MAS to financial firms: third-party AI is still your problem

Singapore's financial regulator has closed off one of the sector's favourite escape routes. Fresh guidance from the Monetary Authority of Singapore makes clear that a bank or insurer remains answerable for any artificial intelligence woven into the services it sells — even when an outside party builds it, runs it, or hands it over ready-made.

MAS writes the rules for the city-state's financial sector, and it has spent years prodding the industry to take up AI without letting risk controls slip. The guidance extends that same thinking down the supply chain, to the vendors whose models increasingly sit behind everyday products that customers never see.

Accountability is one of several expectations set out in the package, but it is the one with real teeth for procurement and risk teams. A supplier's assurances no longer stand in for a firm's own oversight of how a system actually behaves once it is live.

In practice, that pushes contracts, due diligence and continuous monitoring closer to the centre of the job. When a system misfires, it is the institution standing in front of the customer that answers for the outcome — not the company that wrote the code.

The weight falls on compliance and technology staff who must now understand, test and document tools they had no hand in building. Firms that outsource the model can no longer outsource the blame, and that raises the cost of getting vendor selection and oversight wrong.

Why it matters for Singapore: The city-state has staked its claim as a place where finance and AI mix, and local institutions buy a great deal of their technology from overseas. This guidance keeps the accountability onshore, which is the whole point: a vendor's address does nothing to change who the regulator comes knocking to when something breaks.