Monetary Authority of Singapore Technology Risk Management Guidelines CHN.4.6: Notice on Cyber Hygiene 4.6: multi-factor authentication for critical-system admins and internet access to customer information

The FI must implement multi-factor authentication for all administrative accounts on any operating system, database, application, security appliance or network device that is a critical system, and for all accounts on any system it uses to access customer information through the internet. The FAQ confirms MFA is expected for critical-system administrative accounts even when access is limited to the internal network.