On 7 October 2026, the Monetary Authority of Singapore (MAS) — the country’s central bank and integrated financial regulator — published a new rulebook aimed at governing how financial institutions build, buy and deploy artificial intelligence. The Guidelines on Artificial Intelligence Risk Management for Financial Institutions will become binding a year from now, leaving regulated firms a twelve-month runway to overhaul their internal controls, oversight structures and vendor due-diligence processes.
Scope and obligations
MAS makes clear from the outset that the framework is technology-agnostic: it covers everything from large language models and predictive analytics engines to simpler rules-based automation tools, and it applies irrespective of whether the AI was built in-house, licensed from a technology supplier or bundled inside a third-party platform that the institution may not even realise qualifies as AI.
The net is cast wide. Banks of every stripe — full, merchant and wholesale — fall within scope, as do fund managers, insurers, payment institutions, credit rating agencies, trade repositories and REIT managers, to name the principal categories. Rather than prescribing a one-size-fits-all rulebook, MAS expects each institution to right-size its controls to match the footprint of its AI deployment. A lender running machine-learning models for credit scoring will naturally attract heavier scrutiny than one using a chatbot to deflect routine customer queries.
The substantive obligations centre on five pillars.
- Management oversight — company management must own the AI risk agenda rather than relegating it to a technical silo.
- Pre-deployment risk assessment — firms must evaluate every AI system for bias, accuracy and robustness before it goes live.
- Ongoing performance monitoring — once deployed, models need continuous tracking to catch degradation or behavioural drift.
- Data lineage and quality — institutions must know what information fed the training process and whether it was fit for purpose.
- Vendor accountability — where AI capabilities are procured externally, the buying institution cannot outsource responsibility: it must understand the model’s inherent constraints, the composition of its training corpus and how frequently the vendor pushes updates.
Regulatory outlook
Singapore has moved ahead of most of its regional counterparts in issuing a standalone, cross-sector AI risk framework. The new guidance does not exist in isolation: it builds on the voluntary FEAT principles that MAS put forward in 2019 for the use of AI and data analytics in financial products. FEAT — fairness, ethics, accountability and transparency — was designed to encourage firms to use data-driven decision-making in a manner that produces outcomes fair to customers, is grounded in ethical considerations, allows clear attribution of responsibility for AI-driven decisions, and enables internal and external parties to understand how models arrive at their outputs.
Crucially, the new guidelines elevate those principles from aspirational guidance to enforceable supervisory expectations across a much broader church of regulated activities. Compliance teams would be ill-advised to treat the one-year grace period as downtime. MAS has indicated it will run industry dialogue sessions and targeted supervisory engagements during the lead-up, giving firms a window to test their approaches against regulator expectations before the clock starts. The most urgent practical step is to audit every AI touchpoint across the organisation — including capabilities embedded inside vendor solutions that may never have been labelled as AI — and benchmark each against the governance, assessment and monitoring standards that the framework now demands.
Disclaimer: This article is for informational purposes only and does not constitute legal or compliance advice.
Leave a Reply