What MAS’s AI Risk Guidelines Mean for Singapore Banks and Their Technology Providers

A bank can now encounter artificial intelligence in places its risk committee may never have thought to look: a customer-facing assistant, a fraud-monitoring workflow or a feature added to an existing software suite. When an AI system can call tools or initiate actions, the question is no longer just whether its answer is accurate. It is also who approved its access, how its decisions are checked and what happens when it fails.

The Monetary Authority of Singapore (MAS) addressed those questions in its finalised Guidelines on Artificial Intelligence Risk Management, issued on 7 October 2026. The guidelines cover traditional predictive models as well as generative and agentic AI. They require financial institutions to make AI use visible to management, assess its risk and apply controls across its lifecycle. For Singapore banks, the practical change is from broad principles for responsible AI to specific supervisory expectations that can be examined through governance records, inventories and evidence of testing.

This is not a new statute with a schedule of AI-specific fines. The guidelines set supervisory expectations, and MAS retains broader supervisory powers. That distinction matters, but it does not make the deadlines optional for banks preparing for regulatory scrutiny.

From ethical principles to operational expectations

Singapore’s approach has developed in stages. In 2018, MAS published its principles for fairness, ethics, accountability and transparency, known as FEAT, in the use of AI and data analytics. The Veritas Consortium subsequently worked on assessment methods, metrics and an open-source toolkit intended to help institutions put those principles into practice.

The emergence of generative AI widened the problem. Phase 1 of MAS’s Project MindForge concluded in November 2023 with an industry whitepaper examining risks that included governance, transparency, cyber security and data leakage. MAS then consulted on formal AI risk management guidelines in November 2025. In March 2026, Phase 2 of MindForge produced an AI Risk Management Toolkit and Operationalisation Handbook, developed with a consortium of 24 financial institutions across banking, insurance and capital markets, alongside technology participants.

That history helps explain the final guidelines’ emphasis on implementation. Principles can tell a bank to be accountable; an operational framework asks it to show which systems it uses, how it judges their risk and who can intervene when something goes wrong. The guidelines also reflect a financial-sector response to forms of AI that are harder to govern through conventional model review alone. A generative system may produce variable outputs; an agentic system may be able to use tools and act on those outputs.

Domestic banks DBS, OCBC and UOB, as well as international banks including Citi, HSBC and Standard Chartered, participated in the MindForge consortium. Its toolkit and handbook give the sector practical material to draw on. They do not replace each institution’s responsibility to implement the MAS guidelines within its own operations.

Two deadlines, with governance coming first

MAS has split implementation into two stages. Sections 3 and 4—covering AI oversight, risk management systems, identification and materiality assessment—take effect on 7 October 2027. Sections 5 and 6—covering AI lifecycle controls and the capabilities and capacity needed to operate them—must be implemented by 7 October 2028.

The sequencing is consequential. A bank cannot consistently validate and monitor higher-risk AI if it has not first established who oversees AI, what systems are in use and which uses warrant the closest attention. By the first deadline, board-approved risk appetite statements, governance arrangements and a baseline inventory are among the materials MAS supervisors are expected to review during regular inspections.

Section 3 places responsibility with the board and senior management. They must establish and approve the institution’s AI risk appetite and governance framework. MAS does not require every bank to create a standalone AI committee. Instead, AI oversight can be embedded in existing senior management risk committees and the three-lines-of-defence model, which separates business ownership of risks from risk and compliance oversight and independent assurance.

The guidelines apply on a group basis to financial institutions within their stated scope, extending beyond retail and corporate banks to other regulated institutions. For an international bank operating in Singapore, that raises an implementation question: a global AI framework may provide common policies, but it still needs to meet MAS’s requirements for the institution’s activities. For a smaller institution, the proportionate approach leaves room for simpler oversight where AI use is limited or lower risk. Proportionate does not mean invisible: the institution still needs to know what it uses and why its controls fit the risk.

The inventory is more than a list of models

Section 4 requires an active, comprehensive inventory of AI systems, including systems developed internally, supplied by third parties or embedded in other products. This is potentially harder than cataloguing a bank’s purpose-built models. An AI function introduced through a cloud software suite or used without formal approval may not appear in an existing model register.

Banks are therefore examining vendor contracts and software deployments for embedded functions and shadow AI usage across business lines. The work connects procurement, technology, business teams and risk management: each may hold only part of the information needed to identify a use case and determine what it does.

