Singapore has set out how it expects financial firms to manage the risks of AI. The Monetary Authority of Singapore has finalised its Guidelines on AI Risk Management, following a public consultation in November 2025, according to Fintech News Singapore. The guidelines cover how institutions should identify, control and oversee AI across its lifecycle, including AI supplied by third parties, and they come into force in two phases, in October 2027 and October 2028.
The timing reflects how quickly AI is spreading through finance. In the same week, UOB signed an agreement with AWS to explore AI-driven banking across ASEAN and launched workforce programmes for an AI-enabled workplace, Backbase rolled out conversational banking that lets customers complete tasks by voice or text through AI agents, and Airwallex upgraded business accounts so AI agents can move money within set rules. MAS's guidelines are the framework those projects will need to fit into.
What the guidelines require
The guidelines set expectations for managing AI risks across the AI lifecycle, from development and procurement to deployment, monitoring and change. Institutions must maintain an inventory of their AI use, which means knowing where AI is used, for what purpose and with what level of risk.
Firms must apply controls covering data governance, cybersecurity, testing, human oversight, monitoring and change management. Those categories mirror the ways AI can fail: poor or biased data, security weaknesses, untested behaviour, a lack of human checks on important decisions, drift over time and uncontrolled changes.
The approach is proportionate. Institutions can tailor their response to the scale and risk profile of their AI use, and they can use existing governance structures rather than creating dedicated AI committees. A small fintech using AI for internal document search faces lighter expectations than a bank using AI in credit decisions.
- Inventory: maintain a record of where and how AI is used.
- Controls: data governance, cybersecurity, testing, human oversight, monitoring and change management.
- Accountability: institutions remain responsible for AI built, run or supplied by third parties.
- Proportionality: approach scaled to the size and risk of AI use; existing governance can be used.
Human oversight is likely to attract the most attention in practice. MAS expects institutions to decide where people must review or approve AI outputs, particularly when decisions affect customers, such as credit approvals, claims or fraud flags. The right level of oversight depends on the impact of the decision, and firms will need to document why they chose it.
Accountability for third-party AI
The most consequential requirement may be about vendors. Institutions remain accountable for AI used in their services, including systems built, run or supplied by third parties. Most financial firms do not build their own large AI models. They buy services from technology providers, which makes third-party risk central.
Under the guidelines, firms must obtain sufficient assurance from third-party providers and assess whether the AI is suitable for its intended use. Where assurance gaps or practical constraints exist, they should apply compensating controls. Where risks fall outside their risk appetite, they should consider limiting, suspending or replacing the third-party AI service.
That puts pressure on vendors. Technology providers selling to Singapore's financial institutions will face more questions about how their models are trained, tested, monitored and updated. Providers that can supply clear documentation and assurance will have an advantage.
Buying AI from a vendor does not outsource the responsibility. MAS has made that explicit.
Contracts will need to change. Institutions will want rights to information about model changes, incident notification, testing results and the ability to audit or exit. Many existing technology contracts were not written with AI in mind, and procurement teams will spend the next year renegotiating terms to meet MAS's expectations.
The timeline: 2027 and 2028
The guidelines take effect in phases. Sections 3 and 4 apply from 7 October 2027, and sections 5 and 6 from 7 October 2028. The phased approach gives institutions time to build inventories, adjust governance and work with vendors before the full set of expectations applies.
A year can pass quickly in a large institution. Building an accurate AI inventory alone can be a substantial project, because AI is often embedded in products and processes without being labelled as such. Firms that start now will be better prepared than those that wait for the deadlines.
MAS also signalled what comes next. It noted the growing use of autonomous AI systems that can access tools, often described as agentic AI, and said it plans to consult the financial sector in 2027 on what additional guidance would help. Firms deploying AI agents should expect more specific expectations in the future.
