Singapore has no AI statute. A bank’s AI is governed through Monetary Authority of Singapore supervisory guidance, plus frameworks from the Personal Data Protection Commission (PDPC) and the Infocomm Media Development Authority (IMDA). The key 2026 document is MAS’s Guidelines on Artificial Intelligence Risk Management, issued on 7 October 2026. They apply to all MAS-regulated financial institutions, including banks, and to all forms of AI, including generative AI and AI agents, in proportion to each institution’s risk. Board oversight and the AI inventory and risk-materiality expectations (Sections 3–4) apply from 7 October 2027, and lifecycle controls (Sections 5–6) by 7 October 2028. The Guidelines are supervisory expectations, not law. The one binding, dated instrument that reaches bank AI directly is MAS Notice 658 on outsourced relevant services, issued under the Banking Act and effective since 11 December 2024, which MAS’s Guidelines apply to third-party AI. The Personal Data Protection Act 2012 binds any AI that uses personal data, and the PDPC’s 2024 and 2026 advisory guidelines explain how. Around them sit voluntary references: the 2018 FEAT Principles, Veritas, the MindForge toolkit (20 March 2026), the SAFR white paper on AI agents (3 July 2026) and IMDA’s frameworks for generative AI (2024) and agentic AI (2026). The table lists 22 instruments.
TRACKED DOCUMENTS: MAS Guidelines on Artificial Intelligence Risk Management · MAS Notice 658 on outsourced relevant services · PDPC Advisory Guidelines on AI Recommendation and Decision Systems · PDPC Advisory Guidelines on Personal Data in Generative AI · IMDA Model AI Governance Framework for Agentic AI
AI statute
None; AI is governed through MAS guidance plus PDPC and IMDA frameworks
Key 2026 document
MAS Guidelines on AI Risk Management, issued 7 October 2026
Phasing
Sections 3–4 from 7 October 2027; Sections 5–6 by 7 October 2028
Binding and dated
Notice 658 on outsourcing, effective 11 December 2024, plus the PDPA
Instruments tracked
22: MAS 15, PDPC 4, IMDA 3
Which instruments govern AI at a bank in Singapore?
The table below lists every Singapore instrument a bank’s AI programme has to reckon with: 3 that bind (the Personal Data Protection Act, MAS Notice 658 and the MAS Notices on Technology Risk Management), the MAS supervisory guidelines that set expectations, and the papers, toolkits and frameworks MAS and the other two authorities point banks to. Each row links to our tracker page for the document, which carries the key points, the AI relevance and the change history, and to the issuer’s own page. Rows are ordered by force: binding instruments first, then MAS’s AI-specific guidance, the MAS guidance the AI Guidelines lean on, and the PDPC and IMDA documents.
| Instrument | Issuer | Type | Binding? | Date (and effective) | Applies to | What it asks of a bank’s AI | Our page |
|---|---|---|---|---|---|---|---|
| Personal Data Protection Act 2012 (PDPA) | PDPC | Statute | Yes. Binding law; the PDPC administers and enforces it | 2 Jul 2014 (Act of 2012; main data protection rules in force) amendments took effect in phases from 1 Feb 2021 | Every private-sector organisation that collects, uses or discloses personal data, including banks and AI vendors acting as data intermediaries | Consent or an applicable exception before personal data trains, tests or runs an AI system; notification of purposes; purpose limitation, protection, retention, accountability, and access and correction rights that reach AI training and deployment data | Regulator page · Primary source |
| Notice 658 Management of Outsourced Relevant Services for Banks (MAS Notice 658) | MAS | Notice | Yes. Binding; issued under section 47A of the Banking Act 1970 | 11 Dec 2023 Effective 11 Dec 2024 | All banks in Singapore (merchant banks: the parallel Notice 1121) | Where a third-party AI service is an outsourced relevant service: a register submitted to MAS semi-annually, due diligence on material ongoing services repeated within 24 months, sub-contracting controls, access rights, customer-information protection and exit measures | Tracker page · Primary source |
