MAS AI Governance

MAS AI Risk Management Guidelines: Frequently Asked Questions

Straight answers on the MAS AI Risk Management Guidelines, final since 7 October 2026, and what they ask of MAS-licensed financial institutions: who is in scope, what changes, and how to be ready before they take effect.

Are the MAS AI Risk Management Guidelines mandatory yet, and when do they take effect?

They are final. MAS issued the Guidelines on 7 October 2026. The core expectations, AI oversight, the AI inventory and the risk materiality assessment, take effect on 7 October 2027, and the fuller life cycle controls, capability and capacity expectations by 7 October 2028. The dates are fixed, and a credible governance record takes longer than a year to build from nothing, so the time between now and 7 October 2027 is a build window, not a grace period.

How long do MAS-licensed firms have to comply with the AI Risk Management Guidelines?

The Guidelines are final and the deadlines are set: 7 October 2027 for AI oversight, the AI inventory and the risk materiality assessment, and 7 October 2028 for the fuller life cycle controls. It can sound generous, but it is a build window rather than a grace period. Identifying every AI use, assessing each one, putting proportionate controls in place and evidencing them over time is not a task that fits into the final months. Firms that use the time to build a record arrive ready; firms that treat it as a delay spend it catching up.

Do the MAS AI Risk Management Guidelines apply to all MAS-licensed financial institutions in Singapore?

Yes. The Guidelines are intended to apply to all financial institutions licensed or regulated by MAS, including banks, capital markets intermediaries, fund managers, financial advisers, insurers and payment service providers. There is no size exemption. What scales with the size and nature of a firm is the depth of what is expected, not whether it is in scope.

What do the MAS AI Risk Management Guidelines require of small MAS-licensed financial institutions?

Less than a large bank, but not nothing. The Guidelines apply proportionately, based on the materiality of each AI use rather than a single firm-wide rating. A small licensed firm whose AI use is limited to assistive tools still needs a baseline: rules on what staff may and may not do with AI, clear ownership, an inventory of the AI in use, and a light assessment of each use. What it does not need is the full weight of controls designed for a high-risk model. The obligation follows the use, not the firm.

Do the MAS AI Risk Management Guidelines apply to fund managers in Singapore?

Yes. A MAS-licensed fund manager is within the scope of the Guidelines, and most fund managers already use AI across research, portfolio work, investor communications and operations, often through vendor tools. Each of those uses is expected to be identified, assessed for materiality and governed proportionately. Where a fund's board is separate from its manager, the accountability sits with the licensed manager, and the board's role is to ensure the manager can demonstrate that governance.

Do the MAS AI Risk Management Guidelines apply to private equity and venture capital fund managers?

Yes, in the same way as any other MAS-licensed fund manager. Deal teams using AI to screen targets or draft memos, operations teams using it to reconcile data, and investor-relations teams using it to prepare communications are all AI uses within scope. Most of this AI is accessed through third-party tools, which brings the third-party expectations into play: the firm remains accountable for AI it procures, and vendor diligence now needs an AI lens as an ongoing part of vendor management, not a one-off check.

Do the MAS AI Risk Management Guidelines apply to payment service providers?

Yes. Payment service providers licensed by MAS are within scope, and they tend to sit at the sharper end of the Guidelines because so much of their AI runs high-volume automated decisioning: transaction monitoring, fraud detection, screening and onboarding. Those are uses that affect people at scale, which is exactly where the Guidelines place the most weight on fairness, explainability, human oversight and ongoing monitoring.

Do the MAS AI Risk Management Guidelines cover third-party AI tools and vendor models?

Yes, and this is the point most firms underestimate. The Guidelines apply to AI that a licensed firm uses, develops, procures or deploys, which includes third-party tools, cloud AI services and vendor models. Crucially, accountability does not transfer with a contract. A firm using a vendor's model is still expected to test it in its own context, on its own data, with compensatory testing where the vendor discloses little, and to maintain oversight and contingency arrangements. The vendor's assurances inform the firm's record; they do not replace it.

Do the MAS AI Risk Management Guidelines cover staff use of ChatGPT and other public AI tools?

Yes. Staff using public generative AI tools for drafting, summarising or research is an AI use, and a licensed firm is expected to have a baseline in place for it even if that is its only AI: rules on what may and may not be entered into such tools, particularly customer or confidential data, clear ownership, and the use recorded in the firm's inventory. The obligation is light for low-materiality use, but it is not absent.

Can a financial institution delegate AI governance to its vendor under the MAS Guidelines?