Every identified use case must then be assessed for inherent risk materiality across three dimensions. Impact concerns the consequences of failure, including effects on customers and safety. Complexity considers opacity and the system’s degree of autonomy. Reliance examines how much human intervention remains in the process.

Consider the distinction between a tool that drafts a credit memorandum for a banker to check and a system that can advance an underwriting decision with little human intervention. Both require identification and assessment. But the potential consequence of an error, the role of human review and the system’s ability to act all affect how closely it should be controlled. The guidelines do not prescribe a universal numerical cutoff for a high-materiality use case. Banks must define and justify their own criteria, leaving scope for differences in classification across institutions.

The inventory should accordingly be treated as a working risk-management tool, not a one-time compliance spreadsheet. New deployments and newly activated software features can change what the bank uses; a change in a system’s autonomy or human oversight can change how its risk should be assessed. That is particularly relevant as banks move beyond isolated conversational tools toward workflows in customer service, fraud monitoring and underwriting.

What stronger controls mean in practice

Section 5 focuses on controls throughout an AI system’s lifecycle. For high-materiality deployments, the guidelines call for pre-deployment validation by independent qualified parties, sound training-data governance, bias testing, adversarial cyber testing and continuing monitoring for drift. Drift is a change in a model’s behaviour or performance over time; a successful test before launch cannot establish that the system will remain reliable indefinitely.

These requirements address different failure paths. Data governance asks whether the material used to build or adapt a system is suitable. Bias testing examines whether outcomes create unfair effects. Adversarial testing probes how a system behaves when deliberately challenged. Independent validation creates a check outside the team responsible for building or deploying it. Monitoring looks for problems that appear after release.

For high-risk uses, business-continuity and contingency arrangements must include a way for people to override the system or fall back to another process. A human fallback has to be operationally meaningful: if a customer-facing tool approaches a binding transaction or a credit decision, the bank needs a clear route to human review rather than assuming that a general ability to escalate will be enough.

Section 6 addresses the people and infrastructure behind those controls. Banks need adequate expertise among developers and risk personnel, and staff across the lines of defence must understand AI limitations and failure modes. This may be a constraint on implementation. Independent validation and ongoing monitoring of complex models require specialised skills, while an institution may be trying to apply those skills across many uses at once. MAS’s framework calls for capacity to match the task; it does not make the talent problem disappear.

Vendor models do not transfer accountability

One of the guidelines’ clearest messages concerns third-party AI: a bank cannot outsource its regulatory responsibility along with the technology. If a vendor model produces an error or harm in the bank’s operations, the bank remains accountable. That includes AI embedded in a broader software product, not just a model purchased as a standalone service.

MAS expects institutions to seek verifiable, independent assessments rather than rely solely on vendor self-attestation. Where residual risk cannot be brought within the bank’s approved risk appetite, the institution is expected to restrict, suspend or replace the vendor. Those expectations give procurement and risk teams a reason to press for evidence of model assurance and suitable safeguards.

They also create a practical bottleneck. Proprietary vendors may be unwilling to provide detailed validation material or independent assurance on the terms a bank wants. A large bank may have more negotiating room than a mid-sized institution, but the research does not establish how much leverage any particular buyer will have. Banks may need to weigh additional controls against restrictions on a product’s use, or reconsider whether it can be used at all.

Technology firms including Microsoft and Google Cloud participated in Project MindForge. Their involvement illustrates the role of external providers in banks’ AI systems, but consortium participation is not a substitute for assurance on a particular deployment. The institution using a system still has to understand the resulting risk and retain evidence for its own oversight.

Agentic AI and the next supervisory questions

Agentic AI makes the framework especially relevant beyond chatbots. A system with tool-calling capability may retrieve information, update a database or take another step toward a goal. If those actions are connected, one faulty instruction or output can affect later actions before a person reviews them. Prompt-injection attempts and cascading automated errors are among the operational risks banks must consider when such systems gain access to data or execution privileges.

The existing guidelines provide a way to assess those uses through impact, complexity and reliance, and to require stronger controls where materiality is high. They do not settle every agent-specific question. MAS has stated an intention to hold a dedicated financial-sector consultation on agentic AI in 2027 to develop more specialised supervisory guidance. Its outcome remains to be seen.

The value of the new timetable is its clarity about what banks must be able to demonstrate first: accountable oversight, a defensible view of every AI use case and a reasoned assessment of risk. The following year brings the fuller burden of validation, monitoring, contingency planning and staffing. Whether a bank uses an internally built model or a vendor’s embedded feature, the central test is the same: it must be able to explain how the system is governed and show that its controls match what the system can do.