| MAS Notices on Technology Risk Management (amendments proposed in P012-2026) | MAS | Notice (amendments under consultation) | Yes. The Notices are binding; the 2026 amendments are still proposals | 10 Jun 2026 (consultation opened; closed 31 Jul 2026) | MAS-regulated financial institutions, including banks | The binding layer beneath the TRM Guidelines; the proposed amendments cover IT asset management, IT risk assessment and monitoring, change management controls, and data backup and recovery, all of which reach the systems AI runs on | Tracker page · Primary source |
| Guidelines on Artificial Intelligence Risk Management for Financial Institutions | MAS | Guideline | No. Supervisory expectations, not a notice or statute; applied proportionately | 7 Oct 2026 Effective 7 Oct 2027 Sections 3–4 from 7 Oct 2027; Sections 5–6 by 7 Oct 2028 | All MAS-regulated FIs, including full, merchant and wholesale banks; all forms of AI, including generative AI and AI agents | Board and senior-management oversight (existing committees may be used; no dedicated AI committee required); consistent AI identification and an AI inventory; risk materiality by impact, complexity and reliance; proportionate lifecycle controls (data, fairness, explainability, human oversight, third-party AI, testing, cybersecurity, monitoring); capabilities | Tracker page · Primary source |
| Consultation Paper on Guidelines on Artificial Intelligence Risk Management (P017-2025) | MAS | Consultation (superseded) | No. Superseded by the final Guidelines of 7 Oct 2026 | 13 Nov 2025 (comments closed 31 Jan 2026) | Proposed for all FIs as defined in the Financial Services and Markets Act 2022, including banks | The draft of the Guidelines: four focus areas, a dedicated cross-functional AI committee where AI risk exposure is material (dropped in the final text) and a single 12-month transition (replaced by the 2027/2028 phasing) | Tracker page · Primary source |
| Artificial Intelligence Model Risk Management: Observations from a Thematic Review | MAS | Information paper | No. Observed good practices from a mid-2024 thematic review of selected banks | 5 Dec 2024 | Written from selected banks; MAS says the practices should generally apply to other FIs | Cross-functional AI oversight forums; a formal AI inventory with approved scope by purpose, jurisdiction and use case; materiality by impact, complexity and reliance; independent validation by materiality; human oversight and input/output filters for generative AI; contract and testing controls for third-party AI | Tracker page · Primary source |
| Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) | MAS | Principles | No. Voluntary; 'not intended to be prescriptive' | 12 Nov 2018 | All firms using AI or data analytics in decisions on financial products and services, including banks | Fourteen principles: no unjustified systematic disadvantage, justified use of personal attributes, bias review of data and models, internal approval of AI use, board awareness, recourse for customers, proactive disclosure and explanations on request | Tracker page · Primary source |
| Veritas Initiative: FEAT assessment methodologies and Veritas Toolkit 2.0 | MAS-led industry consortium | Toolkit | No. Voluntary, open source | 26 Jun 2023 (phase 3 concluded; initiative began Nov 2019) | FIs, including banks, assessing AI use cases against FEAT | Nothing mandatory; gives testable Fairness, Ethics, Accountability and Transparency assessment methods and code, piloted by DBS, OCBC, UOB and BNY Mellon, that can evidence the fairness and transparency controls the Guidelines expect | Tracker page · Primary source |
| Project MindForge AI Risk Management Toolkit (Operationalisation Handbook) | MAS with industry | Toolkit | No. Industry-led companion guide, not a MAS rule | 20 Mar 2026 | FIs in Singapore and elsewhere; built by a 24-institution consortium of banks, insurers and capital markets firms | Nothing mandatory; a four-part framework (scope and oversight, risk management, lifecycle management, enablers) with 17 Considerations, an AI risk taxonomy, AI Card template, metric and guardrail libraries and a checklist for implementing the Guidelines | Tracker page · Primary source |
