Key Takeaways
- On 7 October 2026, the Monetary Authority of Singapore (MAS) issued its Guidelines on AI Risk Management, the first comprehensive, Singapore-wide supervisory statement covering all financial institutions (FIs) and all forms of AI, including generative AI and AI agents.
- The Guidelines formalise a principle most institutions have treated informally until now: an FI remains fully accountable for AI it did not build, including AI developed, operated, or supplied by a third party.
- Obligations are proportional to use-case materiality, not uniform - but they are phased in on fixed dates: core oversight and inventory expectations apply from 7 October 2027, and life-cycle controls, third-party AI management and capability requirements follow by 7 October 2028.
- Most institutions' live AI-vendor relationships - procured over the past two to three years under innovation or efficiency mandates - have never been assessed against this standard, creating a compliance and governance gap that is now visible and dated.
- sourceCode's view: the proportionality principle is an invitation to start triage now, not a reason to wait until the deadline - institutions that build a materiality-based gap assessment this year will spend 2027-2028 remediating a known, prioritised list rather than discovering their exposure under supervisory pressure.
Introduction
Singapore's financial institutions did not wait for a regulator's permission to adopt AI. Generative AI copilots, vendor-supplied fraud-detection models, embedded AI in core banking and insurance platforms, and increasingly agentic workflows have been procured, piloted, and in many cases quietly scaled into production over the past three years - frequently under a vendor's or software-as-a-service provider's own model, with the FI's risk function brought in after the commercial decision, not before it.
MAS's Guidelines on AI Risk Management, published on 7 October 2026 following a public consultation that ran in late 2025, changes the terms of that arrangement - not by inventing new principles, but by making an existing one explicit, universal, and time-bound. The Guidelines apply to all FIs regulated by MAS and to all forms of AI technology, with generative AI and AI agents named specifically (MAS has also signalled a further 2027 consultation dedicated to agentic AI). Their central statement is unambiguous: FIs remain accountable for AI used in the services they deliver, whether that AI is built in-house or developed, operated, or provided by a third party.
That single sentence reframes a large share of existing AI vendor relationships as unassessed risk. The question this piece addresses is not whether the Guidelines are reasonable - they are, and they are closely aligned with how BIS, the Financial Stability Board (FSB), and Hong Kong's HKMA have been thinking about AI and third-party dependency - but what institutions that are already running live AI vendors should actually do between now and the first deadline, 7 October 2027.
Market Context: A Formal Standard Catches Up With an Informal Reality
The need for this kind of guidance has been building for some time. The FSB's October 2025 report to G20 finance ministers on AI and financial stability warned explicitly that generative AI's reliance on "a small number of key suppliers for specialised hardware, cloud infrastructure, and pre-trained models" creates concentration and substitutability risk across the financial system - vulnerabilities that compound when individual institutions treat each vendor relationship as a bilateral commercial matter rather than part of a system-wide dependency (Financial Stability Board, 2025). MAS's Guidelines are Singapore's answer to that same structural concern, translated into institution-level supervisory expectations.
Within Singapore specifically, the Guidelines sit on top of MAS's existing outsourcing and technology risk management requirements rather than replacing them - law firm commentary on the release is consistent on this point (Allen & Gledhill, 2026; Baker McKenzie, 2026). What is new is the explicit framing of AI, specifically, as a category requiring its own oversight, inventory, materiality assessment, life-cycle controls, and - critically for vendor-dependent institutions - third-party AI management as a named, dated obligation under Sections 5 and 6 of the Guidelines.
Regionally, Hong Kong's HKMA moved earlier on generative AI specifically, issuing guidance in 2024 on generative AI in customer-facing applications that emphasised explainability, hallucination risk, human-in-the-loop validation, and customer opt-out rights (HKMA, as reported by Fintech News Hong Kong, 2024). That guidance, however, was narrower in scope - focused on customer-facing GenAI and consumer protection - and did not address third-party AI vendor accountability with the same explicitness MAS now has. MAS's Guidelines are, in that sense, a step ahead regionally on the specific question this article addresses: who is accountable when the AI comes from outside the institution.
