Articles

Singapore’s AI Guidelines Turn Independent Review Into a Question of Who Sets the Risk Rating

MAS published its AI risk guidelines on October 7. The Register says the central bank wants all AI use cases independently reviewed, but the text reserves formal independent validation for high-risk...

October 8, 2026 14 Min Read
14

On October 7, the Monetary Authority of Singapore (MAS), which acts as both the country’s central bank and its financial regulator, published its Guidelines on Artificial Intelligence Risk Management. The Register’s report on them carries a headline saying the central bank “wants all FinTech AI use cases subject to independent review”. The documents are more layered than that. They ask for a pre-deployment review by people who were not involved in building the system, but they reserve what MAS calls formal independent validation for use cases rated high risk, and they leave each firm to decide which of its use cases earn that rating.

Table Of Content

That layering matters for anyone building AI for a Singapore financial institution (FI) or selling to one. This piece reads the guidelines against MAS’s response to feedback and the November 2025 consultation draft, to separate what the rule says from what the headline compresses and to lay out which tier and which date applies to what.

What MAS published

MAS released three documents together: the 30-page guidelines, a response-to-feedback paper of more than 50 pages that answers industry comments on the November 2025 draft, and a media release. The guidelines set out “MAS’ supervisory expectations relating to AI risk management in financial institutions”. They complement existing rules rather than replace them: the 2018 Fairness, Ethics, Accountability and Transparency (FEAT) principles, for example, “continue to apply”. The text runs through six sections: introduction, application, AI oversight, key risk management systems and policies, AI life cycle controls, and AI capability and capacity.

The text speaks of financial institutions, “defined in Section 2 of the Financial Services and Markets Act 2022”, not of FinTech as a category. The guidelines apply on a group basis to locally incorporated FIs that are subject to consolidated supervision by MAS or that own critical information infrastructure, and a footnote says the first group includes locally incorporated FIs from the banking and insurance sectors. “AI” covers systems that derive outputs through learned premises such as the data or inputs they receive, including generative AI and AI agents, while rule-based systems, tools driven by explicit manual formulae, and robotic process automation that follows fixed instructions “would not ordinarily be considered AI”. MAS’s release adds that FIs need not set up a dedicated AI committee solely to meet the oversight expectation, and notes that the Financial Stability Board has also consulted on sound practices for responsible AI adoption.

Reading the headline against the text

Two statements in the coverage deserve a closer look: that independent review applies to all use cases, and that the guidelines “come into force on October 7, 2027”. Both are accurate for part of the text and incomplete for the rest.

What the coverage says What the MAS text says Reference
Independent review for all use cases Before deployment, an FI should subject the use case to “reviews by parties not involved in its development”, with scope and independence “proportionate to the AI’s assessed risk materiality”. Only use cases assessed as high risk “should undergo formal independent validation”. Lower-risk ones may get “other forms of documented review”, such as peer review by qualified people who were not involved in development or deployment. MAS says so directly: “Formal independent validation is not expected in all instances”. Guidelines 5.18 to 5.20; response paper 10.54
The guidelines “come into force on October 7, 2027” That is the effective date, but FIs “may meet the expectations set out in Sections 3 to 4 from 7 October 2027, and Section 5 and 6 of the Guidelines by 7 October 2028”. The pre-deployment review sits in Section 5. For high-risk use cases, MAS says firms should apply lifecycle controls “as soon as possible, and not delay application until the end of the 24-month transition period”. Guidelines 1.8; response paper 13.5

In fairness to the report, the rest of it tracks the documents closely, including the third-party accountability line, the inventory expectation and the contingency-plan requirement. The compression is in the word “all” and in the single date.

Three levels of scrutiny, not one

Basic governance for assistive tools

A firm whose AI use is limited to assistive tools can stay on “basic AI governance policies and procedures”. The test is whether “the poor performance or unavailability of the AI services or tools used by the FI is unlikely to have a material adverse impact on the FI, its customers or other stakeholders”. Paragraph 2.4 lists examples that would generally qualify: drafting or proofreading customer emails, summarising documents or meeting notes, generating formulas, charts or visualisations, designing marketing material with AI image generators, and “AI-powered chatbots to assist personnel in locating relevant internal resources, such as policies or procedures”. A footnote adds that humans in these cases should be reviewing and checking the outputs before use.

