MAS Issues AI Risk Management Guidelines for Financial Institutions, With Compliance Starting in 2027

October 9, 2026 • FinTech News
MAS Issues AI Risk Management Guidelines for Financial Institutions, With Compliance Starting in 2027

Singapore’s Monetary Authority of Singapore (MAS) has issued new AI risk management guidelines covering financial institutions and all forms of artificial intelligence, setting out supervisory expectations for governance, risk assessment, human oversight, and third-party AI use ahead of implementation beginning in October 2027.

The guidelines, published on 7 October 2026, arrive as banks, insurers, payment providers, and investment firms increasingly use AI to support customer service, fraud detection, credit assessment, investment research, and operational decision-making.

The framework aims to help financial institutions adopt AI responsibly while managing the risks that can arise when systems generate inaccurate outputs, influence consequential decisions, or become embedded in critical business processes.

A central message is that financial institutions remain accountable for AI used in the services they deliver, even when the technology comes from an external provider. Outsourcing an AI model or service does not remove the institution’s responsibility to understand its suitability, assess its risks, and maintain appropriate controls.

The guidelines will take effect on 7 October 2027, with implementation phased across two stages. Financial institutions should meet expectations in Sections 3 and 4 from that date, while Sections 5 and 6 are to be met by 7 October 2028.

For the financial sector, the announcement signals a shift from broad principles for responsible AI toward more structured expectations for identifying, assessing, and managing AI risks throughout the technology’s lifecycle.

MAS AI Risk Management Guidelines: What Financial Institutions Need to Know

The new MAS AI risk management guidelines apply to financial institutions across Singapore’s regulated financial sector and cover all forms of AI technology.

Their scope includes banks, insurers, financial advisers, capital markets firms, fund managers, payment institutions, finance companies, credit bureaus, and other covered entities.

MAS is taking a risk-proportionate approach. Institutions are expected to tailor the depth and sophistication of their controls to the scale, nature, and materiality of their AI use rather than apply an identical governance model to every system.

For example, an AI tool used for a low-impact internal task may require a different level of oversight from a system that materially influences lending decisions, customer outcomes, fraud controls, or critical operations.

The guidelines also recognize that institutions may be able to use existing governance structures. MAS does not require every institution to create a dedicated AI committee solely to meet its oversight expectations, provided existing arrangements offer effective accountability and coordination.

This matters because AI adoption varies significantly across the financial sector. Some institutions use AI for limited productivity tasks, while others are integrating it into customer-facing services and business processes on which they depend.

The framework seeks to make risk management proportionate to those differences while establishing clear expectations for responsible use.

Why MAS Is Strengthening AI Governance in Finance

AI can improve productivity, customer service, fraud detection, and risk analysis. However, the consequences of failure can be significant when these systems operate within financial services.

An inaccurate AI-generated answer may mislead a customer. A poorly controlled model could contribute to an unfair decision. An unreliable system might disrupt a critical workflow, while a model exposed to sensitive information could create data protection or security concerns.

More autonomous systems introduce additional challenges. AI agents can increasingly generate outputs, make decisions, and interact with digital tools or other systems. Their actions may extend beyond producing text or recommendations, potentially affecting real operational processes.

These developments make it harder for institutions to rely solely on general AI policies or informal employee guidance.

MAS said its guidelines are intended to support responsible adoption while allowing institutions to realize AI’s benefits. The framework builds on the authority’s consultation launched in November 2025 and reflects feedback from the financial sector.

The regulator’s approach is not to prohibit AI adoption. Instead, it expects institutions to understand where AI is being used, identify the risks associated with each use case, and apply appropriate controls.

That distinction is important. Financial institutions can continue to innovate, but they should be able to explain how their AI systems are governed and how the risks they introduce are managed.

Board and Senior Management Accountability

One of the framework’s central expectations is effective oversight by boards and senior management.

Institutions should establish clear responsibilities for AI risk management, including appropriate risk appetite, governance frameworks, policies, and procedures.

This means AI governance cannot be treated solely as a technical issue delegated to data scientists or IT departments. Business leaders, risk teams, compliance professionals, legal specialists, and technology teams may all need defined responsibilities, depending on how AI is used.

Senior management should understand the institution’s material AI exposures and ensure that governance arrangements are appropriate for the potential impact of those systems.

