Singapore’s financial institutions can no longer treat outsourced AI as somebody else’s problem. The Monetary Authority of Singapore (MAS), the city-state’s central bank and financial regulator, has published guidelines that hold firms answerable for any AI embedded in their services, whether built in-house or sourced from an outside provider.
According to CNA, under the framework, released on 7 October, firms must evaluate and control the risks arising from their AI deployments, including systems that a third party designs, runs or supplies.
MAS explained its expectations in a media release, stating, “Financial institutions should obtain sufficient assurance from third-party providers, assess whether third-party AI is suitable for their intended use, and apply compensating controls where practical constraints or assurance gaps arise.” Where a firm still cannot bring the risk within its tolerance levels, it is expected to weigh restricting, pausing or swapping out the external AI service.
The rules come into force on 7 October 2027. Institutions may adopt them in stages but must achieve full compliance by 7 October 2028.
The framework asks firms to oversee AI risk across the whole organisation as well as for each specific application, and to strengthen their expertise as adoption grows.
In practice, this means cataloguing where AI is used, keeping up-to-date inventories, grading the risk of each application and applying safeguards scaled to that risk at every stage of the AI life cycle. Those safeguards span data governance, testing, human oversight, cybersecurity, monitoring and change management.
MAS stressed that these controls need periodic review as deployment widens and the technology matures. It singled out agentic AI, meaning systems capable of acting independently and drawing on tools, as a growing area of use. The regulator intends to seek industry views in 2027 on what further agentic AI guidance would help.
Boards and senior leaders carry explicit responsibility under the rules. They must supervise AI risk effectively by defining roles, accountabilities, risk appetite and risk management frameworks. A standalone AI committee is not mandatory, provided current governance arrangements already deliver sufficient oversight and coordination across functions.
MAS observed that AI is advancing quickly and being embedded in financial services at greater scale and with more sophistication, including models with increasing autonomy over outputs, decisions and actions. The framework follows a public consultation held in November 2025, and arrives as scrutiny of increasingly capable AI intensifies. Singapore is examining whether high-risk AI uses require additional protections, and Minister for Digital Development and Information Josephine Teo said last week that the safeguards adopted by frontier AI developers fall short of the risks these systems present.
MAS deputy managing director Ho Hern Shin said AI holds “significant potential” to enhance financial services, but argued firms must grasp and control the risks of more powerful systems to capture those gains sustainably.
MAS deputy managing director Ho Hern Shin said, “With greater regulatory clarity on financial institutions’ AI usage, financial institutions can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore’s financial system. MAS will continue to work with the industry to advance sound AI risk management practices in a practical and industry-grounded manner.”
Copyright © 2026 FinTech Global