No. This is the most common misreading of the Guidelines. Using a third-party AI provider does not move the accountability; it stays with the MAS-licensed financial institution. The firm is expected to conduct due diligence on the vendor, secure contractual protections, test the AI in its own use context, monitor it in operation and hold contingency plans for vendor failure or exit. “Our provider handles it” is not a position the Guidelines accept.

Do the MAS AI Risk Management Guidelines apply to generative AI and AI agents?

Yes. The Guidelines explicitly cover generative AI and AI agents, and MAS has confirmed to Parliament that agentic AI is in scope. Generative AI brings specific failure modes, such as hallucination and prompt injection, that testing is expected to address. For agents, autonomy is expected to be governed from the base level regardless of how material the use is judged to be: an agent should be identifiable, its authority defined and revocable, and its actions logged.

What is an AI risk materiality assessment under the MAS Guidelines?

It is the assessment of each AI use on three dimensions: its potential impact, its complexity, and how much the firm relies on its output. The result determines how much control a given use needs. The assessment is done per use case, so one firm can hold a low-risk internal tool and a high-risk decision model at once, each governed on its own terms. It is also expected to be revisited over time, since AI and its risks change, rather than completed once and filed.

What is an AI inventory and does MAS require one?

An AI inventory is a maintained record of every AI use in the firm, including AI accessed through vendor products and staff use of general tools, with details such as what each use does, the data it draws on, who owns it and its materiality. The Guidelines expect licensed firms to be able to identify where AI is used and to keep that inventory accurate and current. Supervisors are likely to ask for it early, because a firm that cannot say where its AI is cannot credibly govern it.

Which AI uses face the strictest requirements under the MAS AI Risk Management Guidelines?

AI that affects people. The Guidelines place the most weight on fairness, explainability and human oversight where an AI shapes a decision about a person, such as credit, pricing, suitability, onboarding or screening. Importantly, this is about the decision, not the customer. An internal model that ranks, prices or screens people carries these obligations even if no customer ever sees it.

What are the board's responsibilities under the MAS AI Risk Management Guidelines?

The board and senior management are accountable for AI risk. They are expected to set the firm's AI risk appetite, ensure AI is brought within the existing risk management framework, oversee material AI uses, and have breaches and material exceptions escalated to them. AI governance is treated as a board-level risk rather than a technology function, and boards are expected to have enough understanding of AI to exercise that oversight.

Can a Singapore branch rely on its parent's AI governance framework under the MAS Guidelines?

Partly. The Guidelines allow a Singapore branch or subsidiary of an overseas group to leverage its parent's AI risk management framework, provided that framework meets MAS's expectations. The accountability still sits with the MAS-licensed Singapore entity, and when MAS supervises, it supervises the licensed entity here. A group framework that does not map to MAS's expectations leaves the Singapore entity holding the gap.

What does MAS mean by AI governance in the AI Risk Management Guidelines?

Evidence, not policy. The recurring expectation is that a firm can show, with dates, that each control operated over time, not that it holds a document describing what it intends to do. A policy assembled the month before an inspection reads as exactly that. What is expected is a continuous, attributable record built as the AI runs, produced on request.

What is the difference between the MAS AI Risk Management Guidelines and the FEAT principles?

FEAT (Fairness, Ethics, Accountability, Transparency) is the set of principles MAS published in 2018 for the responsible use of AI in finance. The AI Risk Management Guidelines build on FEAT rather than replacing it, turning the principles into supervisory expectations: what a licensed firm is expected to have in place, across the whole AI life cycle, and how it is expected to evidence it. FEAT sets the values; the Guidelines set the expectations a supervisor will look for.

How do the MAS AI Risk Management Guidelines relate to MindForge and the Third-Party Risk Management Guidelines?

They form one picture. The MindForge handbook is industry-led guidance on operationalising the Guidelines, with particular attention to generative AI. The separate Third-Party Risk Management Guidelines apply alongside them wherever AI is procured from or outsourced to a third party. The AI Risk Management Guidelines set the supervisory expectations, MindForge helps firms implement them, and the third-party rules govern the vendor relationships that most AI now runs through.

How should a MAS-licensed financial institution prepare for the AI Risk Management Guidelines now that they are final?

Start building the record. Identify every place AI is used, including inside vendor products and staff tools. Inventory each use with an owner. Assess each use for materiality. Put proportionate controls in place and begin evidencing that they operate. The expectations are set and the clock is running to 7 October 2027, and because a defensible record is built over time rather than assembled on demand, the firms that start now are the ones that reach the deadline ready.

Governance Row is built around the MAS AI Risk Management Guidelines, so a MAS-licensed firm can register each AI use, assess it, and hold the evidence in one place.