Institutions should also be able to determine who is responsible for approving AI use cases, evaluating risks, monitoring performance, and responding when a system behaves unexpectedly.

Existing risk management structures can be used where they provide sufficient oversight. The objective is effective accountability rather than creating committees for their own sake.

For financial institutions already using AI extensively, this may require reviewing how AI decisions fit within existing operational risk, model risk, technology risk, and conduct risk frameworks.

AI Inventories and Risk Assessments Become More Important

MAS expects financial institutions to identify their AI use and maintain inventories at an appropriate level of detail.

An AI inventory helps an institution understand which systems and use cases exist across its operations. Without that visibility, it can be difficult to determine where AI is influencing decisions, which business processes depend on it, or where additional controls may be needed.

The guidelines also call for institutions to assess the risk materiality of individual AI use cases.

That assessment should inform the controls applied to each system. Relevant considerations include the potential impact of the AI, its complexity, and the institution’s reliance on it.

A tool that supports routine administrative work may pose a different risk from a model used to assess creditworthiness, detect suspicious transactions, or assist with investment decisions.

Risk assessments should not be treated as a one-time approval exercise. As AI systems change, gain new capabilities or become more deeply embedded in operations, their risk profiles may change as well.

Institutions therefore need processes that keep their inventories and assessments sufficiently current to support meaningful oversight.

Lifecycle Controls: From Data to Monitoring

The guidelines set expectations for managing AI risks throughout the technology’s lifecycle.

These controls include data governance, testing, human oversight, cybersecurity, monitoring, and change management. Their application should reflect the relevance and materiality of the particular AI use case.

Data governance helps institutions understand whether data used by AI systems is appropriate for the intended purpose and handled under suitable controls.

Testing and evaluation help assess whether a system performs as expected, identify weaknesses, and determine whether it is suitable for deployment.

Human oversight can be particularly important where AI outputs influence consequential decisions or where human intervention is needed to address uncertainty, errors, or unexpected behavior.

Cybersecurity helps protect AI systems, data, and connected infrastructure against attacks, misuse, and unauthorized access.

Ongoing monitoring allows institutions to identify changes in performance, emerging risks, and other issues that may not have been apparent during initial testing.

Change management helps ensure that modifications to models, data, tools, or workflows are reviewed appropriately rather than introduced without understanding their potential consequences.

These controls are especially relevant when AI is used in customer-facing or operationally important services. A model that performs well in testing may behave differently when exposed to new data, changing customer behavior, or evolving threats.

The guidelines therefore point toward continuous risk management rather than a single approval before deployment.

Third-Party AI Providers Will Not Remove Institutional Responsibility

A particularly important element of the MAS framework concerns AI supplied by external providers.

Financial institutions may use third-party models, cloud-based AI services, and embedded AI features in software or technology supplied by specialist vendors. These arrangements can accelerate adoption, but they can also limit an institution’s direct visibility into how a system operates.

MAS makes clear that institutions remain accountable for AI used in the services they deliver, including technology developed, operated, or provided by third parties.

Institutions should obtain sufficient assurance from providers, assess whether a service is suitable for its intended use, and apply additional controls where practical limitations or gaps in assurance arise.

If the risks cannot be brought within the institution’s risk appetite, MAS says it should consider limiting, suspending, or replacing the third-party AI service.

This expectation has implications for procurement and vendor management. Financial institutions may need to examine how providers test their systems, manage data, address security risks, monitor performance and communicate material changes.

They may also need contingency arrangements if a third-party AI service becomes unavailable or no longer meets the institution’s requirements.

The principle is straightforward: a financial institution cannot assume that a vendor’s assurances alone are sufficient to manage every risk associated with the service.

Agentic AI Adds a New Layer of Risk

The guidelines arrive as AI systems become more capable of acting through tools and connected applications.

Traditional AI tools may primarily generate predictions, recommendations or content. More autonomous systems can take additional steps, interact with external services and execute actions within defined workflows.

In financial services, these capabilities could support customer operations, compliance processes, transaction monitoring and other activities. They can also introduce risks if an agent acts on incorrect information, exceeds its intended authority or triggers an inappropriate action.

For example, an AI agent connected to a financial institution’s internal tools may have access to information or workflows that require careful permission management. Institutions need to understand not only the quality of the agent’s outputs but also the actions it can take and the consequences of those actions.

