MAS Finalises AI Risk Guidelines for Financial Firms

The Monetary Authority of Singapore (MAS) has finalised its Guidelines on Artificial Intelligence (AI) Risk Management for financial institutions (FIs), published today, 7 October 2026. The release follows consultation P017-2025, which opened on 13 November 2025 and closed on 31 January 2026, and comes with MAS’s response to feedback. The guidelines take effect on 7 October 2027, and FIs may implement them in phases.

MAS kept the key expectations from the November 2025 draft and refined them. Boards and senior management should oversee AI risk, with clear roles, a stated risk appetite, frameworks, policies and procedures. Existing governance structures can be used where adequate, and MAS says FIs “need not establish a dedicated AI committee solely to meet this expectation.” Firms should identify where they use AI and keep an inventory at an appropriate granularity. They should assess risk materiality, meaning how much a failure would matter, and apply proportionate controls across the AI lifecycle: data governance, testing, human oversight, cybersecurity, monitoring and change management. Those reviews should continue as agentic AI, meaning AI that can act with some independence, becomes more common. FIs remain accountable for AI that third parties develop, operate or provide. They should obtain sufficient assurance, assess suitability and apply compensating controls. If the risk cannot be brought within appetite, MAS says they should consider limiting, suspending or replacing the service. Where an AI tool’s failure is unlikely to materially affect the firm, its customers or other stakeholders, basic policies and procedures may be enough.

The guidelines apply to all FIs and all forms of AI, with controls scaled to the nature and scale of AI use and its risk materiality. MAS’s guidelines page tags licence types including Dealing in Capital Markets Products, Markets and Exchanges, Clearing House, Major Payment Institution, Standard Payment Institution and Designated Payment System Operator, as well as banks and insurers. For brokers, payment firms and exchanges, the practical first step is to inventory their AI use, including embedded AI, and to review vendor contracts for assurance rights. These are supervisory guidelines, meaning MAS’s statement of what it expects, not legislation, and the release does not state any penalties.

MAS also intends to consult the sector in 2027 on what additional guidance on agentic AI would be useful, but gives no date.

Firms therefore have a year before the first sections apply. Ho Hern Shin, Deputy Managing Director at MAS, said: “With greater regulatory clarity on financial institutions’ AI usage, FIs can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore’s financial system.”

Source: MAS media release, 7 October 2026