Singapore Sets AI Risk Guidelines for Finance Sector

The Monetary Authority of Singapore (MAS) published the final version of its Artificial Intelligence Risk Management Guidelines on Wednesday (7), which will take effect on October 7, 2027, for all financial institutions under its supervision. The document covers all forms of AI technology, including generative models and agents, and allows for phased implementation until October 7, 2028.

The guidelines conclude a process initiated on November 13, 2025, when MAS published consultation document P017-2025, with a comment period ending on January 31, 2026. The final version was released alongside the authority's response to the contributions received. It represents supervisory expectations rather than legislation: the regulator mandates compliance during inspections, but the text does not impose specific penalties as outlined in the European AI Act.

What Banks Will Need

The first requirement is to know where AI is being utilized. According to MAS, institutions must establish processes to identify AI usage throughout the organization, maintain updated inventories, and assess the materiality of risks for each use based on three dimensions: impact, complexity, and degree of dependence. The controls, the regulator states, should be proportionate to this assessment.

The board and senior management are responsible for overseeing AI risk, which includes defining roles, risk appetite, and policies. However, MAS clarified that there is no obligation to create a dedicated AI committee solely to comply with the guidelines: existing governance structures are acceptable as long as they are adequate. According to MAS, participants in the consultation sought clarification precisely on this, in addition to questions about how to handle AI embedded in third-party products.

Regarding suppliers, the rule is that responsibility cannot be outsourced. The institution must obtain adequate assurances regarding purchased AI, assess whether it serves the intended purpose, and apply compensatory controls. If the risk does not fit within the defined appetite, the text allows for limiting, suspending, or replacing the service. The list of control areas includes data governance, testing, cybersecurity, human oversight, monitoring, and change management.

Agents to be Addressed Later

The final text does not include specific rules for autonomous agents. According to the website Blockhead, MAS indicated that guidelines dedicated to agentic AI are expected to come in 2027, and the currently published guidelines require periodic reviews as this type of system proliferates.

Three Jurisdictions' Perspectives

In Singapore, the guidelines apply to local banks like DBS, OCBC, and UOB, and also to the branches of global groups licensed by MAS, placing operations of HSBC, Citi, and JPMorgan in the city under the same inventory and materiality assessment. For a global bank, this means at least a map of AI usage that needs to align with the requirements of other jurisdictions in which it operates.

In the Eurozone, the timeline is stricter. The European Central Bank sent a letter on July 7, signed by Claudia Buch, Chair of the Supervisory Board, requesting the 110 banks it directly supervises to prepare action plans against AI-enhanced cyber threats by October 31, 2026. Under the AI Act, obligations for high-risk systems, including credit analysis, have been postponed to December 2, 2027, due to the streamlining revision approved this year, according to the European Commission. The outcome is that a bank operating in Frankfurt and Singapore will have two AI governance regimes coming into effect just two months apart.

The difference in design matters for service providers. The European model classifies the system by use category and imposes obligations based on that. Singapore's approach is based on the materiality assessment carried out by the institution itself and is, by design, less prescriptive. A consultancy that sells AI governance frameworks to global banks can no longer provide a single matrix: it needs an inventory that feeds both logics.

Where the Text Leaves Room

The main open point is the very criterion of materiality. The assessment of impact, complexity, and dependence rests with each institution, and two banks may classify the same credit model differently. From October 7, 2027, when the guidelines begin to be enforced, each bank's inventory will cease to be an internal document and will become the basis for conversation with the supervisor regarding where low-risk use ends.