Singapore's financial institutions now have a firm rulebook for artificial intelligence, and a two-year runway to meet it. On 7 October 2026, the Monetary Authority of Singapore (MAS) finalised its Guidelines on Artificial Intelligence Risk Management, closing a process that began with a public consultation in November 2025.
It covers every financial institution MAS regulates and every kind of AI, from traditional machine-learning models to generative AI and AI agents. What has changed is the detail: MAS has answered the industry's main questions on governance structures, embedded AI, and what counts as "enough" for firms whose AI use is low-risk.
A principles-based rulebook, scaled to risk
The Guidelines do not prescribe a single model of compliance. Each institution is expected to determine how to meet MAS's expectations based on how much AI it uses, what it uses it for, and the potential damage a failure could cause. MAS calls this risk materiality, and it runs through the whole document.
That proportionality was the feature consultation respondents backed most strongly, according to MAS. It also produces the most practical concession in the final version. For low-stakes tools, where a breakdown would cause no material harm to the firm, its customers or the wider market, MAS accepts a lighter set of basic policies and procedures. Heavier controls are reserved for higher-risk uses.
What MAS expects firms to do
MAS groups its expectations into four themes.
Oversight and accountability. Boards and senior management are responsible for overseeing AI risk, including setting roles, risk appetite and the frameworks that govern AI use. In response to industry feedback, MAS has made it clear that existing committees can do this job if they provide adequate oversight and coordination across functions. Firms do not need to create a dedicated AI committee simply to tick this box.
Life cycle risk management. Institutions must know where they use AI, maintain an inventory of those uses at a sensible level of detail, rate each use case for risk materiality, and apply appropriate controls from development through retirement. The controls MAS lists include data governance, testing, human oversight, cybersecurity, monitoring and change management. Firms are told to revisit them as their AI use grows and the technology moves on.
Third-party AI. Outsourcing the model does not outsource the accountability. Vendor-supplied AI stays the institution's responsibility. Firms need enough assurance from providers to decide whether a tool is fit for purpose, and should plug any gaps with their own controls. If the remaining risk is still more than the firm is willing to accept, MAS expects it to scale back or pause the service, or switch provider.
Proportionate application. The extent and sophistication of controls should align with each firm's actual risk exposure, which allows smaller or lighter AI users to run a simpler framework.
Agentic AI: covered now, more guidance in 2027
The Guidelines explicitly bring AI agents and multi-agent systems within scope, consistent with MAS's earlier position that agentic AI would be handled under these Guidelines, which set supervisory expectations rather than binding rules, while MAS keeps its approach under review. MAS points firms to Singapore's IMDA Model AI Governance Framework for Agentic AI for further reference.
The Monetary Authority of Singapore (MAS) also signalled that the current regulatory position remains an interim baseline. The authority intends to launch an industry public consultation in 2027 to establish targeted supervisory guidance for agentic AI, addressing the operational risks posed by autonomous systems capable of executing unassisted actions and orchestrating external API tools across financial services.
The Guidelines detail why generative AI amplifies these regulatory stakes. MAS categorises several acute threat vectors: adversarial attacks, such as prompt injection; intellectual property and legal liabilities; systemic concentration risk stemming from overreliance on a handful of foundational model providers; operational outages; and behavioural vulnerabilities, including automation bias and the unchecked adoption of shadow AI across enterprise workflows.
"With greater regulatory clarity on financial institutions' AI usage, FIs can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore's financial system."
Ho Hern Shin, Deputy Managing Director, MAS
The timeline:
The Guidelines take effect on 7 October 2027, and MAS is allowing a phased start:
- From 7 October 2027: Sections 3 and 4, covering AI oversight and the core AI risk management systems, policies and procedures.
- By 7 October 2028: Sections 5 and 6, covering AI life cycle controls and AI capability and capacity.
The sequencing puts governance first. Firms are expected to have accountability, inventories and risk assessments in place before the more detailed control and capability expectations apply.
Part of a wider international push
Singapore is not moving alone. MAS noted that since its own consultation, the Financial Stability Board has also consulted on sound practices for responsible AI adoption by financial institutions. European supervisors have separately called on firms to contain ICT risks from frontier AI models, and Hong Kong's banking regulator has encouraged wider AI use to fight financial crime.
What compliance teams should do now
For banks, insurers, payment firms, fund managers and other MAS-regulated institutions, the immediate priority is visibility.
From there, compliance and risk teams should:
- map which existing committee will own AI oversight, and document why it is adequate;
- agree a risk materiality method so each use case is classified consistently;
- review third-party AI contracts for the assurance, audit and exit rights the Guidelines now expect;
- plan the 2028 life cycle controls early, since testing, monitoring and human oversight take time to build.
Accountability is the theme that runs through the Guidelines, and it is the hardest to retrofit. As we have explored before, the question of who owns an AI system's output becomes harder as those systems act more independently. MAS has now made clear that, in Singapore, the answer is the regulated firm.
The full Guidelines and MAS's response to consultation feedback are available on the MAS website.
