AI in action · Regulation

Singapore Gives Every Financial Institution a Year to Put AI Under Board Oversight. Rules for Agentic AI Come Later

The Monetary Authority of Singapore issued its final Guidelines on Artificial Intelligence Risk Management on October 7, 2026, covering all financial institutions and all forms of AI. Boards must oversee AI risk, firms must keep an inventory of AI use and assess the materiality of each case, and they remain accountable for vendor models. The first sections apply from October 2027; MAS will consult in 2027 on agentic AI.

Oct 19, 2026

Singapore's central bank has finished the AI rulebook it began in November 2025, and it has chosen breadth over detail. The Guidelines on Artificial Intelligence Risk Management, issued by the Monetary Authority of Singapore on October 7, 2026, apply to all financial institutions it supervises and to all forms of AI, from a credit-scoring model to a general-purpose language model embedded in vendor software. They are principles-based and risk-proportionate: firms whose AI use is unlikely to have a material impact can comply with basic policies and procedures, while those running AI in material decisions face the full set of expectations.

The expectations start at the top. Boards and senior management must oversee AI risk, with defined roles, a stated risk appetite and governance frameworks, though MAS does not require a dedicated AI committee. Every institution must keep an inventory of its AI use and assess the materiality of each use case. Across the AI life cycle the guidelines call for data governance, testing, human oversight, cybersecurity, monitoring and change management, with the depth of each scaled to the materiality assessment.

The third-party section is the one most relevant to a market in which almost every firm builds on models from a handful of large developers. Institutions remain accountable for AI used in their services even when a vendor develops, operates or provides it; they must obtain sufficient assurance from providers; and if a third-party AI service's risks fall outside the firm's risk appetite, the guidance says the firm should consider limiting, suspending or replacing it. Respondents to the consultation had asked how to handle AI embedded in other software and when basic policies were enough, and MAS adjusted the detail while keeping the core expectations.

The timetable is deliberately long. Sections 3 and 4 of the guidelines apply from October 7, 2027, and sections 5 and 6 from October 2028. On agentic AI, systems that act autonomously and use tools, MAS said the thinking is not yet settled: firms should review their controls as they deploy more autonomous systems, and the authority intends to consult the industry in 2027 on what further guidance would be useful. Ho Hern Shin, MAS deputy managing director, said the aim was for institutions to innovate with confidence while maintaining the trust of customers.

Set beside the Financial Stability Board's twelve sound practices finalised a week later, the US agencies' informal questions to banks and the Bank of England's test-first approach to frontier models, Singapore's document is the most complete national rulebook so far and the most cautious on the question everyone is now asking. It covers the AI that exists in banks today and defers the AI that trades and pays on its own to a consultation next year. For firms building agent-driven trading or payment products in Singapore, that is both a reprieve and a notice.

Sources: Monetary Authority of Singapore — Media releases (Guidelines on Artificial Intelligence Risk Management, Oct 7, 2026); Blockhead — MAS Finalises AI Risk Rules for Financial Institutions, With Agentic AI Guidance to Follow in 2027 (Oct 8, 2026); Financial Stability Board — FSB finalises sound practices for the responsible adoption of AI (Oct 15, 2026)