In short: On 7 October 2026 the Monetary Authority of Singapore issued Guidelines on Artificial Intelligence Risk Management. They set out what MAS expects of every financial institution using AI: board oversight, an AI inventory, controls across the AI life cycle, and skilled staff. They take effect on 7 October 2027; Sections 5 and 6 follow by 7 October 2028.
Two uses of AI in one bank
A bank’s staff use an AI assistant to draft customer emails. The same bank uses an AI model to help decide who gets a loan. Both fall under the Guidelines, but controls scale with risk (paras 2.1, 5.2).
Generally qualifies for basic AI policies (explained below) if humans check outputs (para 2.4(a), note 13).
AI heavily relied on for credit decisioning needs a higher level of transparency and explainability (para 5.6) and greater attention to fairness (para 5.7). If rated high risk, it needs formal independent validation before deployment (para 5.19).
What are the Guidelines, and why did MAS issue them?
They are MAS’s supervisory expectations on managing AI risk at financial institutions, and they “seek to support” responsible adoption of AI (para 1.1). The release notes AI is being adopted “with increasing scale and sophistication”.
The Guidelines say risks from AI are often an extension of existing risk categories, which generative AI (including large language models, note 6) and AI agents can amplify (paras 1.9 to 1.11). They “complement existing legislation and guidelines issued by the MAS”, and the FEAT principles (Fairness, Ethics, Accountability and Transparency) “continue to apply” (para 1.2).
Who has to follow them, and what counts as AI?
All financial institutions, as defined in the Financial Services and Markets Act 2022, and all forms of AI. For locally incorporated firms the Guidelines apply on a group basis where the firm is under MAS consolidated supervision (note 4: these include locally incorporated banks and insurers) or owns critical information infrastructure (para 1.2). A global group’s framework may be used if it meets the Guidelines (para 1.5).
AI means “machine-based systems or models that derive outputs through learned premises such as the data or inputs it receives” (para 1.3). A use case is a specific real-world setting for a model or system (para 1.4).
Generally AI
- Machine learning, including logistic regression and gradient boosting
- Deep learning, language processing, computer vision
- Generative AI and AI agents
Generally not AI
- Calculators and rule-only tools
- Robotic process automation with fixed instructions
- Monte Carlo simulation not derived from training data
Note 6; response paper, paras 2.8, 2.9 (hybrid systems and pilots included).
What does each section expect?
AI Oversight
The board, or a delegated committee, approves the governance approach, covers AI in the risk appetite (the AI risk the firm is willing to accept, note 18) and understands AI enough to provide oversight and challenge. Senior management implements, sets roles, escalates AI incidents and reports to the board.
Paras 3.3 to 3.6
Key systems, policies and procedures
Designated control functions oversee three jobs: identifying AI use, keeping an AI inventory (a record of its AI use cases, systems and models, para 4.5), and rating each use case’s risk materiality on Impact (consequences of failure), Complexity and Reliance (paras 4.3 to 4.13).
Paras 4.1 to 4.13
AI Life Cycle Controls
Controls from inception to retirement, scaled to risk materiality. High-risk use cases should have contingency plans, formal independent validation before deployment and regular independent re-validation.
Paras 5.1 to 5.26
AI Capability and Capacity
Staff who develop, deploy and use AI should have the competence and conduct to do so, with training and resources. Technology infrastructure should be adequate for the AI in use.
Paras 6.1 to 6.3
- Data management
- Transparency and explainability
- Fairness
- Human oversight
- Third-party AI
- Selection
- Evaluation and testing
- Technology and cybersecurity
- Reproducibility and auditability
- Pre-deployment reviews
- Post-deployment monitoring
- Change management
- Retirement
When do the expectations start?
- 7 Oct 2026Guidelines issued
- 7 Oct 2027Guidelines take effect: Sections 3 and 4
- 7 Oct 2028Sections 5 and 6
The timeline follows para 1.8, where firms “may meet” the expectations in two stages. The media release says “should meet”. The response paper adds that high-risk use cases should get life cycle controls as soon as possible (para 13.5).
How much applies to a firm with limited AI use?
A firm whose AI is unlikely to have a material adverse impact on the firm, its customers or other stakeholders if it performs badly or becomes unavailable may apply basic AI governance policies (para 2.3). A firm not yet using AI is still expected to have basic policies on whether and how staff may use it (response paper, para 3.14).
