What does MAS AI Model Risk Management information paper say about AI in banking?

What are the key points of MAS AI Model Risk Management information paper?

• Section 4 (governance and oversight): cross-functional AI oversight forums, updated policies and procedures, central statements on fair, ethical, accountable and transparent AI use, and capability building.
• Section 5.1 (identification): banks extend existing model definitions to identify AI, with model risk management functions typically the key control function for AI identification.
• Section 5.2 (inventory): a formal AI inventory showing the approved scope of use (purpose, jurisdiction, use case), so AI approved for one jurisdiction is not automatically treated as approved for another; typical attributes are listed in paragraph 5.2.4.
• Section 5.3.1 (risk materiality): most banks assess impact, complexity and reliance (autonomy granted to the AI and human-in-the-loop mitigants) and review ratings over time.
• Section 6 (development and deployment): standards for data management, robustness and stability, explainability and fairness, reproducibility and auditability; independent validation or peer review by risk materiality (6.4.4); pre-deployment checks and post-deployment monitoring and change management (6.5).
• Section 7.1 (generative AI): hallucination and unexpected behaviour were a key concern; most banks limited generative AI to assisting humans or non-customer-facing efficiency uses, with human oversight, input and output filters and data-security controls.
• Section 7.2 (third-party AI): banks use compensatory testing, contingency planning, updated contracts (performance guarantees, data protection, audit rights, notice of AI being introduced) and awareness efforts, within existing third-party risk standards.
• Paragraph 3.5 puts data governance, technology and cyber risk and third-party risk management outside the paper, noting existing MAS notices, guidelines and information papers continue to apply.

What did MAS AI Model Risk Management information paper change for banks?

This was MAS's first supervisory paper dedicated to AI model risk management. It showed what Singapore banks were already doing and so set the practical benchmark that supervisors compare against, and it signposted the move from FEAT principles to risk-management expectations that culminated in the November 2025 draft AI risk management Guidelines. MAS published a companion circular (ID 18/24) to insurers on the same date.

What good practices does the MAS information paper on AI model risk management set out for banks?

The MAS information paper on artificial intelligence model risk management, published on 5 December 2024, describes good practices observed at selected banks across three areas: oversight and governance of AI, key risk management systems (AI identification, inventories and risk materiality assessment using impact, complexity and reliance), and development, validation and deployment (data management, robustness, explainability, fairness, reproducibility, independent validation or peer review, pre-deployment checks, monitoring and change management). It adds sections on generative AI and third-party AI. The practices are not binding, but MAS says they should generally apply to other financial institutions, and the paper foreshadowed the 2025 consultation on Guidelines on AI Risk Management. For banks, it is the clearest statement of what MAS saw as sound practice before the Guidelines are finalised.

The paper is deliberately observational. MAS gathered practices from selected banks in mid-2024 and framed them as good practice that other FIs should take reference from, while excluding general data governance, technology and cyber, and third-party risk management, where existing MAS notices, guidelines and information papers apply (paragraph 3.5). It also cites supervisory statements from other jurisdictions, for example the Federal Reserve and OCC's SR 11-7 on independent validation.

In paragraph 8.2 MAS said it was considering supervisory guidance for all FIs the following year, building on these focus areas; the November 2025 consultation paper on Guidelines on AI Risk Management repeats the same structure (oversight, identification, inventory, risk materiality, lifecycle controls) and proposes a 12-month transition once finalised.

WHAT THIS MEANS IN PRACTICE

• Check that your model inventory tags AI models and records approved scope of use, including jurisdiction.
• Adopt a documented materiality methodology based on impact, complexity and reliance and tie validation depth to the rating.
• Ensure independent validators or peer reviewers have AI technical expertise.
• For generative AI, document why a use case is or is not customer-facing and what human review and guardrails apply.
• For vendor AI, build compensatory testing, contingency plans and contract clauses (audit rights, notice of new AI features) into third-party risk processes.
• Use the paper as a gap-assessment baseline now, ahead of the final Guidelines.