Singapore’s MAS Finalizes AI Risk Rules for Banks
3 min readThe Monetary Authority of Singapore has finalized its Guidelines on Artificial Intelligence Risk Management, the first binding set of supervisory expectations for how the city-state’s banks, insurers and other financial institutions must govern AI. Published on October 7, the MAS AI risk guidelines take effect on October 7, 2027 and apply to every licensed firm and every form of AI, from fraud models to chatbots.
Background
MAS opened a consultation on the draft rules in November 2025 and closed it at the end of January. Respondents supported the principles-based, risk-proportionate approach but asked for clarity on three points: whether existing governance structures were enough, how to treat AI embedded inside other software, and when basic policies would suffice. The regulator kept its core expectations and adjusted the detail, according to Blockhead.
What the MAS AI risk guidelines require
Boards and senior management must oversee AI risk with defined roles, a stated risk appetite and a governance framework, though MAS says a dedicated AI committee is not required. Firms must keep an inventory of every AI use, assess the materiality of each use case and apply controls across the whole life cycle: data governance, testing, human oversight, cybersecurity, monitoring and change management.
The provision with the widest reach covers third-party AI. Institutions remain accountable for AI used in their services even when a vendor builds, runs or supplies it. They must obtain sufficient assurance from providers, and vendor self-attestation generally will not count. If a third-party AI service cannot be brought within the firm’s risk appetite, MAS expects the firm to limit, suspend or replace it. Since most banks build on models from a handful of large AI developers, that puts the vetting burden squarely on the banks.
Implementation is phased. Sections 3 and 4 apply from October 2027, and Sections 5 and 6 from October 2028. Firms whose AI use is unlikely to have a material impact can comply with basic policies and procedures.
Agentic AI is next
MAS flagged autonomous agents as the open question. It told firms to review their controls as they adopt agentic systems that can act on their own and call external tools, and said it will consult the industry in 2027 on what further guidance is needed. “With greater regulatory clarity on financial institutions’ AI usage, FIs can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore’s financial system,” said Ho Hern Shin, MAS deputy managing director.
Why it matters
Singapore is one of Asia’s largest financial hubs, and MAS rules tend to travel: regional regulators and global banks with Singapore operations often adopt them as a baseline. The third-party clause in particular means model providers such as OpenAI, Anthropic and Google will face more detailed due diligence from financial customers, and the 2027 agentic consultation will be closely watched by firms building AI-driven trading and payments products.
Banks in Singapore now have a year to build their AI inventories. The harder work, deciding which vendor models they can actually vouch for, starts now.