Following a public consultation that ran from November 2025 to January 2026, the Monetary Authority of Singapore released its final Guidelines on Artificial Intelligence Risk Management for financial institutions on October 7. They are supervisory expectations, which means that rather than enacting new legislation, MAS lays out what it wants firms to do. The release does not specify any fines. They apply to banks, insurers, capital markets firms, and payment firms, scaled to how much a firm uses AI and how risky that use is, and they cover all types of AI, including systems bought from outside vendors. MAS said consultation respondents backed guardrails that scale with risk.
The main message is that a firm remains responsible for its AI, even when someone else built it. Boards and senior management should oversee AI risk, set clear responsibilities, and decide how much AI risk the firm will accept. MAS says firms do not need a dedicated AI committee and can use their existing governance structures, but those structures must cover AI across the whole institution, so that business units assess risk consistently. Firms should keep an inventory of the AI they use, including AI built into vendor services and tools staff use without approval, and rate each use by how much a failure would matter. A tool that helps staff draft emails may need only basic safeguards, while a model used for credit decisions deserves far more.
Vendors receive particular consideration. Firms should add their own precautions, such as additional testing, closer human supervision, or independent assessments of the supplier's controls, as well as obtain sufficient assurance from outside suppliers to ensure that their tools meet their demands. In addition to requiring vendors to disclose when they add or modify AI in a product, MAS wants contracts to address performance, data security, and audit rights. Additionally, it requests that businesses avoid becoming overly dependent on a small number of suppliers. According to MAS, a company should think about limiting, suspending, or replacing the service if it is unable to reduce the risk inside its bounds.
For high risk uses, MAS expects independent validation before launch, continued monitoring, and periodic review, and it asks firms to consider switches that can quickly shut a system down. Controls should cover an AI system’s whole life, from data governance and testing to human oversight, cybersecurity, and change management.
Consumer protection is a clear concern. Credit decisions, insurance underwriting, and financial advice are among the uses most tied to customer outcomes, because biased data or models could affect who gets access to finance. This builds on the fairness principles MAS introduced in 2018. The guidelines are a general framework, so uses like algorithmic trading fall under the same risk based approach.
The scope is wide. According to Entrepreneur Asia Pacific, the guidelines cover generative AI and AI agents, while US bank regulators left both out when they rewrote their model risk guidance in April. MAS is also working on what comes next. On October 9, its managing director, Chia Der Jiun, said agents that can complete transactions for customers could change how banks manage liquidity and collateral. A voluntary framework MAS and industry partners published in July, called SAFR, adds checks at the moment an agent proposes an action, including verifying who the agent is and what it may do.
Firms have time. The guidelines take effect on October 7, 2027, with board oversight, inventories, and risk assessments first, and controls across an AI system’s life follow by October 7, 2028. MAS also plans to consult the industry in 2027 on whether further guidance is needed for agentic AI.
Other regulators in the region are moving in the same direction. Hong Kong’s HKMA already expects human oversight of customer facing generative AI. Singapore’s approach is broad and flexible, which makes it easy for others to adapt, and its real effect will show in how firms name owners and set limits.