Every financial institution supervised by the Monetary Authority of Singapore now has a dated deadline to find, inventory, rate and control all of its AI, including generative AI and AI agents. MAS published its Guidelines on Artificial Intelligence Risk Management on 7 October 2026, after a consultation launched in November 2025. Board oversight, AI identification, inventory and risk materiality (Sections 3 and 4) apply from 7 October 2027, and lifecycle controls and capability (Sections 5 and 6) must be in place by 7 October 2028. This guide walks through what each section expects, with paragraph references, how the proportionality regime works, what is specific to AI agents, and how to build a programme that meets both deadlines. It is written for CROs, CISOs, heads of model risk, AI governance leads and technology teams in Singapore banks, insurers, capital markets firms and payment institutions, and for vendors selling AI to them.
Source note: dates and paragraph references are from the MAS Guidelines, MAS media release and MAS response to feedback; the consultation reference P017-2025 and 31 January 2026 closing date are from the MAS consultation page. Confirm against the official text before relying on it.
Key takeaways
- Scope is every FI and every kind of AI. The Guidelines apply to all financial institutions and all AI technologies, including AI embedded in material third-party services such as SaaS features; rules-based tools and RPA without learning are excluded.
- Two deadlines. Governance, identification, inventory and materiality from 7 October 2027; lifecycle controls and capability by 7 October 2028.
- Proportionality has a floor. Firms whose AI is only assistive and low impact can use a basic regime of named accountability, permitted uses, human review, approved tools, training and checks (paragraphs 2.3 to 2.5); everyone else meets the full expectations.
- Agents get explicit treatment. Inventory entries should record agent identifiers, the tools and systems each agent can access, its components and guardrails, and monitoring should cover reasoning, actions and tools used.
- Third-party AI stays your problem. The FI keeps primary accountability, must test vendor AI on its own data, should rely on independent certifications rather than self-attestations, and must limit, suspend or replace a provider whose residual risk exceeds appetite.
Status, timeline and legal character
| Date | Milestone |
|---|---|
| November 2025 | MAS consultation on proposed Guidelines on AI Risk Management |
| 7 October 2026 | Final Guidelines and response to feedback published |
| 7 October 2027 | Section 3 (AI oversight) and Section 4 (key AI risk management systems, policies and procedures) apply |
| 2027 | MAS intends to consult industry on further guidance for agentic AI |
| 7 October 2028 | Section 5 (AI life cycle controls) and Section 6 (AI capability and capacity) expected to be met |
The document describes itself as supervisory expectations. It does not state a statutory basis or penalties, so treat it the way FIs treat other MAS guidelines: not an offence-creating instrument, but a standard MAS will assess you against in supervision and inspections. The earlier FEAT principles (fairness, ethics, accountability, transparency) continue to apply (paragraph 1.2). Locally incorporated FIs under consolidated supervision apply the Guidelines on a group basis; a branch of a global group may use group frameworks if they meet the expectations, but local senior management remains accountable (paragraph 3.6).
What counts as AI, and the basic regime
AI is a machine-based system or model that derives outputs such as estimates, predictions, content, recommendations or decisions from patterns learned from data or inputs (paragraphs 1.3 and 1.4). Tools that only follow predefined rules or explicit formulae, and robotic process automation without learning, are out. The Guidelines distinguish a model, a system made of one or more models plus other components, and a use case.
| Regime | When it applies | What is required |
|---|---|---|
| Basic (2.3 to 2.5) | Poor performance or unavailability is unlikely to have a material adverse impact; examples include drafting or proofreading emails, summarising internal documents, internal policy chatbots, generating internal charts or marketing images, with human review of outputs | Named senior management accountability; permitted and prohibited uses (for example no confidential data in public AI tools); human review; approved tool list and approval process; staff education; regular compliance checks; periodic and trigger-based reviews |
| Full (2.2, Sections 3 to 6) | Any AI beyond that, scaled to the FI's size, activities and the materiality of each use case | Board and senior management oversight, identification, inventory, materiality, lifecycle controls and capability, applied in proportion to materiality |
Most banks and insurers will be in the full regime for at least some use cases, so the practical question is how controls scale by materiality, not whether the Guidelines apply.
Oversight and core systems (Sections 3 and 4, from October 2027)
- Board (3.4): approves the AI governance approach and strategy, reflects AI risk in the risk appetite framework with qualitative and quantitative measures, sets roles, ensures sufficient AI understanding and reviews regularly. A dedicated AI committee is optional if existing structures give a consolidated view of AI risk.
- Senior management (3.5): implements frameworks, institutes lifecycle controls, assigns inventory and materiality roles, sets escalation for AI incidents and threshold breaches, reports to the board and funds training.
- Identification (4.2 to 4.4): identify AI consistently across functions, including AI embedded in material third-party services. A designated control function is the final arbiter of whether something is AI. Residual risk from unidentified or shadow AI must stay within appetite.
