The report
Singapore's Monetary Authority finalized its AI Risk Management Guidelines on October 7, extending supervisory expectations across regulated financial institutions and their use of autonomous AI. The approach is risk-proportionate and holds institutions accountable for outside AI services. It is final guidance, but the requirements have two different implementation deadlines.
The MAS announcement says Sections 3 and 4 should be met from October 7, 2027, while Sections 5 and 6 may be implemented by October 7, 2028. The latter phase is not an extension of the whole framework's start date. The guidelines cover all forms of AI, including systems that can autonomously use tools and take action, while allowing simpler governance when an AI failure would not materially affect customers, the institution or counterparties.
Accountability survives outsourcing
Institutions are expected to identify AI use cases, maintain inventories at an appropriate granularity and evaluate risk throughout the system lifecycle. Board and management accountability, data governance, testing, human oversight, cybersecurity and ongoing monitoring all feature in the guidance. MAS does not require a new AI committee if an existing structure provides effective coordination.
For a model or agent supplied by another company, the regulated institution still must assess the arrangement, seek assurance and add controls where necessary. MAS says an institution should consider restricting, suspending or replacing a third-party AI service if material risk cannot be contained within its appetite. This matters when an agent is permitted to access records, choose an operation or initiate a payment: outsourcing inference does not transfer the bank's responsibility for the effect.
MAS plans a further 2027 consultation on agentic-AI-specific guidance, but that is not the first time agents enter the regulatory scope. The related agent trust-boundary case offers an illustration of consequential tool authority, not evidence of a Singaporean institutional breach or enforcement action. The final MAS record documents the expectations; operational compliance at any particular institution remains unmeasured.