Monetary Authority of Singapore issues AI risk management guidelines for financial institutions

The Monetary Authority of Singapore issued new artificial intelligence risk management guidelines on October 7, 2026, to establish supervisory expectations for financial institutions. Under the guidelines, which take effect on October 7, 2027, and require full compliance by October 7, 2028, firms remain fully accountable for AI risks, including those from third-party providers. Financial institutions must implement risk-proportionate controls and ensure effective board oversight.

Timeline for implementing the guidelines

• ▪Financial institutions may implement the guidelines in phases, meeting expectations for Sections 3 and 4 by October 7, 2027, and Sections 5 and 6 by October 7, 2028.
• ▪Following a November 2025 public consultation, the Monetary Authority of Singapore issued Guidelines on Artificial Intelligence Risk Management on October 7, 2027, to establish supervisory expectations, with full compliance required by October 7, 2028.

Governance and oversight of artificial intelligence

• ▪Financial institutions are not required to establish a dedicated artificial intelligence committee if their existing governance structures provide adequate oversight and cross-functional coordination.
• ▪The board and senior management of financial institutions must provide effective oversight of artificial intelligence risks by establishing clear roles, responsibilities, risk appetite, and risk management frameworks.

Risk-proportionate management of artificial intelligence

• ▪Financial institutions are expected to manage artificial intelligence risks at both the enterprise level and for individual use cases, maintaining inventories and reviewing controls regularly as the technology evolves.
• ▪Financial institutions must apply the guidelines in a risk-proportionate manner, implementing controls such as data governance, testing, human oversight, cybersecurity, monitoring, and change management based on their risk exposure.

Managing third-party artificial intelligence risks

• ▪Financial institutions remain fully accountable for artificial intelligence used in their services under the new guidelines, even when the technology is developed, operated, or supplied by third-party providers.
• ▪Financial institutions must obtain sufficient assurance from third-party providers, assess suitability, and apply compensating controls or consider limiting, suspending, or replacing third-party artificial intelligence services if risks exceed their risk appetite.

Addressing frontier artificial intelligence risks

• ▪The Monetary Authority of Singapore and the Association of Banks in Singapore formed the AI-Driven Cyber and Technology Risk Taskforce in July 2026 to strengthen collective cyber and technology resilience against frontier artificial intelligence risks.
• ▪In 2026, Singapore's Minister for Digital Development and Information Josephine Teo stated that safeguards implemented by frontier artificial intelligence companies are insufficient to address risks from increasingly capable systems.

Debatable claims

• ▪A one-year timeline for full AI risk compliance is unrealistic for financial institutions
• ▪Flexible risk-proportionate guidelines are insufficient to prevent systemic AI financial crises
• ▪Existing corporate governance structures are inadequate for managing complex AI risks
• ▪Financial institutions should bear full liability for third-party AI failures