MAS Issues Guidelines on Artificial Intelligence Risk Management for Financial Institutions

On 7 October 2026 the Monetary Authority of Singapore (MAS) published its final Guidelines on Artificial Intelligence Risk Management for Financial Institutions.

The Guidelines set out supervisory expectations for how financial institutions (FIs) should manage risks arising from the use of AI while supporting responsible adoption. They apply to all FIs and all forms of AI technologies (including generative AI and newer developments such as AI agents) and take effect on 7 October 2027, with phased implementation permitted.

Practical implications

• The Guidelines move AI risk management from voluntary principles (FEAT and earlier information papers) toward supervised expectations with clear deadlines.

• Inventory and materiality assessment work will be the immediate priority for many firms, especially those that must capture AI embedded in third-party products and services.

• Third-party accountability is explicit and cannot be contracted away. Global groups operating in Singapore will need to ensure local senior management can demonstrate that group frameworks satisfy MAS expectations and that Singapore-specific issues have clear escalation paths.

• Firms with limited AI use may be able to rely on the basic-policies route, but they must still document why the low-materiality criteria are met and keep that assessment under review.

• All FIs should begin mapping current AI use, assessing gaps against Sections 3–4, and planning the more detailed life-cycle controls that become due a year later.

• High-risk use cases should receive appropriate controls as soon as practicable. MAS expects FIs to review their AI risk management regularly against technological developments.

Background and purpose

• MAS consulted on the Guidelines in November 2025 (consultation P017-2025, closed 31 January 2026). Respondents broadly supported a principles-based, risk-proportionate approach.

• The final Guidelines retain the core expectations from the consultation and refine them in response to feedback, including on the use of existing governance structures, management of embedded AI, and when basic policies are sufficient.

• The Guidelines complement existing MAS requirements and the Fairness, Ethics, Accountability and Transparency (FEAT) principles.

• They should be read alongside other relevant MAS guidelines, information papers and circulars.

• They apply on a group basis for locally incorporated FIs that are subject to consolidated supervision by MAS or that own critical information infrastructure.

• Global groups may leverage group frameworks provided they meet the MAS expectations, with local senior management remaining accountable for Singapore-specific considerations.

• AI is defined for these purposes as machine-based systems or models that derive outputs (estimates, predictions, content, recommendations or decisions) through learned premises from data or inputs.

• Tools whose outputs rely solely on predefined programming logic or rules fall outside the definition.

Scope and proportionate application

• The Guidelines apply to all FIs listed in the relevant MAS regimes (banks, insurers, capital markets intermediaries, trust companies, payment institutions, financial advisers and others) and to all forms of AI.

• Implementation must be commensurate with the size and nature of the FI’s activities and the materiality of risks arising from its AI use.

• FIs may adopt basic AI governance policies and procedures where poor performance or unavailability of the AI tools is unlikely to have a material adverse impact on the FI, its customers or other stakeholders.

• Basic requirements include clear accountability (e.g. a designated senior management member), permitted/prohibited uses with effective human oversight, an approved list of tools with a request process, staff education, regular compliance checks, and periodic review of whether the low-materiality criteria still apply. Examples of generally low-materiality uses include assisting with drafting or proofreading emails, summarising documents for internal reference, generating charts for internal use, or internal chatbots locating policies.

Key supervisory expectations

MAS summarised four key expectations:

1. Strengthen oversight of AI risks with clear accountabilities. Boards and senior management must provide effective oversight, set clear roles and responsibilities, incorporate AI risks into the risk appetite framework, and establish appropriate frameworks, policies and procedures. Existing governance structures may be used if they deliver adequate oversight and cross-functional coordination; a dedicated AI committee is not required solely to meet the expectation. Local senior management remains accountable even when relying on group frameworks.

2. Identify, assess and manage AI risks across the AI life cycle. FIs must consistently identify AI use (including AI embedded in material third-party services), maintain accurate inventories at an appropriate level of granularity, and assess the risk materiality of each use case. Materiality assessments must cover at least impact, complexity and reliance (considering both inherent and residual risk). Controls are then applied proportionately across the life cycle. These include data governance, evaluation and testing, human oversight, fairness, transparency and explainability, technology and cybersecurity, monitoring, change management, and incident management. Controls should be reviewed regularly as AI use and technologies evolve.

3. Manage the risks from third-party AI use. FIs remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties. They must obtain sufficient assurance from providers, assess suitability for the intended use, and apply compensating controls where assurance gaps or practical constraints exist. If residual risks cannot be brought within the FI’s risk appetite, the FI should consider limiting, suspending or replacing the third-party AI service.

4. Apply the Guidelines in a risk-proportionate manner. The sophistication of frameworks, inventories, assessments and controls should reflect the FI’s risk exposure and the materiality of specific use cases. Basic policies may suffice for low-materiality uses (see above).