| Safeguards for Agentic Finance at Runtime (SAFR) | MAS with industry | White paper | No. States it 'does not constitute regulatory guidance or supervisory expectations' | 3 Jul 2026 version 1.1 9 Oct 2026 | FIs deploying AI agents that initiate payments, trades, credit, claims or filings | Nothing mandatory; a reference runtime layer: verified agent identity, a controls repository, a disposition engine (Deny, Escalate, Auto-Execute, Observe) and a tamper-evident audit log for every consequential agent action | Tracker page · Primary source |
| Cyber Risks Associated with Generative Artificial Intelligence (MAS/TCRS/2024/05) | MAS | Circular (information paper) | No. Awareness paper; measures FIs 'could' take | 30 Jul 2024 | Financial institutions in Singapore, including banks | Check cyber controls against GenAI-enabled attacks (deepfakes, phishing, malware) and threats to the bank's own GenAI deployments (data leakage, model and output manipulation): liveness detection, data loss prevention, access controls, human-in-the-loop | Tracker page · Primary source |
| Cyber Risks Associated with Deepfakes (MAS/TCRS/2025/06) | MAS | Circular (information paper) | No. Awareness paper | 18 Sep 2025 | Financial institutions in Singapore, including banks | Assess deepfake risk to biometric authentication, impersonation scams and disinformation; liveness detection, extra verification for high-risk transactions, real-time deepfake detection and tested incident response plans | Tracker page · Primary source |
| Advisory to FIs on frontier-AI cyber threats | MAS | Advisory | No. Not published on MAS's site; known from MAS's 28 Jul 2026 remarks. Supervisory expectations to follow | Apr 2026 | Financial institutions; the follow-up expectations are aimed at key FIs | Shorter patching timelines and faster adoption of AI in secure coding, vulnerability detection and security testing; MAS said it would soon require key FIs to submit assessments and action plans against AI-enabled cyber threats | Regulator page · Primary source |
| Technology Risk Management Guidelines | MAS | Guideline | No. Observance of their spirit 'is an area of consideration by MAS' (para 2.2) | 18 Jan 2021 | All MAS-regulated FIs, including full, merchant and wholesale banks | The technology and cybersecurity baseline for every AI system (cited in the AI Guidelines, footnotes 47 and 50): review of third-party and open-source code before integration, API vetting, access control, security-by-design | Tracker page · Primary source |
| Guidelines on Outsourcing (Banks) | MAS | Guideline | No. Expectations alongside the binding Notice 658 | 11 Dec 2023 Effective 11 Dec 2024 | Banks and merchant banks with ongoing outsourced relevant services | Manage outsourced AI services 'as if the services were still managed by the Bank'; assess providers, contracts, sub-contractors, confidentiality, business continuity, audit and concentration risk where several functions sit with one provider | Tracker page · Primary source |
| Proposed Guidelines on Third-Party Risk Management (P004-2026) | MAS | Consultation (proposed guideline) | Not yet. Not issued as of 24 Oct 2026; would take effect 6 months after issuance | 6 Mar 2026 (comments closed 20 Apr 2026) | All MAS-regulated FIs with third-party arrangements; Notices 658 and 1121 stay in effect for banks | Extends outsourcing-style expectations to all third-party services, including AI model APIs and SaaS tools that are not outsourcing; semi-annual register of third-party arrangements; would supersede the Guidelines on Outsourcing | Tracker page · Primary source |
| Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems | PDPC | Advisory guideline | No. 'Not legally binding'; interprets the binding PDPA | 1 Mar 2024 | Organisations using personal data in machine-learning systems, including banks; bespoke AI developers as data intermediaries | A lawful basis (consent, Business Improvement, Research or Legitimate Interests exceptions) for training, bias testing and fraud detection; proportionate notification of AI use, with a bank credit-assessment policy statement as the example | Tracker page · Primary source |
