Financial institutions remain accountable for third-party AI under new MAS guidelines

SINGAPORE: Financial institutions will be expected to assess and manage risks from their use of artificial intelligence, including AI by third-party providers, under new guidelines issued by the Monetary Authority of Singapore (MAS) on Wednesday (Oct 7).

They also remain accountable for AI used in the services they provide even when the technology is developed, operated or supplied by a third party, MAS said.

“Financial institutions should obtain sufficient assurance from third-party providers, assess whether third-party AI is suitable for their intended use, and apply compensating controls where practical constraints or assurance gaps arise,” the central bank said in a media release.

If the risks still cannot be brought within the firm's risk appetite, it should consider limiting, suspending or replacing the third-party AI service.

The guidelines will take effect on Oct 7, 2027, with financial institutions allowed to implement them in phases and meet the full requirements by Oct 7, 2028.

Under the guidelines, financial institutions are expected to manage AI risks at both the enterprise level and for individual use cases, while building up their capabilities as their use of the technology expands.

They should identify their AI use, maintain inventories, assess the risk posed by individual use cases and put in place proportionate controls throughout the AI life cycle.

These include data governance, testing, human oversight, cybersecurity, monitoring and change management.

MAS said such controls should be reviewed regularly as AI use expands and the technology evolves, pointing to the growing use of agentic AI systems that can operate autonomously and access tools.

The authority plans to consult the financial sector in 2027 on what additional guidance on agentic AI would be useful.

GROWING AI RISKS

The new guidelines come amid growing scrutiny of the risks posed by increasingly capable and autonomous AI models.

Singapore is studying whether new safety measures are needed in high-risk uses of AI.

Minister for Digital Development and Information Josephine Teo said last week that safeguards put in place by frontier AI companies are insufficient to address the risks posed by increasingly capable systems.

MAS noted on Wednesday that AI technologies are developing rapidly and being adopted in financial services with increasing scale and sophistication.

This includes AI models and systems with greater autonomy in generating outputs, decision-making, or executing actions, the central bank said.

The new guidelines also require boards and senior management to provide effective oversight of AI risks, including by setting out clear roles and responsibilities, risk appetite and risk management frameworks.

Financial institutions will not, however, have to establish a dedicated AI committee if their existing governance structures provide adequate oversight and cross-functional coordination.

The guidelines were established following a public consultation in November 2025.

MAS deputy managing director Ho Hern Shin acknowledged that AI has “significant potential” to improve financial services, but noted that financial institutions need to understand and manage the risks that come with increasingly capable AI systems to reap these benefits sustainably. 

“With greater regulatory clarity on financial institutions’ AI usage, financial institutions can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore's financial system,” said Ms Ho.

“MAS will continue to work with the industry to advance sound AI risk management practices in a practical and industry-grounded manner.”