MAS expects institutions to review controls as AI adoption expands and technology evolves. The authority also said it intends to consult the financial sector in 2027 on what additional guidance on agentic AI would be useful.

That planned consultation is not a separate set of final requirements. It indicates that MAS intends to continue examining the risks associated with increasingly autonomous AI systems.

For financial institutions, the practical challenge is to ensure that greater autonomy does not weaken accountability, human oversight or operational control.

Risk-Proportionate Controls Will Matter Across Different Institutions

MAS has emphasised that the guidelines should be applied in proportion to each institution’s risk profile.

This means institutions should not assume that every AI use case requires the same degree of governance. The scale and sophistication of controls should reflect the potential impact of poor performance or system unavailability on the institution, its customers and other stakeholders.

Where an AI service has limited potential to cause material harm or disruption, basic policies and procedures may be sufficient.

More consequential use cases are likely to require stronger controls, deeper assessments and more structured oversight.

This approach recognises that financial institutions differ in size, business models, technical capabilities and levels of AI adoption. It also provides a way to distinguish routine productivity tools from AI systems that could materially affect customers or the wider financial system.

However, proportionality should not be interpreted as permission to ignore low-profile systems. Institutions still need enough visibility to understand where AI is being used and determine whether its risks are material.

The challenge will be to apply the framework consistently without creating unnecessary processes for low-risk use cases or leaving important risks unmanaged.

MAS Sets a Phased Implementation Timeline

The guidelines will take effect on 7 October 2027. MAS has allowed a phased approach to implementation.

Financial institutions should meet the expectations in Sections 3 and 4 from 7 October 2027. The expectations in Sections 5 and 6 are to be met by 7 October 2028.

This gives institutions time to assess their existing arrangements, identify gaps and plan improvements before the relevant dates.

A practical preparation process could include reviewing the current AI inventory, identifying high-impact use cases, assigning clear ownership, assessing third-party AI arrangements and checking whether testing, monitoring and human oversight are appropriate.

Institutions may also need to review employee training, escalation procedures and processes for managing changes to AI systems.

The precise work required will depend on each institution’s existing governance and the nature of its AI use. MAS’s risk-proportionate approach means implementation should be tailored to the risks rather than treated as a uniform checklist.

The phased timeline nevertheless gives financial institutions a clear reason to begin readiness planning well before October 2027.

What the Guidelines Mean for Singapore’s Financial Sector

The new framework places AI governance more firmly within the broader risk management responsibilities of financial institutions.

For banks and lenders, that includes understanding how AI may influence customer interactions, credit-related decisions and operational workflows. For insurers, the relevant risks may involve claims processes, customer services and other uses of AI. Payment providers and capital markets firms may need to consider systems supporting fraud controls, transaction processes, analysis and customer-facing services.

The exact implications vary by institution and use case, but the underlying expectation remains consistent: institutions should understand their AI exposure and manage it in a way that reflects the associated risks.

The framework may also influence relationships between financial institutions and technology providers. Vendors could face more detailed questions about testing, security, monitoring and the assurances they can provide to regulated customers.

For the wider fintech sector, the guidelines underline the importance of building governance into AI products rather than treating it as an afterthought.

That does not mean every fintech provider is automatically subject to the same direct obligations as a regulated financial institution. The formal applicability depends on the entity and the relevant regulatory framework. However, providers serving regulated institutions may find that customers increasingly expect evidence of appropriate AI risk controls.

What Happens Next?

MAS has established a phased timeline for financial institutions to prepare for the new expectations, beginning with the first implementation date in October 2027 and continuing through October 2028.

The immediate priority for institutions is to understand where AI is used, identify the systems that could have a material impact and determine whether existing governance arrangements are adequate.

They will also need to assess third-party AI relationships and ensure that appropriate controls extend beyond the initial deployment of a system.

Further discussion of agentic AI is expected, with MAS planning a consultation in 2027 on whether additional guidance would be useful.

The framework does not prohibit AI in financial services. Instead, it sets out how institutions are expected to govern and manage the risks associated with its use while continuing to pursue potential benefits.

The key message for the financial industry is that AI adoption must be matched by accountability. As AI systems become more capable and more deeply integrated into financial operations, institutions will need to demonstrate that they understand their risks, maintain appropriate oversight and remain responsible for the services they deliver.

Guidelines on Artificial Intelligence Risk Management for Financial Institutions