“Basic” still means something. Paragraph 2.5 asks for clear accountability, such as a designated senior manager; permitted and prohibited uses, with prohibitions on putting confidential or client information into public AI tools given as an example; an approved list of AI tools with a process for requesting new ones; staff education; regular compliance checks; and a periodic check that the firm still qualifies. The response paper says this tier should be in place within 12 months, and that the expectation reaches firms that have not adopted AI at all, which should have policies on “whether and how AI may be used by staff” to manage unauthorised use such as shadow AI.

The response paper treats this as a firm-level choice: an FI that meets the test may apply basic policies, and otherwise it should implement “the full set of expectations set out in Sections 3 to 6”. Inside the full regime, controls are then calibrated use case by use case.

A documented review for every other use case

Inside the full regime, paragraph 5.18 is the provision the headline is about. Before deployment, the use case and its underlying models get reviewed by people who were not involved in developing them, to confirm that controls such as evaluation and testing were followed. Below the high-risk line, MAS accepts “other forms of documented review” (5.20). Findings, limitations and conditions of use go to an approval body that must make sure the recommendations are acted on (5.21), and a separate technology and cybersecurity review checks that the system can be deployed “in a controlled and secure manner” (5.22).

Formal independent validation for high-risk use cases

For use cases assessed as high risk, paragraph 5.19 asks for validation by “competent personnel or functions possessing the necessary expertise and objectivity, and who are independent from the development and deployment teams”. The validation “should provide effective challenge to developers” and “should cover areas relevant to the AI use case”, such as:

  • the conceptual soundness of the design;
  • the suitability and quality of data inputs;
  • the integrity of the implementation;
  • evaluation measures, performance thresholds, testing approaches and results;
  • explainability analysis and fairness assessments; and
  • assumptions, limitations and mitigants.

The response paper answers the practical objections. MAS “does not prescribe the function or party that must conduct formal independent validation”, so a firm may engage external expertise provided the validator has “sufficient expertise and independence from the development and deployment teams” (10.55). Independence does not require isolation: validators may talk to developers “to understand the use case, clarify documentation or replicate results”, but must “exercise independent judgement and retain responsibility for the validation conclusions” (10.56). If a firm cannot assemble such a validator for a high-risk use case, it “should consider whether the risks of the use case can be reduced through changes to its design, scope or deployment” and, failing that, “assess whether it is appropriate to proceed with deployment” (10.57). Pilots are not exempt, because validation applies “irrespective of whether such use cases are pilots or partial deployments” (10.79), and high-risk use cases are re-validated by independent parties on a regular basis (5.24).

The pivot is the risk rating

The split between documented review and formal independent validation hangs from one input: the risk materiality rating of the use case. Paragraph 4.12 says the assessment should minimally consider three dimensions. Impact is the consequence of failure for the FI, its customers and other stakeholders, including the sensitivity of the data. Complexity covers the technology, the novelty of the application, the data and how explainable the outputs are, plus, for third-party AI, how much visibility the firm has. Reliance is how far the decision or output depends on the AI, including the autonomy granted and the degree of human oversight. Paragraph 4.11 asks for both an inherent rating before controls and a residual rating after them, with the residual risk within appetite before deployment.

Who assigns the rating

Paragraph 4.13 says a control function “should be designated to establish the risk materiality assessment framework, and to arbitrate or approve the risk materiality of an AI use case”. Business units can do the work, but the designated function must keep “sufficient and independent oversight” so the process is applied consistently. MAS then declines to supply the calibration. In the response paper it says it will neither prescribe a formula for combining the three dimensions nor define a universal threshold for a high rating, and that an FI “has flexibility to determine how the respective risk dimensions are weighted or combined” (7.19).

What MAS offers instead are relative illustrations (paragraph 7.18), which it says “are intended to be read as relative comparisons” and “do not imply or prescribe any specific absolute rating”:

Dimension Could be assessed higher Could be assessed lower
Impact AI for credit scoring AI for personal productivity, such as internal document summarisation
Complexity Generative AI systems provided by third parties Regression-based AI models developed internally by the FI
Reliance AI for automated trade execution AI that helps recommend responses to consumer queries, with staff reviewing each recommendation

Two details about inherent and residual risk

First, the requirements specific to high-risk use cases (the question put to MAS named independent validation and contingency plans) “are to be applied based on inherent risk materiality” (7.21). A firm cannot argue a use case down a tier by pointing to the controls it plans to add. Second, MAS will not prescribe how residual risk is assessed (7.22), which leaves that method to each firm’s existing frameworks.

