MAS AI Risk Management Guidelines vs SR 26-2

What is the difference between MAS AI Risk Management Guidelines and SR 26-2?

The MAS Guidelines cover all forms of AI, including generative AI and AI agents, at every MAS-regulated financial institution, and add AI-specific controls on fairness, explainability, human oversight, third-party AI and cybersecurity, phased in between October 7, 2027 and October 7, 2028. SR 26-2 is model risk guidance "most relevant" to US banking organizations above $30 billion in assets: it narrows the model definition to complex quantitative methods, places generative and agentic AI outside its scope and "does not set forth enforceable standards".[1][2][3]

At a glance

	MAS AI Guidelines (Singapore)	SR 26-2 (US)
Instrument	Monetary Authority of Singapore, Guidelines on Artificial Intelligence Risk Management for Financial Institutions (October 7, 2026)	Revised Guidance on Model Risk Management — Federal Reserve SR 26-2 / OCC Bulletin 2026-13 / FDIC FIL-15-2026 (April 17, 2026)
Status	Issued Oct 7, 2026; takes effect Oct 7, 2027, fully by Oct 7, 2028	In force since Apr 17, 2026
In the tracker	MAS Guidelines on Artificial Intelligence Risk Management · MAS Consultation Paper P017-2025 (AI Risk Management Guidelines) Authority: MAS	SR 26-2 · OCC Bulletin 2026-13 Authority: Federal Reserve, OCC

Side by side

How do the MAS AI Guidelines and SR 26-2 differ?