Why This Is Happening Now
Three forces converged to produce this Guidelines package in October 2026, rather than earlier or later.
First, the adoption curve itself. Generative AI and embedded vendor AI moved from pilot to production inside Singapore's financial sector faster than most institutions' third-party risk frameworks were built to absorb - procurement and business teams, not risk and compliance, were frequently the first to sign off on AI-enabled vendor contracts.
Second, systemic concern caught up with institutional practice. The FSB's 2025 work, and BIS commentary over 2024-2025, made the concentration and substitutability risk of AI supply chains a live financial-stability topic, not just a conduct-risk one. Regulators needed a framework that addressed both the individual institution's accountability and the system's exposure to a small number of AI infrastructure and model providers.
Third, MAS deliberately chose proportionality over prescription - and proportionality requires a dated, binary cut-over to be enforceable. A principle that says "do more if the risk is higher" needs a fixed point at which "doing enough" becomes assessable. That is what 7 October 2027 and 7 October 2028 provide.
The Proportionality Ladder: A Framework for Reading MAS's Expectations
The Proportionality Ladder is a practical way to translate MAS's principle - that the extent and sophistication of AI controls should match the risk materiality of the use case - into something an institution can actually assess, rung by rung, against every live or planned AI vendor relationship.
- Rung 1 - Low materiality, internal use. Productivity and internal-efficiency AI tools (document summarisation, internal search, developer assistance) where failure or unavailability has no material customer or market impact. MAS's Guidelines explicitly permit "basic AI policies and procedures" here.
- Rung 2 - Customer-facing, moderate materiality. Chat-based customer support, marketing content generation, and advisory-adjacent tools where errors are correctable and do not directly determine a financial outcome. Expectation: documented testing, human review protocols, clear usage boundaries.
- Rung 3 - Decision-relevant, high materiality. Credit scoring and underwriting inputs, AML/fraud detection, claims assessment, trading or pricing signals - use cases where AI output materially influences a financial decision about a customer or the institution. Expectation: full life-cycle controls, contractual visibility into model changes, independent testing on the FI's own data, contingency and fallback plans, senior management and board-level oversight.
- Rung 4 - Systemically material or concentrated dependency. Use cases built on AI infrastructure or models shared across many institutions (common cloud-hosted foundation models, shared fraud-utility AI), where the FSB's concentration-risk concern becomes directly relevant to a single institution's resilience planning. Expectation: explicit assessment of provider substitutability, exit planning, and engagement with MAS's broader outsourcing notice requirements.
The Ladder's purpose is not to replace MAS's text - institutions should work from the Guidelines directly - but to give risk and compliance teams a shared, defensible, use-case-by-use-case language for a gap assessment that starts before the 2027 deadline rather than at it.
What Most Institutions Get Wrong
Three patterns recur across institutions that have not yet assessed their AI vendor book against this standard.
The first is treating "the vendor is accountable" as a live assumption rather than a legacy one. Many AI-enabled SaaS and vendor contracts signed in 2023-2025 were negotiated under conventional outsourcing or software-licensing templates, with AI functionality added as a feature rather than a named risk category. MAS's Guidelines make clear that the FI's accountability does not depend on how the contract was originally framed.
The second is conflating "proportionate" with "optional." Proportionality is a calibration mechanism, not an exemption. A use case classified - even informally - as low-risk because it was procured for operational convenience may, on closer inspection, sit much higher on the Ladder than its original business case assumed (a "productivity" AI tool that quietly becomes an input into customer correspondence or decision support is a common example).
The third is assuming contractual leverage exists where it may not. "Sufficient assurance" and visibility into a provider's model changes are reasonable expectations when dealing with a boutique vendor; they are far harder to secure from a hyperscale cloud or foundation-model provider whose standard terms are largely non-negotiable for any single mid-sized institution. This is a genuine implementation gap the Guidelines do not resolve - proportionality tells an institution how much assurance to seek, not how to extract it from a vendor with disproportionate bargaining power.
