SCOPE OF ASSIGNMENT

As required under the MEPS+ Operations and Contingency Manual for Participants and Non-Participants, the Bank is required to obtain an independent review of:

• 1
  The Bank's self-assessment of its compliance with the MEPS+ Security Guidelines and MEPS+ Contingency Requirements, as prescribed under Annex 21 of the MEPS+ Operations and Contingency Manual for Participants and Non-Participants; and
• 2
  The Bank's annual self-attestation under the SWIFT Customer Security Framework (CSP).

INDEPENDENT REVIEW OF MEPS+ COMPLIANCE

The appointed firm would be required to:

• A
  Evaluate if bank's policies and procedures are adequate and conduct testing to verify the effectiveness of the checks and controls against the MEPS+ security guidelines;
• B
  Provide its opinion on the adequacy and effectiveness of Bank's control environment and rectification measures in the report. The report should also set out the gaps and deficiencies noted, including follow up action and timeline to remediate the gaps and deficiencies.
• C
  Provide an independent opinion in the written report expressed in either a "positive" or "negative" form of expression as appropriate in accordance with the applicable requirement of the Singapore Standards on Assurance Engagements ("SSAE") 3000, where applicable.

INDEPENDENT ASSESSMENT ON SWIFT CSP

The appointed firm would be required to:

• 1
  Examine the Bank's policies, procedures and documentation related to SWIFT CSP compliance.
• 2
  Review incident response plans, risk assessments and security-related documents.
• 3
  Conduct interviews with key personnel who are involved in SWIFT operations and security.
• 4
  Review the processes, controls and security measures in place including logs, reports and other relevant data.
• 5
  Review the penetration testing and vulnerability scanning to identify weaknesses or vulnerabilities in the SWIFT environment.
• 6
  Evaluate the bank's compliance with both mandatory and advisory SWIFT CSP controls, including user authentication, incident response and risk management.
• 7
  Test the Bank's incident response plan to assess its effectiveness in responding to security incidents related to SWIFT transactions.
• 8
  Evaluate the Bank's risk management practices, including risk identification, assessment and mitigation as they pertain to SWIFT CSP.
• 9
  Prepare a detailed independent assessment report that outlines the findings of the assessment. This report should include:
• Identified areas of compliance and non-compliance with SWIFT CSP controls.
• Recommendations for remediation and improving security.

QUOTATION SUBMISSION REQUIREMENTS

Interested firms are requested to submit a detailed quotation for undertaking the above assignments by 9 October 2026, together with the following information:

• 1
  Details on Background of the firm, partner etc.
• 2
  Qualification and Experience of the Auditors assigned for performing the above task.
• 3
  Number of man days estimated/required to complete the task.