The Monetary Authority of Singapore (MAS) has issued a comprehensive regulatory framework that effectively ends the era of outsourced liability for artificial intelligence in the financial sector. Released on 7 October 2026, the directive mandates that financial institutions remain fully accountable for any AI systems embedded within their services, regardless of whether the technology is developed internally or procured from third-party vendors.
Under the new requirements, firms must conduct rigorous evaluations of risks associated with external AI deployments, including those designed, operated, or maintained by outside entities. According to the official guidance, institutions are expected to secure sufficient assurance from their providers to verify that third-party AI remains suitable for its intended operational use. Where technical constraints or information gaps persist, firms must implement compensating controls to mitigate potential vulnerabilities effectively.
The framework establishes a clear escalation path for risk management, requiring firms to restrict, pause, or replace external AI services if the associated risks exceed the institution’s defined tolerance levels. This policy shift forces banks to treat AI supply chains with the same level of scrutiny applied to traditional critical infrastructure or financial clearing systems. The rules take effect on 7 October 2027, with a mandatory deadline for full compliance set for 7 October 2028.
Operational compliance requires a systematic approach to AI governance across the entire organization. Institutions must maintain up-to-date inventories of all AI applications, grade the risk profile of each individual deployment, and apply safeguards that scale in proportion to the identified threats. These mandatory safeguards encompass a wide array of technical domains, including data governance, stress testing, human-in-the-loop oversight, cybersecurity protocols, and rigorous change management procedures.
MAS has specifically highlighted the rise of agentic AI—systems capable of autonomous action and tool utilization—as a primary area of concern. The regulator plans to solicit industry feedback in 2027 to refine specific guidance for these highly autonomous models. Boards of directors and senior leadership teams are now explicitly tasked with defining roles, accountabilities, and risk appetite, ensuring that AI governance is integrated into existing corporate structures rather than siloed in isolated committees.
Ho Hern Shin, deputy managing director at MAS, emphasized that the framework is intended to foster sustainable innovation by providing clear regulatory boundaries.
With greater regulatory clarity on financial institutions’ AI usage, financial institutions can innovate with confidence, while maintaining the trust of customers and the resilience of Singapore’s financial system. MAS will continue to work with the industry to advance sound AI risk management practices in a practical and industry-grounded manner.
This statement underscores the regulator’s intent to balance technological advancement with the preservation of systemic stability.
The policy arrives against a backdrop of intensifying global scrutiny regarding the safety of frontier AI models. Recent comments from Josephine Teo, Minister for Digital Development and Information, suggest that current safeguards employed by many AI developers remain insufficient given the inherent risks of advanced systems. By forcing banks to take ownership of their third-party dependencies, MAS is shifting the burden of verification from the vendor to the financial institution.
This regulatory move signals a departure from passive reliance on vendor-provided compliance documentation. Financial institutions must now develop internal technical expertise to audit the black-box nature of many commercial AI models. The requirement for periodic review ensures that as AI systems evolve and gain greater autonomy over decision-making processes, the corresponding risk management frameworks remain dynamic and responsive to new threat vectors.
Market participants should prepare for a period of intensive auditing as they map their AI dependencies against the new MAS standards. The focus will likely shift toward interoperability and transparency in vendor contracts, as banks demand deeper access to the underlying logic and training data of the AI tools they procure. Future regulatory milestones will center on the 2027 consultation phase, which will likely set the tone for how autonomous agentic systems are integrated into the broader financial ecosystem.