The Monetary Authority of Singapore recently issued its first AI risk management guidelines for financial institutions, requiring local financial institutions to have AI use cases reviewed by an independent party not involved in development before deployment to production. The guidelines take effect on October 7, 2027.
As Singapore's central bank and financial industry regulator, the Monetary Authority of Singapore noted that while AI can improve performance across multiple business and functional areas, its complexity and probabilistic nature increase uncertainty and may produce anomalies or deviant behaviors that are difficult to identify. Generative AI faces higher risks due to more complex models — training data noise, insufficient data representativeness, and models encountering scenarios outside their training scope can all affect outputs. Agentic AI may further amplify related risks.
Singapore financial institutions must follow AI risk management guidelines
Under the guidelines, financial institutions should incorporate AI into existing risk management frameworks, with boards and senior management responsible for driving implementation. Pre-deployment independent reviews must cover underlying systems or models, confirming that assessment, testing, and other control measures are implemented, while also conducting technical and cybersecurity reviews to ensure AI enters production in a controlled, secure manner.
After AI systems go live, financial institutions must continuously monitor model performance to guard against data drift, model drift, performance degradation, and model aging. The same requirements apply to third-party AI products and services. The regulator explicitly stated that third-party service failures do not absolve financial institutions of responsibility. If risks cannot be kept within the institution's acceptable range, it should consider restricting, suspending, or replacing the relevant services.
In addition, financial institutions need to maintain an up-to-date inventory of AI applications. For cases where third-party services do not disclose AI usage, measures should also be taken to manage potential risks. High-risk AI applications must also have contingency and fallback plans, including activating backup systems or manual processes, to safeguard business continuity.