My reading is that this is where supervisory attention is most likely to gather. The guidelines do not say how MAS will test a firm’s ratings, and the text offers no numeric boundary. What it does offer is an order of work: the identification, inventory and risk materiality assessment that make up Section 4 are due a year before the Section 5 controls, so every firm in the full regime will have to produce its ratings, and the control function behind them, first.

What changed from the November 2025 draft

MAS issued its consultation paper on November 13, 2025, and the consultation closed on January 31, 2026. The release says MAS kept the key expectations and refined them in response to feedback. Three of the changes bear on the points above.

Topic November 2025 draft October 2026 guidelines
Who faces the full regime The full expectations applied only to firms using AI as an integrated part of their business processes, judged by operational dependence. The draft’s annex listed an internal IT helpdesk chatbot among integrated uses. A few respondents objected that the test could catch firms using only low-risk productivity tools such as Microsoft Copilot. A materiality test: basic governance if poor performance or unavailability is unlikely to have a material adverse impact, otherwise Sections 3 to 6, calibrated by risk materiality.
Transition 12 months for everything. 12 months for Sections 3 and 4 and the basic tier, 24 months for Sections 5 and 6, with high-risk lifecycle controls as soon as possible. Many respondents had asked for more time, most commonly 18 to 24 months.
Reliance Included the availability of alternatives. Removed as a sub-dimension, although fallback options are still expected for high-risk use cases.

Third-party AI: the part vendors will feel first

Section 5 and the response paper put more weight on third-party AI than the headline suggests, and several provisions read as a checklist for AI vendors selling into Singapore.

The firm stays accountable

Paragraph 5.11 says the FI “retains primary accountability for its use of third-party AI”. The response paper presses the point against the argument, raised by a few respondents, that model safety, security and training data quality should sit with the provider: “even where an FI may not be in a position to influence or compel third-party AI providers to employ robust AI risk management practices, the FI remains accountable for how third-party AI is used within its organisation” (9.3). If the risks cannot be brought within appetite, the FI “should consider limiting or suspending the third-party AI service, or replacing the relevant third-party provider” (9.5). The guidelines also list over-reliance on a few dominant generative AI providers as a risk (1.10) and make concentration risk one of the considerations at onboarding (5.11).

Independent assessments yes, self-attestation no

Respondents asked MAS to let firms rely on standardised certifications such as ISO 42001, or to create a “safe harbour” with relaxed requirements for AI from reputable providers (9.7). The response does not grant one: the FI “remains responsible for managing the risks arising from such use” (9.8). MAS agreed that where transparency is insufficient an FI “may consider relying on certifications or external assessments”, but only if the assessor has the expertise, is independent of the provider and covers the key risks. Reliance on provider self-attestations, particularly when unsupported by evidence, “would generally not be considered as effective approaches to address limitations in transparency” (9.9).

Test it on your own data

Paragraph 5.10 expects “testing third-party AI services in the context of the FI’s use cases (including using the FI’s own data)” and “performing compensatory testing to address informational gaps arising from inadequate disclosures by third-party AI providers”, with documentation of how the firm decided the AI was suitable. A vendor-commissioned review can count as a “documented review”, but it counts as formal independent validation only if the FI can determine that the reviewer had the necessary expertise and independence from the provider’s own development and deployment teams, and the FI must still test on its own data (10.58). In practice, that makes a vendor’s red-team report a useful input and not a substitute.

Vendor updates and embedded AI

Vendors that change models underneath a deployed use case get specific treatment. MAS “does not expect an FI to establish processes to receive and assess all updates or changes to third-party AI in all circumstances” (9.13), but contracts should give “a risk-proportionate degree of visibility into updates or changes to third-party AI that could reasonably be expected to affect the continued performance, behaviour or risk profile of the AI use case” (9.14). For high-risk use cases, where significant vendor-driven updates may proceed “without an FI’s knowledge or prior assessment”, the firm should apply “compensating controls such as enhanced monitoring” (10.74).

The same visibility problem applies to AI the firm did not buy as AI. Identification must “minimally cover” AI in services from material third-party providers (4.2), and where providers do not disclose embedded AI the firm should identify the risks that constraint creates and put mitigating measures in place (4.4). MAS says those difficulties “do not by themselves justify excluding embedded AI or shadow AI from the AI identification process in all instances” (response paper 6.5), while also noting that providers of third-party AI “would not automatically be classified as providing a material outsourcing arrangement” (9.21).