| Advisory Guidelines on Use of Personal Data in Generative AI | PDPC | Advisory guideline | No. 'Not legally binding' (para 1.5); interprets the PDPA | 20 Jul 2026 | Model providers, system providers and system deployers of generative AI, including banks deploying GenAI or agentic assistants | The deployer, usually the bank, 'bear[s] primary responsibility' for PDPA compliance of the GenAI systems it chooses and must get enough information on upstream safeguards; regular review of agentic safeguards; access and correction requests reach RAG databases | Tracker page · Primary source |
| Model Artificial Intelligence Governance Framework, Second Edition | PDPC with IMDA | Framework | No. Voluntary; does not mean compliance with sector law | 21 Jan 2020 (first edition 23 Jan 2019) | Private-sector organisations deploying AI at scale, including banks; points finance firms to FEAT | Internal governance structures; a risk-based choice of human-in-the-loop, human-over-the-loop or human-out-of-the-loop; data and model operations management; disclosure to affected individuals, e.g. that a credit rating may lead to a loan refusal | Tracker page · Primary source |
| Model AI Governance Framework for Generative AI | IMDA / AI Verify Foundation | Framework | No. Voluntary | 30 May 2024 (draft 16 Jan 2024) | The generative AI ecosystem, including banks that build or deploy it; MAS's Guidelines invite FIs to refer to it | Nine dimensions: accountability along the development chain, data, trusted development and deployment, incident reporting, testing and assurance, security, content provenance, safety R&D, AI for public good | Tracker page · Primary source |
| AI Verify Testing Framework and Toolkit | IMDA / AI Verify Foundation | Toolkit | No. Voluntary, open source | 7 Jun 2023 (AI Verify Foundation launched; MVP piloted from 2022) | Any organisation testing AI systems, including banks; DBS was a founding Foundation member | Nothing mandatory; tests and process checks against 11 principles (transparency, explainability, fairness, robustness, human oversight and others) mapped to NIST AI RMF and ISO/IEC 42001; the PDPC suggests using results to support disclosures | Tracker page · Primary source |
| Model AI Governance Framework for Agentic AI | IMDA | Framework | No. Voluntary; a 'living document' | 22 Jan 2026 version 1.5 20 May 2026 | Organisations deploying AI agents built in-house or bought; footnote 11 of MAS's Guidelines names it for agentic AI | Assess and bound agent risks upfront (autonomy, tool and data access), make humans meaningfully accountable at checkpoints, technical controls through the agent lifecycle, end-user responsibility; includes an OCBC (Bank of Singapore) case study | Tracker page · Primary source |
Three issuers, three roles. The Monetary Authority of Singapore supervises banks and writes the sector expectations. The Personal Data Protection Commission enforces the PDPA, the only binding law in the table that reaches every AI system touching personal data, and explains in advisory guidelines how it applies to AI. The Infocomm Media Development Authority is not a financial regulator; it publishes cross-sector governance frameworks and the AI Verify testing toolkit, and its weight with banks comes from MAS’s Guidelines inviting institutions to refer to them.
The table applies to every bank MAS licenses: the local groups DBS, OCBC and UOB, foreign banks such as Standard Chartered, and the digital banks GXS Bank, Trust Bank, MariBank and ANEXT Bank. The local banks also show up inside the documents. DBS, OCBC and UOB pilot-tested Veritas Toolkit 2.0 in 2023. DBS was a founding general member of the AI Verify Foundation and gave feedback on IMDA’s agentic framework. OCBC’s Bank of Singapore supplied the agentic-framework case study on bounding agent autonomy in source-of-wealth memos. OCBC is also among the firms whose case studies were added to SAFR version 1.1.
What is not in the table: MAS’s promised supervisory expectations for key FIs to submit assessments and action plans against AI-enabled cyber threats, announced on 28 July 2026 and not published as a standalone document as of 24 October 2026; outputs of the BuildFin.ai AI risk management workgroup; and IMDA’s guidelines for testing agentic AI applications, which IMDA said in January 2026 it was developing. The text of the April 2026 frontier-AI advisory is not public; its content comes from the Managing Director’s remarks.
