The Monetary Authority of Singapore (MAS) has issued its finalized Guidelines on AI Risk Management for financial institutions. The rules ask firms to manage risks across the full life of an AI system. They also cover risks that come from third-party providers.
The final version follows a public consultation held in November 2025.
Flexible rules, firm accountability
The guidelines let institutions scale their approach to match how much AI they use and how risky that use is. A small firm with limited AI exposure is not expected to build the same controls as a large bank.
Firms can also rely on the governance structures they already have. They do not need to set up dedicated AI committees.
MAS expects every institution to keep an inventory of its AI use. Controls should cover data governance, cybersecurity, testing, human oversight, monitoring and change management.
Third-party AI stays the firm’s responsibility
Institutions remain accountable for the AI behind their services. That includes systems built, run or supplied by outside providers.
Firms should get enough assurance from those providers. They should also check that the third-party AI suits its intended purpose. Where gaps in assurance or practical limits exist, MAS expects compensating controls.
If a risk cannot be brought within a firm’s risk appetite, MAS said the firm should consider limiting, suspending or replacing the service.
Phased rollout and agentic AI
Implementation will happen in stages. Sections 3 and 4 take effect on October 7, 2027. Sections 5 and 6 apply from October 7, 2028.
MAS also pointed to the growing use of agentic AI, meaning systems that can act on their own and use tools. The regulator plans to consult the financial sector in 2027 on what extra guidance would be useful.
Ho Hern Shin, Deputy Managing Director at MAS, said that realizing the benefits of AI sustainably requires institutions to “understand and manage the risks that come with increasingly capable AI systems.” She added that clearer regulation should help firms innovate with confidence. It should also support customer trust and the resilience of Singapore’s financial system.
Industry views on AI risk management
Outside Singapore, the debate over how tightly to regulate AI is moving in a different direction. OpenAI CEO Sam Altman told Politico’s Decoded that society should accept some harms from AI in return for much larger benefits. He named hacks and scams as costs that should not be removed at the price of stalling the technology. He also argued that heavy restrictions could concentrate power in a few companies, individuals or countries. Altman has said he supports tougher rules in specific high-risk areas, but he favors a lighter approach overall. His remarks came days after an OpenAI safety leader stepped down and called the company’s current trajectory unacceptable.
Reaction to Altman’s comments has been mixed. Critics on professional networks argued that the gains tend to flow to a small group of firms and investors, while the downsides fall on the public and on smaller institutions. Others said the stakes rise when AI moves into medicine, industrial controls or critical infrastructure, where errors can affect physical safety. Some commentators said that democratic rules, liability standards and design choices are still available tools. The wider debate also includes Anthropic CEO Dario Amodei, who urged the industry in September to ease the pace of capability gains so safety work could catch up. According to the same report, calls for coordinated restraint have found little traction among the governments best placed to enforce them.