- Clear accountability for AI oversight
- Permitted and prohibited uses, with human oversight
- An approved list of AI tools and a process to add new ones
- Staff education
- Regular compliance checks
- Periodic and trigger-based review of eligibility
Every other firm applies Sections 3 to 6 in proportion to its size, activities and risk profile (para 2.2).
What changed after the November 2025 consultation?
MAS consulted from 13 November 2025 to 31 January 2026. It “retained the key expectations” and refined them after feedback on governance structures, embedded AI and basic policies:
What do the Guidelines say about third-party AI?
The firm “retains primary accountability” for AI it takes from others, including AI inside vendors’ services (para 5.11; note 10). It should test that AI on its own use cases and document the result (para 5.10), and weigh:
- Transparency
- Supply chain
- Concentration risk
- Change management
- Contingency plans
- Legal agreements
- Staff capabilities
- Complexity
If residual risk cannot be brought within appetite, the firm should consider limiting, suspending or replacing the service (para 5.11).
What about generative AI and AI agents?
Both are covered (para 1.5). AI agents “may be granted greater autonomy and access to tools” (para 1.11). For agents, the inventory may record the tools they can reach and their guardrails (note 25). Where relevant, monitoring should also cover reasoning processes, actions taken and tools used (para 5.23(a)). In 2027 MAS intends to consult on what additional guidance on agentic AI would be useful (media release).
Key facts
| Authority | Monetary Authority of Singapore (MAS) |
|---|---|
| Instrument | Guidelines on Artificial Intelligence Risk Management (for financial institutions) |
| Issue date | 7 October 2026 |
| Effective date | 7 October 2027. Sections 3 to 4 from that date; Sections 5 and 6 by 7 October 2028 |
| Applies to | All financial institutions and all forms of AI; group basis for certain locally incorporated firms |
| Status | Final guidelines Issued; not yet in effect |
| Official source | MAS guidelines page |
| Last verified | 20 October 2026 |
Frequently asked questions
Does a firm that only uses AI to draft emails need the full framework?
Not necessarily. A firm may apply basic AI governance policies if poor performance or unavailability of its AI tools is unlikely to have a material adverse impact on the firm, its customers or other stakeholders (para 2.3). Drafting customer emails is one of MAS’s own examples, provided people check the outputs first (para 2.4 and note 13). The basic policies have six minimum elements (para 2.5).
Is a dedicated AI committee required?
No. The media release says existing governance structures may be used where they provide adequate oversight and cross-functional coordination, and firms need not set up a dedicated AI committee solely to meet this expectation. Paragraph 3.3 still expects consistent, coordinated management of AI risk across all relevant functions.
Does it cover AI that comes inside a vendor’s software?
Yes. Where AI is incorporated within, or used in delivering, third-party services, the identification process should minimally cover it for material third-party service providers (para 4.2). The firm remains accountable for third-party AI (para 5.11). The response paper gives an example of AI features inside software-as-a-service used for key business decisions (para 2.10).
Do firms have to report AI incidents to MAS?
The response paper says MAS does not intend to introduce AI-specific incident reporting requirements at this juncture. Firms should keep complying with existing incident reporting requirements to MAS, such as those on technology risk management or business continuity management, whatever the root cause (para 10.69).
Legal basis
Financial institutions: section 2, Financial Services and Markets Act 2022. Critical information infrastructure: Cybersecurity Act 2018.
Sources (official, verified 20 October 2026)
- MAS, Guidelines page https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions
- MAS, Guidelines (PDF) https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf
- MAS, media release, 7 October 2026 https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions
- MAS, Consultation P017-2025 https://www.mas.gov.sg/publications/consultations/2025/consultation-paper-on-guidelines-on-artificial-intelligence-risk-management
- MAS, Response to Feedback Received (PDF) https://www.mas.gov.sg/-/media/mas-media-library/publications/consultations/bd/2025/response-to-feedback-received-on-guidelines-on-artificial-intelligence-risk-management.pdf
- Singapore
- MAS
- AI risk management
- Banking Regulations
Book a demo to see how each regulatory change becomes an executable action list, with immediate, safer compliance as well.
Agentic AI Built Exclusively for BFSI
Neurasix delivers rule-aligned agentic workflows – from regulatory intelligence to audit-ready outputs