What is actually binding on a bank’s AI in Singapore?
Very little that names AI. Singapore has no AI statute, and none of the AI-specific documents in the table is legally binding. What binds a bank’s AI comes from general law and notices that were not written for AI but reach it.
MAS Notice 658 is the one binding instrument with a fixed date that reaches third-party AI directly. Published on 11 December 2023 under section 47A of the Banking Act 1970 and effective from 11 December 2024, it applies to all banks in Singapore. Where a bank buys an AI service that counts as an outsourced relevant service under the Notice’s definitions, the bank must keep it on a register submitted to MAS semi-annually. For a material ongoing service it must also run due diligence before contracting, repeat it within 24 months and then at a board-approved frequency, control sub-contracting, secure access rights and prepare exit measures. MAS’s AI Guidelines say outsourcing and third-party expectations and requirements ‘would apply to the use of third-party AI’, and that the institution ‘retains primary accountability for its use of third-party AI’. MAS’s 2026 third-party consultation keeps Notice 658 in place (our Notice 658 page).
The PDPA is the binding law for any AI system that uses personal data. Its main data protection rules have applied since 2 July 2014, and amendments took effect in phases from 1 February 2021. The PDPC’s 2024 and 2026 advisory guidelines say they are not legally binding, but they set out how the Commission reads the Act for AI: which consent exceptions cover model training and bias testing, what to tell customers when AI drives a decision, and why a bank that deploys a vendor’s generative AI system carries primary responsibility for it (2024 guidelines, 2026 guidelines).
The MAS Notices on Technology Risk Management carry the binding technology-risk requirements beneath the 2021 TRM Guidelines. MAS consulted on amendments from 10 June to 31 July 2026 (P012-2026), covering IT asset management, IT risk assessment and monitoring, change management controls, and data backup and recovery. The amendments were not final as of 24 October 2026. MAS’s AI Guidelines cite the TRM Guidelines for the security and infrastructure of AI systems, so the Notice layer is where an AI system’s availability and recovery obligations sit.
Everything else is guidance, of two strengths. The AI Risk Management Guidelines, the TRM Guidelines and the Guidelines on Outsourcing (Banks) are supervisory expectations. They are not notices, but MAS supervises against them; the TRM Guidelines say the degree of observance of their spirit ‘is an area of consideration by MAS’. The FEAT Principles, the information papers and circulars, the toolkits (Veritas, MindForge, AI Verify), SAFR and the PDPC/IMDA frameworks are voluntary references. Several say so in terms. SAFR ‘does not constitute regulatory guidance or supervisory expectations’, and FEAT is ‘not intended to be prescriptive’.
What is the 2027 and 2028 timeline for the MAS AI Guidelines?
MAS issued the final Guidelines on Artificial Intelligence Risk Management on 7 October 2026. According to MAS’s media release, they take effect on 7 October 2027, and institutions may implement them in phases. The expectations in Sections 3 and 4 apply from 7 October 2027: board and senior-management oversight, plus the AI risk-management systems for identification, inventory and risk-materiality assessment. Sections 5 and 6, covering AI lifecycle controls and capabilities and capacity, apply by 7 October 2028. That gives 12 months to fix governance and the inventory and 24 months to put the controls in place. The November 2025 consultation had proposed a single 12-month transition.