This is the assurance gap that a vendor’s own disclosures can open. When OpenAI launched its always-on dots agents, we reported that it said it was still addressing known vulnerabilities. A Singapore FI weighing a comparable product for a high-risk use case would have to decide, under paragraphs 5.10 and 5.11, whether its own testing and compensating controls close that gap or whether to limit or suspend the service. Our earlier analysis of who is liable when AI agents go rogue covers the legal side of the same accountability question.

Agents: monitored now, regulated later

The guidelines name agents as an amplifier of existing risks. Paragraph 1.11 warns that an agent with access to tools “could autonomously execute unauthorised or erroneous actions that are not aligned with an FI’s business objectives or in a customer’s best interests due to a divergence between pre-defined goals and how the AI agent translated such goals into actions”, and that a compromised agent with access to internal systems could be used to exfiltrate sensitive data or run malicious commands at scale. Readers of our coverage of the OpenAI agent that, according to Australia’s prime minister, breached the country’s Medicare portal will recognise the shape of the first scenario, although the guidelines do not cite any incident.

The controls it asks for are concrete where they touch agents, even though no agent-specific rulebook exists yet:

  • Inventory. A footnote to paragraph 4.8 says inventory attributes for agents may include “agent-specific identifiers, information on the tools and systems the agent can access, its components, and the guardrails imposed to manage risk”.
  • Monitoring. Where relevant, monitoring should cover “information flow and decision-making paths across workflows that use AI, such as reasoning processes, actions taken, tools used” (5.23(a)), and documentation for generative AI or agents could include “logging prompts and model responses, together with applicable model versions and reasoning processes used” (5.23(d)).
  • Kill switches and fallbacks. For high-risk use cases the firm should have contingency plans with alternative systems or manual processes, and where a kill switch exists its activation protocol should be tested regularly (5.3). The response paper says contingency plans are expected for high-risk use cases and left to the firm’s judgment elsewhere (10.70).
  • Pilots. Guardrails for pilots should be “robustly designed and implemented, given the possibility for highly autonomous AI to devise ways to evade or circumvent these controls” (10.78).

What MAS postpones is the rulebook. The response paper says MAS “will not mandate specific testing techniques or minimum controls at this time” (12.7), points firms to the Infocomm Media Development Authority’s national agentic AI governance framework as a practical reference in the near term (12.9), and says it will consult the sector separately on more specific guidance. The release dates that consultation to 2027. For the containment-tooling side of the same question, see our report on NVIDIA’s open agent safety platform.

What is due, and when

Date What applies Reference
November 13, 2025 Consultation paper issued; the consultation closed January 31, 2026 Response paper 1.1 and 1.2
October 7, 2026 Guidelines and response paper published MAS media release
During 2027 MAS intends to consult the sector on additional agentic AI guidance MAS media release
October 7, 2027 Guidelines take effect. Sections 3 and 4 apply: oversight, plus identification, inventory and risk materiality assessment. The basic tier applies to firms that qualify Guidelines 1.8; response paper 13.5 and 13.6
As soon as possible Lifecycle controls for high-risk use cases, without waiting for the 24-month period Response paper 13.5
October 7, 2028 Sections 5 and 6 apply: lifecycle controls (pre-deployment review, third-party AI, monitoring, change management) and capability and capacity Guidelines 1.8

Open questions

  • Where is the high line? MAS declines to define it, so two firms can rate the same use case differently, and the documents do not say how ratings will be tested in supervision.
  • Who validates? Respondents said the expertise to assess a use case may sit mainly with the development team. MAS’s answer is to allow external validators and, failing that, to redesign the use case or reconsider deployment.
  • What counts as an adequate independent assessment of a model provider? The response paper sets criteria for the assessor and says the assessment should cover the key risks, but it does not specify a standard for assessing a frontier model provider.
  • What will the agent guidance add? Today’s text asks for inventories, monitoring and kill switches in general terms and leaves testing methods to firms.

The headline question, whether there is independent review, has a straightforward answer: yes, in graded form. The question the guidelines leave open is the one underneath it: who decides which grade a use case gets, and how hard anyone checks. For teams on either side of a Singapore FI’s AI contracts, that is the part to prepare for.

Sources

Tags:

Agentic AIAI GovernanceAI RegulationAI Risk ManagementSingaporeThird-Party Risk

Share

No Comment! Be the first one.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Posts