Section 5 of the Guidelines sets out detailed life-cycle controls

1. Section 5 of the Guidelines sets out detailed life-cycle controls (data management, model/feature selection, evaluation and testing, technology and cybersecurity, reproducibility and auditability, pre- and post-deployment reviews and monitoring, change management, decommissioning, etc.).

Section 6 addresses the capabilities, capacities and technology infrastructure needed to support responsible AI use

2. Section 6 addresses the capabilities, capacities and technology infrastructure needed to support responsible AI use.

Implementation timeline

• Guidelines take effect on 7 October 2027.

• FIs should meet the expectations in Sections 3 and 4 (oversight, identification, inventory and risk materiality assessment) from 7 October 2027.

• Expectations in Sections 5 and 6 (life-cycle controls and capability/capacity) should be met by 7 October 2028.

MAS SAYS

• In 2027, MAS intends to consult further on additional guidance that would be useful for agentic AI (systems with greater autonomy and tool access).

• MAS has indicated it will continue to work with the industry on practical, industry-grounded implementation. The accompanying response to feedback provides further clarification on points raised during consultation.

Primary sources for verification

• Guidelines page: https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions

• PDF of the Guidelines: https://www.mas.gov.sg/-/media/mas-media-library/regulation/guidelines/bd/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions/guidelines-on-artificial-intelligence-risk-management.pdf

• Media release: https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions

• Consultation response (also published 7 October 2026): available via the MAS consultation page for P017-2025.

• Consultation page (P017-2025)
  https://www.mas.gov.sg/publications/consultations/2025/consultation-paper-on-guidelines-on-artificial-intelligence-risk-management

• This page lists the response, the original consultation paper, and the submissions annex.

• Direct PDF – Response to Feedback Received on Guidelines on Artificial Intelligence Risk Management (7 October 2026)
  https://www.mas.gov.sg/-/media/mas-media-library/publications/consultations/bd/2025/response-to-feedback-received-on-guidelines-on-artificial-intelligence-risk-management.pdf

• Direct PDF – Annex B (Submissions to Consultation Paper)
  https://www.mas.gov.sg/-/media/mas-media-library/publications/consultations/bd/2025/annex-b---submissions-to-consultation-paper.pdf

OTHER READING

• Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of Artificial Intelligence and Data Analytics in Singapore’s Financial Sector (12 November 2018, with a minor update in February 2019).
  These voluntary principles continue to apply. The Guidelines treat them as the ongoing reference point for fairness, ethics, accountability and transparency.
  Page: https://www.mas.gov.sg/publications/monographs-or-information-paper/2018/FEAT
  PDF: https://www.mas.gov.sg/-/media/mas/news-and-publications/monographs-and-information-papers/feat-principles-updated-7-feb-19.pdf

• Information Paper: Artificial Intelligence (AI) Model Risk Management (5 December 2024).
  Based on a mid-2024 thematic review of banks’ practices (including Generative AI). It sets out observed good practices on governance and oversight, identification/inventory/materiality assessment, and development/deployment. MAS encourages all FIs to reference it. This paper is the practical predecessor to the 2026 Guidelines.
  Page: https://www.mas.gov.sg/publications/monographs-or-information-paper/2024/artificial-intelligence-model-risk-management
  PDF: https://www.mas.gov.sg/-/media/mas-media-library/publications/monographs-or-information-paper/imd/2024/information-paper-on-ai-risk-management-final.pdf
  Related circular to insurers: ID 18/24 (5 December 2024).

• Guidelines on Risk Management Practices – Technology Risk (Technology Risk Management Guidelines, revised 18 January 2021).
  These apply to AI systems in the same way as other technology systems (availability, resilience, cybersecurity, change management, third-party risk, etc.). Footnotes in the AI Guidelines point to them for technology and infrastructure expectations.
  Page: https://www.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines

Other materials that sit alongside them in practice

• Outsourcing / third-party risk guidelines and notices (because third-party AI accountability is a core theme).

• Relevant Technology Risk Management Notices and the Notice on Cyber Hygiene (legally binding baselines).

• Fair dealing, data protection, and other conduct/operational risk expectations that continue to apply when AI is used.

• The industry-developed AI Risk Management Operationalisation Handbook from Project MindForge (published March 2026). This is not a formal MAS guideline but was created with MAS support and is aligned with the Guidelines; it provides practical implementation detail.

In short, the only document the Guidelines themselves single out by name in the introductory section is the 2018 FEAT principles. Everything else falls under the general instruction to read them alongside other relevant MAS materials (especially the 2024 AI Model Risk Management Information Paper and the Technology Risk Management Guidelines). Firms should also check for any subsequent circulars or updates MAS issues.

This summary is based on the published Guidelines, media release and related MAS materials as at the date of writing. Firms should consult the original documents and, where appropriate, obtain legal or compliance advice specific to their circumstances.