MAS finalises AI risk management rules for financial firms

Singapore's financial regulator has locked in its rulebook for how banks, insurers and other licensed firms should handle artificial intelligence. The finalised AI risk management guidelines follow a consultation the Monetary Authority of Singapore ran in November 2025, and they stretch across the whole AI lifecycle, vendors included.

MAS has staggered the rollout rather than switching everything on at once. Sections 3 and 4 of the guidance bite from 7 October 2027, with Sections 5 and 6 following exactly a year later, on 7 October 2028. That window gives institutions time to rework governance, testing and vendor oversight before the clock starts.

There is no one-size-fits-all template. Firms can calibrate their approach to how big and how risky each AI deployment is, and they will not be forced to stand up dedicated AI committees, since current board and governance arrangements can carry the load. What MAS does expect is a maintained inventory of AI use, plus controls spanning cybersecurity, data governance, model testing, human oversight, monitoring and change management.

The accountability line is deliberately firm: an institution owns the outcome of any AI inside a service it delivers, even when an outside party built, runs or supplies that system. Firms need sufficient assurance that a vendor's AI fits the purpose they have in mind, and where evidence falls short they must layer on compensating controls. If residual risk still sits outside their appetite, the options MAS names include restricting the service, suspending it or swapping it out. The regulator also flagged agentic AI, meaning systems that act autonomously and reach for tools, and said it will consult the sector in 2027 on extra guidance for it.

Why it matters for Singapore: MAS is staking out an early position on how finance should run AI, and the two-step timeline lets local banks, insurers and fintechs adapt without stalling deployment. Clearer expectations should feed the broader national push to commercialise the technology, while the promised look at agentic systems shows the regulator intends to keep pace as it shifts. Ho Hern Shin, the authority's deputy managing director, said that kind of certainty lets firms innovate with confidence, and also helps protect customer trust and the country's resilience.