Singapore sets phased AI risk expectations for financial firms

The Monetary Authority of Singapore on 7 October 2026 issued Guidelines on Artificial Intelligence Risk Management. The release calls them supervisory expectations that firms may scale to their risk. The PDF says they complement existing legislation. Its directions are written as what a firm “should” do.

Paragraph 1.8 of the PDF states the dates. The guidelines take effect on 7 October 2027. Firms may meet the expectations in sections 3 to 4 from 7 October 2027, and sections 5 and 6 by 7 October 2028. Sections 3 and 4 cover board and senior-management oversight, and the systems for identifying AI, keeping an inventory, and rating risk. Sections 5 and 6 cover life-cycle controls and the skills and technology to support them.

The response paper, from a consultation that ran from 13 November 2025 to 31 January 2026, calls those phases 12 months and 24 months. It says high-risk life-cycle controls should be applied as soon as possible, not left to the end of the 24 months.

Who the guidelines cover

The PDF applies them to all financial institutions, in proportion to size and risk. The guidelines page lists the licenses, including banks, insurers, payment firms and fund managers. For some locally incorporated firms under consolidated supervision, and for owners of critical information infrastructure, they apply on a group basis.

AI here means a system whose outputs come from what it learned. The PDF includes generative AI, large language models, and AI agents, including multi-agent systems. A tool that only follows fixed rules is outside that definition. Paragraph 1.5 covers deployment of AI, “including Generative AI and newer developments such as AI agents.”

Inventory, materiality, and review before deployment

An AI inventory is the firm’s list of AI use cases, systems or models, kept accurate through the life cycle, with enough detail to manage the risk. That includes life-cycle status, the risk-materiality rating, and who is responsible. Risk materiality is how serious the firm judges a use case to be, before controls and after them. Residual risk has to sit inside the firm’s appetite before deployment.

Paragraph 5.18 says that before deployment the use case, including its systems or models, should be reviewed by people not involved in building it, to check that controls such as evaluation and testing were followed. How wide that review is, and how independent the reviewers are, should match the risk rating. Paragraph 5.19 says a high-risk use case should have formal independent validation before deployment, by competent people independent of the development and deployment teams. Paragraph 5.20 says a use case that is not high risk may instead have a documented review, such as a peer review by qualified people who did not build or deploy it.

The Register reported that MAS wants all fintech AI use cases subject to independent review before deployment, and that the guidelines come into force on 7 October 2027. The PDF’s review rule is the one in paragraphs 5.18 to 5.20, and its dates are phased through 7 October 2028 for sections 5 and 6.

Outside models, and a later agentic consultation

For a bank using an outside model, paragraph 5.11 says the firm keeps primary accountability, including effects on customers and on compliance. Contracts should show when that AI is introduced or changed. The firm should test it on its own use cases, including with its own data. If residual risk cannot be brought inside its appetite, the PDF says the firm should consider limiting or suspending the service, or replacing the provider.

The release says that in 2027 MAS intends to consult the financial sector further on what additional guidance on agentic AI would be useful. The response paper says MAS will not mandate specific testing techniques for generative or agentic AI at this time, and that it intends, over time, to consult separately on agent-specific guidance. The 2027 line is the release’s.