What does MAS Guidelines on Outsourcing (Banks) say about AI in banking?

What are the key points of MAS Guidelines on Outsourcing (Banks)?

• Section 3 covers board and senior management responsibilities, evaluation of risks, assessment of service providers, the outsourcing agreement, sub-contractors, confidentiality and security, business continuity, monitoring and control, audit and inspection, outsourcing outside Singapore, intragroup outsourcing and outsourcing of internal audit.
• Paragraph 1.3: banks should ensure outsourced services, whether provided by a service provider or its sub-contractor, 'continue to be managed as if the services were still managed by the Bank'.
• Paragraph 1.1 names country risk when a provider is overseas and 'concentration risk when more than one function is outsourced to the same service provider' — the risk MAS and the FSB flag for reliance on a few AI model providers.
• Paragraph 1.2 asks banks to self-assess all existing outsourcing arrangements against the Guidelines.
• Paragraph 1.4: arrangements outside the definition of outsourcing 'should also be subject to adequate risk management and sound internal controls'; Annex 1 helps assess materiality and Annex 2 covers cloud computing.
• The 2016 Guidelines on Outsourcing (last revised 5 October 2018) were in effect until 10 December 2024 and MAS now lists them as cancelled.
• Consultation Paper P004-2026 (6 March 2026) proposes Guidelines on Third-Party Risk Management that would supersede these Guidelines and extend the expectations to all third-party services.

What did MAS Guidelines on Outsourcing (Banks) change for banks?

The 2023 Guidelines split the earlier cross-sector 2016 Guidelines on Outsourcing into a bank-specific version aligned with Notices 658 and 1121, effective December 2024. They are a transitional instrument: MAS's March 2026 consultation would fold them into Third-Party Risk Management Guidelines covering all third-party services, including AI services that are not outsourcing.