MAS Finalises AI Risk Rules for Financial Institutions, With Agentic AI Guidance to Follow in 2027

The Monetary Authority of Singapore (MAS) has issued its Guidelines on Artificial Intelligence (AI) Risk Management, setting out what it expects of financial institutions using AI, the regulator announced on Wednesday. The guidelines take effect on October 7, 2027, and apply to all financial institutions and all forms of AI.

The final text follows a public consultation in November 2025. MAS said respondents backed its principles-based, risk-proportionate approach but wanted clarity on whether existing governance structures would suffice, how to handle AI embedded in other software, and when basic policies would be enough. The regulator kept its core expectations and adjusted the detail in response.

Firms are expected to have boards and senior management oversee AI risk, with defined roles, risk appetite and frameworks, although MAS said they need not set up a dedicated AI committee to do so. They must keep inventories of their AI use, assess the materiality of each use case and apply controls covering data governance, testing, human oversight, cybersecurity, monitoring and change management across the AI life cycle.

The provision with the widest reach covers third-party AI. MAS said financial institutions remain accountable for AI used in their services even when it is developed, operated or provided by an outside vendor. Firms must obtain sufficient assurance from providers, and if the risks of a third-party AI service cannot be brought within their risk appetite, they should consider limiting, suspending or replacing it. Most institutions build on models from a small number of large AI developers, so that expectation puts the burden of vetting those models on the firms themselves.

Firms whose AI use is unlikely to have a material impact on them, their customers or other institutions can meet the guidelines with basic policies and procedures. Implementation is phased, with sections 3 and 4 applying from October 2027 and sections 5 and 6 from October 2028.

MAS flagged agentic AI as the area still to be settled. It told firms to review their controls as they make greater use of agentic systems that can operate autonomously and access tools, and said it intends to consult the industry in 2027 on what further guidance on agentic AI would be useful. That consultation is likely to matter to crypto firms building agent-driven trading and payments products in Singapore.

"With greater regulatory clarity on financial institutions' AI usage, FIs can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore's financial system," said Ho Hern Shin, MAS deputy managing director.