Dimension	MAS AI Guidelines (Singapore)	SR 26-2 (US)
Status and dates	Issued October 7, 2026 with an accompanying response to feedback paper; "These Guidelines take effect on 7 October 2027."[4][1]	Issued April 17, 2026 by the Federal Reserve, OCC and FDIC; it "supersedes and replaces" SR 11-7 and SR 21-8. The letter names no later effective date or transition period.[5]
Issuer and legal nature	MAS guidelines setting out "supervisory expectations relating to AI risk management in financial institutions"; they "complement existing legislation and guidelines issued by the MAS".[1]	Interagency guidance that "does not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with this guidance will not result in supervisory criticism", although supervisory action may still follow for "violations of law or unsafe or unsound practices stemming from insufficient management of model risk".[3]
Who it applies to	"The Guidelines apply to all FIs in a proportionate manner, according to their size and risk profile." The MAS page lists full, merchant and wholesale banks (branches and locally incorporated) among the covered entity types; the Guidelines apply on a group basis to locally incorporated FIs under consolidated supervision by MAS or owning critical information infrastructure.[1][2]	"Expected to be most relevant to banking organizations with over $30 billion in total assets"; smaller banks only where they have "significant exposure to model risk" because of the prevalence and complexity of their models.[3][5]
What it covers	AI: "machine-based systems or models that derive outputs through learned premises such as the data or inputs it receives". A model is "a method or approach which converts assumptions and input data into outputs such as estimates, decisions, or recommendations"; expectations attach to AI use cases, systems and models.[1]	Models only: "a complex quantitative method, system, or approach that applies statistical, economic, or financial theories to process input data into quantitative estimates".[3]
Generative and agentic AI	In scope. The Guidelines apply to "all forms of AI technologies", with expectations that FIs adhere to "as they deploy AI, including Generative AI and newer developments such as AI agents"; examples include "generative AI (including large language models), and AI agents (including multi-agent systems)".[2][1]	Out of scope: "Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance." The principles apply to "traditional statistical and quantitative models and non-generative, non-agentic AI models".[3]
Rules-based tools	"Calculators or tools whose outputs are solely based on predefined programming logic or rules would not be regarded as AI"; nor, ordinarily, robotic process automation "that follows fixed programmed instructions without learning or adaptation".[1]	Excludes "simple arithmetic calculations, such as those found within spreadsheets, as well as deterministic rule-based processes and software where there are no statistical, economic, or financial theories underpinning their design or use".[3]
Low-risk use	An FI may apply only basic AI governance policies where poor performance or unavailability of its AI tools "is unlikely to have a material adverse impact on the FI, its customers or other stakeholders" (examples: drafting emails, summarising internal notes). The basics include designating a member of senior management responsible for AI oversight and an approved list of AI tools.[1]	Banking organizations "may deem certain models immaterial based on model exposure and purpose"; model risk management for them "may consist of identifying those models and monitoring model performance".[3]
Identification and inventory	Consistent identification of AI use "across all relevant business and functional areas", including AI in services from material third-party providers; a designated control function is "the final arbiter on whether a given use constitutes AI use". FIs keep "an accurate inventory of AI use cases, systems or models across the FI to the extent possible or practicable".[1]	"An effective model inventory includes sufficient information to understand model risks", at the individual and aggregate levels. The text sets no separate process for identifying AI.[3]
Materiality	A risk materiality assessment for each AI use case, "minimally covering" impact, complexity and reliance (including autonomy and human involvement), assessed both before and after controls; residual risk materiality should meet the FI's risk appetite before deployment.[1]	"Model purpose, together with model exposure, determines model materiality"; "Sound practice involves assessing model risk both individually and in aggregate."[3]
Board and senior management	The board, or a committee it delegates, approves "the overall governance approach for AI risk management", ensures risks from AI use are addressed in the risk appetite framework and has "an adequate understanding of AI to provide effective oversight and challenge"; senior management updates the board "on material AI risk issues in a timely manner".[1]	Calls for "clear roles and responsibilities with well-defined accountability"; the attachment does not set out board or senior-management duties.[3]
AI committee	Not required: "Existing governance structures may be used where they provide adequate oversight and cross-functional coordination, and FIs need not establish a dedicated AI committee solely to meet this expectation." The consultation had proposed a dedicated cross-functional committee where overall AI risk exposure is material.[4][6]	No committee is specified; "Sound governance practices delineate the individual(s) responsible for key activities throughout the model lifecycle".[3]
Lifecycle controls	Section 5 sets controls for data management, transparency and explainability, fairness (an FI defines what it considers fair outcomes and runs fairness assessments where relevant) and human oversight, which should take into account "automation bias and decision fatigue"; controls are proportionate to each use case's risk materiality.[1]	Development testing includes "a critical assessment of data quality, relevance, and inputs"; conceptual soundness may rely on "interpretability measures or benchmarking to other models". There is no fairness, bias or human-oversight section.[3]
Third-party AI	"The decision to onboard and use third-party AI is ultimately a decision of the FI"; FIs test it in their own use cases, perform "compensatory testing to address informational gaps", and where residual risk exceeds appetite consider "limiting or suspending the third-party AI service, or replacing the relevant third-party provider".[1]	For vendor products "the principles of model risk management remain applicable"; sound practice includes understanding the vendor model's "conceptual soundness, design, development data, and performance" and ongoing monitoring and outcome analysis.[3]
Validation and testing	Evaluation and testing proportionate to risk materiality before deployment; "AI use cases assessed as having high risk materiality should undergo formal independent validation before deployment" and "should be subject to regular re-validations by independent parties". Generative AI and agent testing should cover "key failure modes and the effectiveness of associated guardrails".[1]	Effective challenge by experts with "sufficient independence to maintain objectivity"; "The timing, nature, and frequency of validation activities vary" with model purpose, methodology and constraints, and urgent business need may justify use before validation is completed.[3]
Monitoring and change	Ongoing monitoring "of all deployed AI (including third-party AI used in the FI)", with drift checks, incident management, "kill switches" considered for high risk materiality AI, change controls and decommissioning controls.[1]	A model that no longer performs as expected "may warrant overlays, adjustment, or redevelopment"; monitoring frequency depends on the nature of the model, new data and "model materiality".[3]
Cybersecurity	AI systems should be "secure, well-governed, and supported by appropriate controls to manage technology and cybersecurity risks"; pre-deployment reviews include "vulnerability assessments, penetration testing, and red teaming".[1]	No cybersecurity or technology-risk section; model risk is "the potential for adverse financial consequences associated with models".[3]
Transition	"FIs may meet the expectations set out in Sections 3 to 4 from 7 October 2027, and Section 5 and 6 of the Guidelines by 7 October 2028." High-risk use cases should get lifecycle controls "as soon as possible" rather than at the end of the 24-month period.[1][6]	None stated: the letter and attachment are dated April 17, 2026 and replace SR 11-7 and SR 21-8 from issue.[5][3]
Predecessors	Finalises Consultation Paper P017-2025 (November 13, 2025 to January 31, 2026), which had proposed a single 12-month transition. The FEAT principles "continue to apply for guiding the use of AI in the financial sector".[7][6][1]	Supersedes SR 11-7 (April 4, 2011) and SR 21-8, the BSA/AML model risk statement (April 9, 2021).[5]
Group frameworks	An FI in a global group may leverage group frameworks "as long as those frameworks meet the expectations set out in these Guidelines"; "Local senior management remains accountable for ensuring that group frameworks, if adopted for Singapore, adequately address local considerations".[1]	No group-framework provision; "Each banking organization ultimately is responsible for adopting model risk management practices that are appropriate and effective" for its own risks.[3]

What it means for a bank

What does a bank operating in both Singapore and the US need to reconcile?