Business Implications for Risk and Compliance Leaders
For Chief Risk Officers and Heads of Compliance, the Guidelines convert AI vendor oversight from a technology-governance footnote into a board-reportable accountability item with fixed dates. Three implications follow directly.
Inventory becomes a prerequisite, not a project. An institution cannot assess materiality, let alone remediate gaps, without a complete and current inventory of every AI use case - including those embedded inside third-party platforms that the business may not describe internally as "AI." Sections 3 and 4's 2027 deadline effectively requires this inventory to exist well before then, since materiality assessment depends on it.
Vendor management and model risk functions need to converge. In many institutions, third-party risk management and AI/model governance have developed as separate disciplines with separate owners. MAS's explicit linkage of third-party AI management to the broader AI risk framework (Sections 5-6) makes that separation a structural weakness going into 2028.
Board reporting needs a materiality-based narrative, not a tooling inventory. Boards will reasonably ask which AI use cases are high-materiality, what assurance exists for each, and what the fallback is if a vendor's AI becomes unavailable or non-compliant - questions the Proportionality Ladder is built to answer directly.
Technology and Operational Implications
Operationally, the Guidelines push institutions toward capabilities many have not yet built at scale: independent testing of vendor AI against the institution's own data (not just the vendor's benchmark results); contractual rights to visibility into material model changes; documented contingency plans for high-materiality use cases, including manual fallback where an AI dependency fails or is withdrawn; and AI capability and capacity within the institution itself - meaning in-house staff who can actually evaluate a vendor's AI claims, not just procure against a feature checklist.
From sourceCode's perspective, this last point is where many institutions are most exposed. In our experience working with BFSI environments across Singapore and the broader APAC and Gulf markets, the gap is rarely an absence of policy - most institutions already have model risk and outsourcing policies on paper. The gap is operational capacity: the in-house technical depth to independently test a vendor's AI against the institution's own data and risk appetite, rather than relying on the vendor's own assurances. That is a delivery and capability question as much as a governance one, and it is where an insourced, embedded technical partner adds more value than a point-in-time compliance review.
What Leaders Should Do Next
- Build the complete AI use-case inventory now, explicitly including every third-party and embedded-vendor AI feature, not just institution-built models.
- Apply the Proportionality Ladder to each use case to produce a prioritised, defensible materiality ranking - before, not during, a supervisory review.
- Audit existing vendor contracts for visibility and testing rights against Section 5-6 expectations, and flag where current terms fall short.
- Identify the Rung 3 and Rung 4 use cases first - these carry the highest compliance and business risk if remediation is left until 2028 - and build contingency plans for each.
- Assess internal AI evaluation capability honestly: can the institution independently test a vendor's AI claims today, or does that capability need to be built or sourced?
The Counterargument: Proportionality Cuts Both Ways
It is worth stating the nuance plainly rather than glossing over it. Proportionality, as a regulatory design choice, is double-edged. It rightly spares institutions from applying bank-grade model governance to a low-risk internal productivity tool. But it also creates room for institutions to classify a use case as low-materiality precisely because doing so avoids the cost of fuller controls - a self-serving materiality assessment is a real risk, not a hypothetical one, and MAS's Guidelines rely on the institution's own good-faith judgement to draw that line correctly. Nor does proportionality solve the bargaining-power problem described above: a principles-based standard does not change what a dominant AI infrastructure provider is willing to put in a contract. Institutions that treat the Guidelines as a compliance ceiling rather than a floor - doing only what the lowest defensible materiality rating requires - will have technically complied while remaining substantively exposed.
