Singapore's New AI Risk Guidelines for Banks and Insurers: What MAS Expects

By Rowan Ashby | October 20, 2026 | Data as of October 20, 2026

For informational purposes only, not financial advice. This article is for general information and education only. It is not financial, investment, legal or tax advice, and it does not take into account your personal circumstances. Bullquill is an independent publication, not a licensed financial adviser, broker or financial institution. Information is accurate to the best of our knowledge as of the date shown and may change. Always check primary sources and consider speaking to a licensed professional before making financial decisions.

What happened

On October 7, 2026, the Monetary Authority of Singapore (MAS) issued Guidelines on Artificial Intelligence Risk Management for financial institutions. According to the guidelines page and the guidelines document:

• Who: all MAS-regulated financial institutions, from banks and insurers to capital markets firms, financial advisers and payment service providers.
• What: all forms of AI, explicitly including generative AI and AI agents (paragraph 1.5).
• When: effective October 7, 2027, with some sections phased in until 2028 (paragraph 1.8).

MAS first consulted on a draft from November 13, 2025, to January 31, 2026, and published a response to feedback alongside the final text.

What the guidelines expect

The document has six sections. In our reading, the core expectations are:

Oversight (Section 3). The board, or a delegated committee, approves the firm's AI governance approach, risk appetite and roles; senior management runs the framework. Firms can use a central AI function or existing risk functions (paragraphs 3.3–3.5), and MAS's release confirms a dedicated AI committee is not required.

Knowing where AI is used (Section 4). Firms should identify AI across the business, including AI inside vendor products, keep an inventory, and rate each use's risk on at least three dimensions: impact, complexity and reliance (paragraphs 4.2–4.13).

Life cycle controls (Section 5). These span data management, explainability, fairness, human oversight, testing, cybersecurity, pre-deployment review (independent validation for high-risk uses), monitoring, change management and decommissioning, plus contingency plans and kill switches for high-risk uses.

Third-party AI. A firm "retains primary accountability" for AI it obtains from vendors (paragraph 5.11). Where a vendor tool's residual risk stays above what the firm is willing to accept, the guidelines say it "should consider limiting or suspending the third-party AI service, or replacing the relevant third-party provider."

Proportionality (Section 2). Low-stakes uses, such as drafting customer emails or summarizing internal documents with human review, may need only basic AI governance (paragraphs 2.3–2.4).

People and infrastructure (Section 6). Skills and technology capacity should match the firm's AI risks.

MAS's release adds that "In 2027, MAS intends to further consult the financial sector on what additional guidance on agentic AI would be useful."

The timeline

Analysis: The draft proposed "a transition period of 12 months after the Guidelines are issued" (consultation paper, paragraph 4.7). The final text keeps that start date but allows about two years for the life cycle and capability sections.

Why it matters

The document sets out "MAS' supervisory expectations relating to AI risk management" (paragraph 1.1). Analysis: It is the yardstick supervisors are likely to use when reviewing how firms deploy and control AI, including tools bought from vendors.

It also fits a global trend. On October 15, 2026, the Financial Stability Board (FSB) published its final report on sound practices for the responsible adoption of AI, setting out 12 practices that it describes as a "practical toolkit" for financial institutions.

MAS Deputy Managing Director Ho Hern Shin said "AI has significant potential to improve financial services" and that the guidelines aim to help financial institutions "innovate with confidence, while maintaining the trust of customers" (MAS release).

What it means for readers

Analysis.

• Customers in Singapore: the guidelines create no new consumer rights on their own. They raise the internal bar for how firms inventory, test and oversee the AI behind their services.
• Finance and fintech professionals: the immediate work is mapping AI use (including in vendor products), rating materiality and documenting controls. Vendors serving Singapore-regulated firms may face more assurance requests.
• Elsewhere in Southeast Asia: regulators take different approaches. Indonesia's POJK 6/2026, for example, addresses a different issue: how publishers of financial information, including AI-assisted content, must behave.

Sources

All accessed October 20, 2026.

1. Monetary Authority of Singapore, "MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions," October 7, 2026.
2. Monetary Authority of Singapore, Guidelines on AI Risk Management for Financial Institutions (page) and PDF, October 7, 2026.
3. Monetary Authority of Singapore, Consultation Paper P017-2025 (page) and PDF.
4. Monetary Authority of Singapore, Response to feedback received, October 7, 2026.
5. Financial Stability Board, "FSB finalises sound practices for the responsible adoption of artificial intelligence (AI)," October 15, 2026, and the final report.
6. Otoritas Jasa Keuangan, POJK 6/2026 (Indonesian).