- Inventory (4.5 to 4.9): accurate, with a defined update frequency and a control function overseeing completeness.
- Materiality (4.10 to 4.13): assess inherent and residual risk on impact, complexity and reliance; residual risk must be within appetite before deployment; a control function approves ratings.
Inventory attributes and materiality dimensions
| Inventory attribute (4.7) | Agent-specific addition (footnote 25) |
|---|---|
| Purpose, description and approved scope of use (for example jurisdiction) | Agent-specific identifier |
| Model type, data used and dependencies | Tools and systems the agent can access |
| Lifecycle status and model review status | Components that make up the agent |
| Risk materiality rating | Guardrails applied |
| Owners, developers and links to documentation | (as for any use case) |
| Dimension (4.12) | What MAS asks you to consider | Example of a high rating |
|---|---|---|
| Impact | Consequences of failure for the FI, customers and stakeholders, including data sensitivity | Credit decisioning or claims denial affecting customers |
| Complexity | Nature and novelty of the technology, data used, explainability, and visibility into third-party AI | Opaque foundation model from a vendor with limited disclosure |
| Reliance | Dependence on AI outputs, autonomy granted and level of human involvement | Agent executing payments or account changes without approval steps |
Use the AI Register and AI Inventory Template as a starting structure and add the agent fields.
Lifecycle controls (Section 5, by October 2028)
| Control area | Paragraph | Key expectations |
|---|---|---|
| Contingency | 5.3 | Fallback systems or manual processes for high-risk use cases, tested regularly; defined and tested kill switch activation protocols |
| Data management | 5.4 | Fit for purpose, representative, classified, secure, privacy compliant, with lineage; secure destruction at decommissioning |
| Transparency and fairness | 5.5 to 5.8 | Explainability proportionate to materiality; inform customers of AI use and redress; defined fairness, assessed across protected attributes and proxies |
| Human oversight | 5.9 | Clear authority to intervene, escalation on defined conditions, logs of overrides and near misses, attention to automation bias |
| Third-party AI | 5.10 to 5.11 | Contract visibility into AI changes; own-data testing; eight assessment areas including supply chain, concentration and audit rights |
| Selection, evaluation and testing | 5.12 to 5.15 | Documented selection rationale; measurable thresholds before deployment; edge case, stress and adversarial testing; for GenAI, hallucination, toxicity, leakage and adversarial robustness |
| Technology and cybersecurity | 5.16, 5.22 | Hardening, segmentation, input validation, API authentication, encryption, DLP, role-based access, MFA, privileged access management, separation of duties, least privilege for APIs and plugins, vulnerability assessment, penetration testing and red teaming |
| Reproducibility | 5.17 | Enough documentation for an independent party to replicate results |
| Pre-deployment review | 5.18 to 5.21 | Independent validation for high-risk use cases; documented peer review for lower risk |
| Monitoring and re-validation | 5.23 to 5.24 | Tiered early-warning thresholds; drift monitoring; monitoring of reasoning, actions and tools; kill switches or overrides for high-risk AI; risk-based re-validation |
| Change and decommissioning | 5.25 to 5.26 | Version control of code, data, parameters and hyperparameters with rollback; limits on auto-updating AI; secure removal |
AI agents: what is specific
Paragraph 1.11 says greater autonomy and tool access amplify risk: agents may take unauthorised or erroneous actions, and a compromised agent could exfiltrate data or execute malicious commands at scale. Generative AI risks listed in paragraph 1.10 include prompt injection, data poisoning, privacy leakage through third parties and shadow AI. The response to feedback says enhanced logging for generative AI and agents is risk-based rather than mandatory, and that agents with access to multiple tools may warrant an access-level risk assessment. In practice:
- Give every agent its own identity: the inventory identifier should map to a distinct workload identity, not a shared service account or a human user's token, so actions are attributable. See the Agent Identity and Access Guide.
- Record and minimise tool access: the footnote 25 list of tools and systems is an entitlement list. Scope each tool credential to the minimum actions and data, and review it like any privileged access, as in the Agent Identity Recertification guide.
- Rate reliance honestly: an agent that can move money or change customer records without an approval step is high reliance, which pushes it to independent validation and kill switch requirements.
- Log what the agent did, not just what it said: prompts, responses, model versions, tool calls and outcomes, retained so an investigator can reconstruct an incident.
- Test the off switch: paragraph 5.3 asks for tested activation protocols. Revoking the agent's credentials and tokens is the most reliable kill mechanism; see the AI Agent Kill Switch and Containment Guide.
Expect more detail: MAS intends to consult in 2027 on further agentic AI guidance. The IMDA framework in the Singapore Model AI Governance Framework for Agentic AI Guide is a useful companion but is not an MAS requirement.
How to implement: a phased programme
- Decide the regime (Q4 2026): document whether any use case falls outside the basic regime. If yes, plan for full expectations.
