Singapore's MAS Turns AI Guidance Into Binding Rules for Banks, Phased In Through 2028

The Monetary Authority of Singapore published a set of Guidelines on Artificial Intelligence Risk Management for financial institutions on October 7, converting what had been principle-level guidance into formal supervisory expectations with dates attached. The guidelines apply to all financial institutions and all forms of AI technology, while letting each firm scale its controls to the nature and size of its AI use and the materiality of the risk.

The framework follows a public consultation opened in November 2025. Respondents broadly backed its principles-based, risk-proportionate approach but asked for clarity on whether firms could reuse existing governance structures, how to handle AI embedded in third-party software, and when basic policies would suffice. MAS kept its core expectations and refined them in response. The Financial Stability Board has separately consulted on sound practices for responsible AI adoption by financial institutions.

The guidelines set four main expectations. First, boards and senior management must oversee AI risk with clear roles, risk appetite and frameworks — though firms need not stand up a dedicated AI committee if existing cross-functional structures provide adequate oversight and coordination. Second, firms must identify, assess and manage AI risk across the full life cycle, maintaining inventories at an appropriate level of granularity and applying proportionate controls covering data governance, testing, human oversight, cybersecurity, monitoring and change management, with controls reviewed regularly as adoption grows.

Third, financial institutions remain accountable for AI used in the services they deliver even when it is developed, operated or provided by a third party. They should obtain sufficient assurance from providers and assess whether third-party AI is suitable for its intended use; reporting on the guidelines notes MAS expects independent assessments rather than reliance on vendors' self-attestations. If the risks cannot be brought within the firm's stated risk appetite, it should consider limiting, suspending or replacing that service. Fourth, the whole framework applies proportionately: firms whose AI failure is unlikely to materially affect them, their customers or other institutions may meet the guidelines with basic policies and procedures.

The deadlines are explicit. The guidelines take effect on October 7, 2027, with the expectations in Sections 3 and 4 — governance, and risk identification and assessment — due from that date. The life-cycle controls and capability requirements in Sections 5 and 6 must be met by October 7, 2028.

MAS flagged agentic AI — systems that can act autonomously and call external tools — as an area of elevated risk and incomplete guidance, and said it intends to consult the financial sector in 2027 on what additional guidance would be useful. Reporting on the guidance also highlights requirements to inventory AI embedded in material third-party services and "shadow AI" not formally procured as AI, and to test contingency and kill-switch protocols for high-risk applications.

"Realising these benefits sustainably requires financial institutions to understand and manage the risks that come with increasingly capable AI systems," said Ho Hern Shin, a deputy managing director at MAS. "With greater regulatory clarity on financial institutions' AI usage, FIs can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore's financial system."

What stands out is that MAS has put dates and accountability on rules that elsewhere remain voluntary. Two requirements will bite hardest in procurement. Inventories that must cover embedded and shadow AI force firms to map what is already inside their stack, and a preference for independent assurance over vendor self-attestation changes how AI contracts are negotiated. For a region where financial institutions are among the fastest enterprise adopters of AI, Singapore has moved from encouraging responsible use to supervising it.