Conclusion
MAS's Guidelines on AI Risk Management do not introduce a new philosophy of accountability; they formalise one that regulators globally have been converging on since the FSB first flagged AI-related concentration risk in the financial system. What they add, specifically for institutions operating in Singapore, is precision: all FIs, all AI, explicit third-party accountability, and two fixed dates - 7 October 2027 and 7 October 2028 - against which "proportionate" controls will be judged. The institutions best positioned when those dates arrive will not be the ones that waited for supervisory guidance to arrive and then read it for the first time. They will be the ones that used the eleven months before the first deadline to build a materiality-based inventory of every AI vendor relationship they already run, and started closing the gaps the Proportionality Ladder reveals - starting with the highest rungs, not the easiest ones.
If your institution has live AI vendor relationships that predate a formal materiality assessment, a structured gap review now is considerably less costly than a remediation programme run against a 2027 or 2028 deadline. Request a MAS AI-readiness gap assessment from sourceCode to understand where your current AI vendor book sits on the Proportionality Ladder. Contact us here!
FAQ
What are MAS's new AI risk management guidelines? They are supervisory expectations, issued by the Monetary Authority of Singapore on 7 October 2026, covering how all Singapore-regulated financial institutions should govern AI risk - including AI developed, operated, or supplied by third parties - across oversight, risk materiality assessment, life-cycle controls, third-party AI management, and institutional capability.
When do the MAS AI risk management guidelines take effect? The Guidelines take effect on 7 October 2027 for oversight, accountability, inventory, and risk materiality assessment expectations (Sections 3 and 4). Life-cycle controls, third-party AI management, and capability expectations (Sections 5 and 6) apply by 7 October 2028.
Are financial institutions accountable for AI provided by third-party vendors under MAS's guidelines? Yes. MAS states explicitly that FIs remain accountable for AI used in the services they deliver, including AI that a third party develops, operates, or provides. This does not transfer to the vendor regardless of how the original contract was framed.
How does proportionality work under the MAS AI guidelines? Institutions may apply basic AI policies and procedures where poor performance or unavailability of an AI service is unlikely to have a material impact on the institution, its customers, or other stakeholders. The sophistication of controls required should scale with the assessed risk materiality of each specific use case, not be applied uniformly across all AI use.
Do the MAS guidelines apply to generative AI and AI agents? Yes. The Guidelines apply to all forms of AI technology, with generative AI and AI agents specifically in scope. MAS has indicated it will consult separately in 2027 on additional guidance specific to agentic AI.
What should a financial institution do first in response to these guidelines? Build a complete inventory of every AI use case, including embedded and third-party vendor AI features, then assess each against a materiality-based framework such as the Proportionality Ladder to prioritise which vendor relationships need remediation before the 2027 and 2028 deadlines.
Does this guideline replace MAS's existing outsourcing and technology risk requirements? No. The AI Risk Management Guidelines sit alongside MAS's existing outsourcing and technology risk management requirements; they add AI-specific expectations rather than replacing the broader third-party risk framework already in force.
Reference List
Allen & Gledhill (2026) MAS publishes AI risk management guidelines setting out supervisory expectations on responsible AI adoption. Available at: https://www.allenandgledhill.com/sg/publication/articles/34686/mas-publishes-ai-risk-management-guidelines-setting-out-supervisory-expectations-on-responsible-ai-adoption (Accessed: 2 November 2026).
Baker McKenzie (2026) Singapore: MAS issues guidelines on artificial intelligence risk management. Available at: https://www.bakermckenzie.com/en/insight/publications/2026/10/singapore-mas-issues-guidelines-on-artificial-intelligence-risk-management (Accessed: 2 November 2026).
Financial Stability Board (2025) FSB outlines next steps for authorities on AI monitoring. Available at: https://www.fsb.org/2025/10/fsb-outlines-next-steps-for-authorities-on-ai-monitoring/ (Accessed: 2 November 2026).
Fintech News Hong Kong (2024) HKMA generative AI guidelines. Available at: https://fintechnews.hk/30641/ai/hkma-generative-ai-guidelines/ (Accessed: 2 November 2026).
Monetary Authority of Singapore (2026) MAS sets out supervisory expectations on responsible AI adoption by financial institutions. Available at: https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions (Accessed: 2 November 2026).