What MAS said
Ho Hern Shin, deputy managing director at MAS, said realising AI's benefits sustainably requires financial institutions to understand and manage the risks. She said greater regulatory clarity should help firms innovate with confidence while maintaining customer trust and the resilience of Singapore's financial system.
That framing matters. MAS presents the guidelines as enabling rather than restrictive, consistent with Singapore's long-standing approach of supporting innovation within clear rules. The regulator has previously tested cross-bank AI models to detect scams faster and worked with industry on AI governance principles.
For firms, the message is that AI adoption is welcome, but it must be managed with the same discipline as other material risks. Clear governance can become a competitive advantage when customers, partners and regulators ask how AI is used.
What it means for banks, insurers and fintechs
For large banks such as DBS, OCBC and UOB, the guidelines formalise practices many have already started. The work will focus on completeness of inventories, consistency of controls across business lines and robust oversight of vendors. Banks that already treat AI as part of model risk management will adapt more easily.
For insurers, AI in underwriting, claims and customer service falls squarely within scope. Automated claims decisions, pricing models and fraud detection all require testing, monitoring and human oversight proportionate to their impact on customers.
For fintechs, including payment firms and digital banks, the guidelines raise the bar for how AI features are built and documented. Startups that embed AI in customer journeys, from credit scoring to chat-based support, will need governance that satisfies MAS supervisors and the banks they partner with.
Customer communication is part of the picture. When AI is used in decisions that affect customers, firms will need to explain outcomes and handle complaints in a way that does not hide behind the technology. Clear explanations build trust and reduce disputes, while opaque automated decisions invite regulatory scrutiny.
Lessons for the rest of Southeast Asia
Singapore's guidelines will influence the region. Regulators in Malaysia, Thailand, Indonesia and the Philippines are developing their own approaches to AI in finance, and many look to MAS as a reference point. Regional banks operating across several markets may adopt Singapore's standards group-wide for consistency.
For technology vendors serving the region, MAS's third-party expectations effectively set a benchmark. Providers that meet them in Singapore can offer the same assurance elsewhere, simplifying sales to banks across ASEAN.
The broader lesson is that AI governance is becoming part of the licence to operate in finance. Firms that build it into their AI programmes now will avoid costly retrofits later. We have covered other MAS initiatives, including its cybersecurity cooperation with the Bank of Thailand, which show how regional regulators are aligning on technology risk.
What are MAS's Guidelines on AI Risk Management?
They are final guidelines from the Monetary Authority of Singapore setting expectations for how financial institutions identify, control and oversee AI risks across the AI lifecycle, including AI from third parties.
When do the MAS AI guidelines take effect?
Sections 3 and 4 take effect on 7 October 2027, and sections 5 and 6 on 7 October 2028.
Do firms need a dedicated AI committee?
No. MAS says institutions can use existing governance structures and tailor their approach to the scale and risk of their AI use.
Are firms responsible for AI from vendors?
Yes. Institutions remain accountable for AI used in their services, including systems built, run or supplied by third parties, and must obtain sufficient assurance from providers.
What is an AI inventory?
It is a record of where and how an institution uses AI, for what purpose and at what level of risk. MAS requires institutions to maintain one.
Will MAS regulate agentic AI?
MAS plans to consult the financial sector in 2027 on what additional guidance on agentic AI, meaning autonomous systems that can use tools, would be helpful.
Do the MAS guidelines apply to insurers and fintechs?
The guidelines are addressed to financial institutions regulated by MAS, which covers banks, insurers, payment firms and other licensed entities, with expectations scaled to the risk of their AI use.
MAS's final AI guidelines give Singapore's financial sector a clear framework at the moment AI agents, conversational banking and AI-driven operations are spreading quickly. The rules are proportionate but demanding, especially on inventories and vendor accountability, and the phased deadlines leave little time to waste. For banks, insurers and fintechs across Southeast Asia, Singapore has just defined what responsible AI in finance looks like.
Talk to the SpinDepth deskYou've finished this story
Read on, send it to someone, or ask about it.