Run one AI and model inventory with two scope flags: LLM assistants, chatbots and agents excluded by SR 26-2 are AI under the MAS definition, and the Singapore entity must have them identified, inventoried and assessed for materiality from October 7, 2027.[1][3]
Record both materiality views per use case: MAS impact, complexity and reliance (including autonomy and human involvement), and the US exposure-and-purpose materiality for in-scope models, so one tiering serves both supervisors.[1][3]
Write AI risk into the board-approved risk appetite framework for Singapore; an existing model risk or technology risk committee can carry AI oversight there if it gives a consolidated, cross-functional view, which MAS accepts in place of a dedicated committee.[1][4][6]
Place fairness, explainability, human oversight and AI cybersecurity controls outside the US model risk policy, which does not address them, and have them running for Singapore use cases by October 7, 2028, sooner for high-risk use cases.[1][6][3]
Update vendor contracts for AI: MAS expects visibility over the introduction of AI and later changes, and compensatory testing where providers disclose too little; the same testing supports the US expectation to understand vendor models.[1][3]
If Singapore relies on a US group framework, local senior management must be able to show MAS that it covers Singapore requirements, including the generative and agentic AI that the US guidance leaves out.[1][3]

Timeline

When did each happen?

Date	Instrument	Event
Nov 13, 2025	MAS AI Guidelines (Singapore)	MAS issues Consultation Paper P017-2025 on proposed Guidelines on AI Risk Management.[7]
Jan 31, 2026	MAS AI Guidelines (Singapore)	P017-2025 consultation closes.[7]
Apr 17, 2026	SR 26-2 (US)	SR 26-2 / OCC Bulletin 2026-13 / FDIC FIL-15-2026 issued; SR 11-7 and SR 21-8 superseded.[5][8]
Apr 17, 2026	SR 26-2 (US)	US agencies say they plan to issue "in the near future" a request for information on model risk management and banks' use of AI, including generative and agentic AI.pending[8]
Oct 7, 2026	MAS AI Guidelines (Singapore)	MAS issues the final Guidelines and its response to feedback.[4][6]
Oct 7, 2027	MAS AI Guidelines (Singapore)	Guidelines take effect; Sections 3 and 4 (oversight, identification, inventory, materiality) expected.pending[1]
Oct 7, 2028	MAS AI Guidelines (Singapore)	Sections 5 and 6 (lifecycle controls, capabilities and capacity) expected in full.pending[1]

Contested or pending

What is still open?

Agentic AI is unsettled on both sides: MAS says that in 2027 it intends to consult the sector on what additional guidance on agentic AI would be useful, and the US agencies have only announced a request for information covering generative and agentic AI.[4][8]

Common questions

Do the MAS AI Risk Management Guidelines cover generative AI and AI agents?

Yes. They apply to all forms of AI technologies, and their examples include generative AI, large language models and AI agents, including multi-agent systems. SR 26-2 places generative and agentic AI outside its scope.[2][1][3]

When do the MAS AI Risk Management Guidelines take effect?

On October 7, 2027. FIs should meet Sections 3 and 4 (oversight and AI risk management systems) from that date and Sections 5 and 6 (lifecycle controls and capabilities) by October 7, 2028.[1][4]

Does a Singapore bank need a dedicated AI committee?

No. MAS says existing governance structures may be used where they provide adequate oversight and cross-functional coordination, and FIs need not set up a dedicated AI committee solely to meet the oversight expectation.[4][6]

Which banks does SR 26-2 apply to?

It is expected to be most relevant to banking organizations with over $30 billion in total assets, and may be relevant to smaller banks with significant exposure to model risk.[3]

Is either document legally binding?

SR 26-2 says it does not set forth enforceable standards and that non-compliance will not result in supervisory criticism. The MAS Guidelines set out supervisory expectations that complement existing legislation and MAS guidelines.[3][1]

Can a US bank's Singapore entity use its group AI framework?

Yes, if the group framework meets the MAS expectations. Local senior management stays accountable for making sure it addresses Singapore requirements and must be able to show MAS how it discharges that oversight.[1]

Sources

Guidelines on Artificial Intelligence Risk Management (PDF) — Monetary Authority of Singapore, Oct 7, 2026
Guidelines on Artificial Intelligence Risk Management for Financial Institutions — Monetary Authority of Singapore, Oct 7, 2026 · tracker page
Supervisory Guidance on Model Risk Management (SR 26-2 attachment) — Federal Reserve Board, FDIC and OCC, Apr 17, 2026
MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions — Monetary Authority of Singapore, Oct 7, 2026
SR 26-2: Revised Guidance on Model Risk Management — Board of Governors of the Federal Reserve System, Apr 17, 2026 · tracker page
Response to Feedback Received on Guidelines on Artificial Intelligence Risk Management (P017-2025) — Monetary Authority of Singapore, Oct 7, 2026
Consultation Paper on Proposed Guidelines on Artificial Intelligence Risk Management for Financial Institutions (P017-2025) — Monetary Authority of Singapore, Nov 13, 2025 · tracker page
OCC Bulletin 2026-13, Model Risk Management: Revised Guidance — Office of the Comptroller of the Currency, Apr 17, 2026 · tracker page

Every cell and answer on this page cites the official text it comes from; quotations are verbatim. Last reviewed Oct 24, 2026.

Navigate