Financial institutions must remain accountable for use of third-party AI tools: MAS

SINGAPORE - Financial institutions here relying on artificial intelligence tools such as chatbots must remain accountable for any unintended consequences such as data leaks or inaccurate information, even if a third-party had built the software.

New guidelines for AI use in the financial sector were published by the Monetary Authority of Singapore (MAS) on Oct 7, which sets regulatory expectations on how institutions such as banks and insurers should manage risks from AI use.

The new guidelines, which will be effective in phases starting from Oct 2027, come amid intense debates over the safety and regulation of advanced frontier AI models that have autonomous abilities.

“Financial institutions remain accountable for AI used in the services they deliver, including AI developed, operated, or provided by third parties,” MAS said in a statement on Oct 7.

It added that institutions should assess factors such as model transparency, explainability and contingency plans in case of unexpected behaviour, before deciding to use third-party AI tools.

The guideline also highlights rules regarding the need for human oversight, inventories that track various AI use cases, and how safeguards can be applied in a risk-proportionate manner.

This follows a period of public consultation in November 2025, during which respondents had sought clarity on whether institutions could tap on existing governance structures to manage AI risks, how they should manage risks from embedded AI, and whether basic AI governance policies would suffice.

The newly-issued guidelines clarified that basic AI governance policies - such as restricting the input of confidential or client information - are sufficient when the poor performance of AI services are unlikely to have an material adverse impact on the company, its customers, or stakeholders.

This includes AI use for drafting and proofreading e-mails, summarising internal meeting notes, and designing marketing materials.

The board and senior management must be responsible for regularly reviewing the policies and risks regarding AI use, and establishing clear internal reporting processes for managing incidents that occur from AI use.

“Existing governance structures may be used where they provide adequate oversight and cross-functional coordination, and financial institutions need not establish a dedicated AI committee solely to meet this expectation,” said MAS in its media statement.

Other top-line rules include the need for an “inventory” of the various ways that AI is used by the institution. The inventory should have details of the systems and models in use such as the approved modes of use, training data involved and the humans accountable.

Risks assessments also need to be conducted, considering factors such as the potential consequences of poor AI performance and the extent of autonomy granted to the AI system.

Proportionate controls can then be applied according to the risk level, said MAS. For instance, AI that is used for credit decisioning, insurance underwriting, or other activities with high impact on customers will require more stringent scrutiny and robust controls.

Appropriate controls must also be implemented to mitigate harmful biases and discriminatory outcomes that might result from AI use, said MAS.

“For example, greater attention should be paid to AI used in areas such as credit decisioning and insurance underwriting that may lead to unfair access or denial of financial services or products offered to individuals,” it added.

Financial institutions are expected to adhere to rules spelled out in the guidelines in two phases.

From Oct 7, 2027, institutions must have their foundational governance systems ready, with an inventory of AI tools used and the ability to conduct risk assessments. From Oct 8, 2028, institutions must be able to rigorously test, monitor, and maintain strict human control over their AI systems, while securing the necessary skilled staff and technology infrastructure to operate them safely.

In 2027, MAS intends to further consult the financial sector on what additional guidance is needed for agentic AI use.

AI has significant potential to improve financial services by enhancing customer experiences, strengthening risk management, and creating new products, said MAS’ deputy managing director Ho Hern Shin.

“Realising these benefits sustainably requires financial institutions to understand and manage the risks that come with increasingly capable AI systems,” said Ho.

“With greater regulatory clarity on financial institutions’ AI usage, financial institutions can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore’s financial system.”