers had dropped one or more on immateriality grounds. MAS's position: run all four, and calibrate the depth to the size and complexity of the business rather than skipping the scenario.
- Group ORSA used as a substitute. Where a firm relies on a group ORSA, the stress tests still have to be tailored to the Singapore legal entity. A group-level result is not a Singapore result.
- Generic counterparty stress. For the material counterparty scenario, MAS expects named counterparties and an assessment of those specific exposures — not a blanket uplift to incurred claims.
- Reverse stress testing treated as optional. It is required even where the failure scenario is remote, because the point is to identify the plausible paths to failure and to test whether the management actions relied on are credible.
None of these is a modelling subtlety that only the actuarial team can assess. A director can ask "did we run all four stresses, tailored to the Singapore entity?" and "which specific counterparties did we stress?" and expect a clear answer. If the answer is vague, that is itself the finding.
What I tell boards to ask
- Is our risk appetite doing any work? Point to one decision in the last year that went differently because of a risk appetite limit. If you cannot, the statement is decoration.
- Did we deliberate this ORSA, or receive it? The minutes should show challenge on assumptions and scenarios, not just a note that the report was tabled.
- Are the ORSA horizon and the business plan horizon the same? If the plan runs three years and the solvency projection runs one, they are not talking to each other.
- What did the reverse stress test find, and do we believe the management actions? "Raise capital from the parent" is only a mitigant if someone has actually asked the parent.
- What is not in the model? Every ORSA has a boundary. The board should know where it sits and revisit it each year.
Notice 126 has been in force in its current shape since 2023, and the ORSA requirement is older than that. The bar is not moving. What MAS has made clear this year is that it is reading the submissions closely, and that it can tell the difference between an ORSA a board has engaged with and one it has waved through. For a Singapore insurance director, the Notice is not a compliance obligation that lives with the risk function. It is a description of work the board is expected to do — and, increasingly, to show that it did.
Common Questions
What does MAS Notice 126 require of an insurance company's board?
Notice 126 requires the board of a licensed Singapore insurer to approve and oversee the enterprise risk management framework and the risk appetite statement, review both at least annually, and actively deliberate the annual Own Risk and Solvency Assessment (ORSA) — including its assumptions, scenarios and implications for strategy and capital. These responsibilities sit with the board itself and are not discharged by delegation to the risk function alone.
What is the ORSA under MAS Notice 126?
The Own Risk and Solvency Assessment is an insurer's own assessment, performed at least annually, of whether its risk management and its current and projected solvency and liquidity are adequate for the risks it runs and the strategy it is pursuing, over a horizon consistent with its business plan. The ORSA report is submitted to MAS, but it is the board's and management's assessment first.
What are the four mandatory stress tests under MAS Notice 126?
MAS Circular ID 01/26 (January 2026) reiterated that an ORSA must include four mandatory stress tests: macroeconomic, material counterparty, liquidity and reserve. All four must be performed and tailored to the Singapore legal entity even where a group ORSA is used, with the depth calibrated to the nature, scale and complexity of the business rather than scenarios omitted on immateriality grounds.
Does a group ORSA satisfy MAS Notice 126 for a Singapore insurer?
Not on its own. Where an insurer relies on a group ORSA, MAS expects the mandatory stress tests and the solvency assessment to be tailored to the Singapore legal entity. A group-level result does not substitute for a Singapore-entity assessment.
About the author
Raymond Cheung is a Chartered Actuary, C-suite executive and board adviser with more than 20 years of experience across Asia in risk management, insurance, ESG and corporate governance. He is the CEO of CER Consultancy and an accredited trainer at SMU Academy and the Singapore College of Insurance.