- Governance (by mid-2027): board approval of AI strategy, AI risk metrics in the risk appetite statement, named senior management owner, designated control function for identification and materiality.
- Discovery (by mid-2027): combine procurement records, SaaS feature reviews, cloud AI service logs, network egress to AI endpoints and business attestations to find AI, including shadow AI and embedded vendor features.
- Inventory and materiality (by 7 October 2027): populate the inventory with paragraph 4.7 attributes plus agent fields, and rate every use case. Pilot the methodology on ten varied use cases first and recalibrate before rating the rest.
- Control design (2027 to 2028): build the Section 5 control set tiered by materiality, starting with high-materiality use cases: independent validation, kill switches, monitoring thresholds and change control.
- Third-party remediation (2027 to 2028): renegotiate contracts for change notification and audit rights, collect independent certifications and run own-data tests.
- Capability (by 7 October 2028): training for developers, validators, monitors and users; infrastructure resilience for AI workloads.
- Test and roll back: exercise contingency plans and kill switches for high-risk use cases at least annually, and keep version-controlled rollback paths for every model and agent change.
Decision guidance
- Small FIs: a fund manager using only drafting and summarisation tools can stay in the basic regime, but must still name an accountable executive and keep an approved tool list.
- Large banks: extend existing model risk management rather than building a parallel AI process; add the AI-specific dimensions, GenAI testing and agent fields. See the AI Model Risk Management Guide.
- Vendor AI with limited disclosure: compensate with own-data testing, independent certifications and usage limits; if residual risk still exceeds appetite, restrict or exit.
- Agents in production: start with read-only tools and human approval of actions, then relax approvals only with monitoring evidence.
Detection, metrics and evidence
- Inventory coverage: discovered AI use cases versus inventoried use cases, including vendor-embedded AI.
- Rating currency: percentage of use cases with a materiality rating reviewed within policy.
- Validation coverage: percentage of high-materiality use cases independently validated before deployment.
- Agent least privilege: percentage of agents with a unique identity and tool scopes reviewed in the last quarter.
- Monitoring breaches: early-warning threshold breaches and time to resolution.
- Kill switch tests: high-risk use cases with a successful contingency test in the last 12 months.
Framework mapping
| MAS expectation | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Board oversight and risk appetite (3.4, 3.5) | GV.RR-01, GV.RM-01 | PM-28 |
| AI identification and inventory (4.2 to 4.9) | ID.AM-02 | CM-8 |
| Third-party AI (5.10 to 5.11) | GV.SC-06, GV.SC-07 | SR-6, SA-9 |
| Access controls and least privilege for agents and APIs (5.16, 5.22) | PR.AA-05 | AC-6 |
| Logging and monitoring (5.23) | DE.CM-09 | AU-2, CA-7 |
| Change management (5.25) | PR.PS-01 | CM-3 |
Common failure patterns
- Inventory built from projects, not discovery: AI switched on inside SaaS tools never reaches the register, leaving shadow AI outside appetite.
- Agents running on shared or human credentials: actions cannot be attributed and the kill switch cannot isolate one agent.
- Accepting vendor self-attestation: the response to feedback says self-attestations are not sufficient where transparency is limited.
- Rating residual instead of inherent risk: high-materiality requirements are triggered by inherent risk, so strong controls do not move a use case out of independent validation.
- Kill switch on paper only: untested activation protocols fail when credentials, queues and downstream jobs keep running.
- Treating 2028 as the start date: lifecycle controls take a year or more to build and must already cover high-risk use cases deployed before then.
Practitioner checklist
- Document basic versus full regime and name the accountable senior manager.
- Put AI risk into the board-approved risk appetite statement before October 2027.
- Designate the control function that decides what is AI and approves materiality ratings.
- Run discovery for embedded vendor AI and shadow AI, not just internal projects.
- Add agent identifier, tool access, components and guardrails to every agent inventory entry.
- Give each agent a unique, least-privileged identity and review its tool scopes quarterly.
- Arrange independent validation and tested kill switches for high-risk use cases.
- Update vendor contracts for AI change notification and audit rights.
- Track MAS's 2027 agentic AI consultation and update controls when it lands.
Standards and references
- MAS: Guidelines on Artificial Intelligence Risk Management for Financial Institutions
- MAS: Guidelines on Artificial Intelligence Risk Management (PDF)
- MAS: Response to Feedback Received on Guidelines on AI Risk Management
- MAS: Media release, supervisory expectations on responsible AI adoption
- Allen & Gledhill: MAS publishes AI risk management guidelines
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
Related NHI Mgmt Group resources: MAS Technology Risk Management Guide · AI Agents in Financial Services Security Guide · Singapore Model AI Governance Framework for Agentic AI Guide · Agent Identity and Access Guide. This guide summarises the MAS Guidelines on Artificial Intelligence Risk Management and is not legal advice.