Proposal to Require Government Agencies to Procure Commercial Cyber Insurance

18 Mr Yip Hon Weng asked the Prime Minister and Minister for Finance (a) whether public sector agencies and statutory boards are required to procure commercial cyber insurance; (b) whether MAS tracks industry cyber insurance claims and payout trends; and (c) how the Government ensures dispute resolution avenues like the Financial Industry Disputes Resolution Centre (FIDReC) have the capability to handle cyber insurance claim disputes.

The Minister of State for Foreign Affairs and National Development (Mr Alvin Tan) (for the Prime Minister and Minister for Finance): Sir, while public sector agencies, including Statutory Boards, are not required to procure commercial cyber insurance, we adopt a multi-pronged approach to managing cyber risks. This includes investments in prevention, detection, response and recovery capabilities.

Cyber insurance has grown in acceptance as a risk management tool by companies in Singapore and the region. The Monetary Authority of Singapore (MAS) follows developments in cyber insurance through our engagements with the industry. This helps MAS support the sound development of the market.

The Financial Industry Disputes Resolution Centre's (FIDReC's) adjudicators have the skills and expertise to handle dispute resolution for consumers and small businesses in the financial sector. This includes undergoing regular training to keep abreast of emerging issues and developments in the industry. FIDReC has experience in handling cyber insurance disputes in recent years.

Mr Speaker: Mr Yip.

Mr Yip Hon Weng (Yio Chu Kang): I thank the Minister of State for his reply. As cyber insurance becomes more important to businesses, will MAS consider publishing suitably aggregated indicators on claims frequencies, claim settlement times, common grounds for dispute and payout ratios? How would such transparency help for smaller firms judge whether such policies offer meaningful protection, while preserving commercially sensitive information?

My second supplementary question is on FIDReC. FIDReC can now hear eligible disputes involving small businesses, but cyber insurance claims can turn on technical evidence, incident timelines and policy exclusions. So, what is being done to ensure that its processors have sufficient cyber insurance expertise and can resolve suitable cases promptly?

Mr Alvin Tan: Sir, on the Member's first question, MAS' supervisory focus is on the overall soundness of insurers' cyber insurance portfolio and cyber insurance currently remains a relatively small component of the overall insurance market in Singapore. Therefore, cyber insurance is reported within a broader business line. So, it is not any different from other growing specialised business lines.

However, MAS does collect the breakdown of gross written premiums for cyber insurance separately – and the amount in 2024 is about $106.3 million and in 2025 is about $103.9 million. That is gross written premiums for cyber liability.

But beyond these statutory returns, MAS supplements its data collection through regular supervisory engagements with insurers. And that includes information on claims experience. This gives MAS visibility into market trends and developments, particularly related to cyber insurance.

On his second point on FIDReC, I had mentioned in my reply that FIDReC has experience handling cyber insurance disputes in recent years. FIDReC provides training for its adjudicators on cybersecurity and cyber insurance issues.

I will just share with the Member also that over the last five years, FIDReC has handled two claims brought by individual consumers involving cyber insurance policies. And having considered the facts and merits of the case, one claim was dismissed at adjudication, while the other was concluded at mediation without settlement.

So, FIDReC has the experience to do so, and they are continually training the adjudicators to manage such risks and such cases.