Two substantive changes came with the final text. First, the dedicated cross-functional AI committee the consultation proposed where AI risk exposure is material is gone. In MAS’s words, ‘existing governance structures may be used where they provide adequate oversight and cross-functional coordination, and FIs need not establish a dedicated AI committee solely to meet this expectation.’ Second, MAS clarified proportionality. An institution may rely on basic policies and procedures where poor performance or unavailability of its AI is unlikely to have a material impact on the institution, its customers or other stakeholders. MAS also said that in 2027 it intends to consult the financial sector again on what additional guidance on agentic AI would be useful.
| Date | Event | What it means for a bank |
|---|---|---|
| 13 Nov 2025 | MAS issues Consultation Paper P017-2025 on Guidelines on AI Risk Management | Draft expectations for all FIs; comments closed 31 January 2026 |
| 6 Mar 2026 | MAS consults on Guidelines on Third-Party Risk Management (P004-2026) | Would reach AI services that are not outsourcing; take effect six months after issuance |
| 20 Mar 2026 | Project MindForge AI Risk Management Toolkit released | Industry handbook for implementing the Guidelines; voluntary |
| Apr 2026 | MAS advisory to FIs on frontier-AI cyber threats | Shorter patching, more AI in cyber defence (per MAS’s 28 July 2026 remarks) |
| 10 Jun 2026 | MAS consults on amendments to the Notices on Technology Risk Management (P012-2026) | Binding-notice changes on IT assets, risk monitoring, change management, backups; closed 31 July 2026 |
| 3 Jul 2026 | SAFR white paper on runtime safeguards for AI agents | Voluntary reference architecture; version 1.1 on 9 October 2026 |
| 20 Jul 2026 | PDPC Advisory Guidelines on Use of Personal Data in Generative AI | Deployers carry primary PDPA responsibility for GenAI systems they choose |
| 28 Jul 2026 | MAS and ABS set up the AI-Driven Cyber and Technology Risk Taskforce (ABS-ACT) | MAS, ABS, DBS, OCBC, UOB, SGX, NETS and BCS on controls against AI-enabled cyber threats |
| 7 Oct 2026 | MAS issues the final Guidelines on AI Risk Management | Supersedes P017-2025; dedicated AI committee no longer expected |
| 7 Oct 2027 | Guidelines take effect: Sections 3 and 4 apply | Board and senior-management oversight; AI identification, inventory and risk-materiality assessment |
| 7 Oct 2028 | Sections 5 and 6 apply | AI lifecycle controls and capabilities and capacity |
For a bank, the practical order follows the phasing. By October 2027 it needs a board-approved AI risk appetite and framework with clear accountabilities, a single way of deciding what counts as AI, an inventory at an appropriate level of granularity, and a materiality rating for each use case. By October 2028 it needs the lifecycle controls scaled to those ratings. The MindForge handbook’s control libraries and AI Card template, and MAS’s December 2024 information paper on what selected banks already do, are the nearest references for what ‘good’ looks like.
How does Singapore compare with the US and the EU?
Singapore sits between the two. Like the US, it relies on supervisory guidance rather than a statute. Like the EU, it writes expectations specifically for AI, including generative AI and agents, rather than folding AI into model risk.
| Dimension | Singapore (MAS) | United States (Fed, OCC, FDIC) | European Union |
|---|---|---|---|
| Main AI instrument for banks | MAS Guidelines on AI Risk Management (7 Oct 2026) | SR 26-2 / OCC Bulletin 2026-13, revised model risk guidance (17 Apr 2026) | Regulation (EU) 2024/1689, the AI Act (in force 1 Aug 2024) |
| Legal force | Supervisory guidelines; no AI statute | Supervisory guidance that 'does not set forth enforceable standards' | Directly applicable regulation with fines up to €35M or 7% of worldwide turnover |
| AI in scope | All forms of AI, including generative AI and AI agents | Models narrowed to complex quantitative methods; generative and agentic AI 'not within the scope' | Risk tiers; credit scoring of natural persons is high-risk (Annex III 5(b)), fraud detection carved out |
| Who | All MAS-regulated FIs, proportionately | Most relevant to banking organisations above $30 billion in assets | Providers and deployers, including outside the EU where output is used in the EU |
| Key dates | 7 Oct 2027 (Sections 3–4); 7 Oct 2028 (Sections 5–6) | In effect since 17 Apr 2026; an AI and model risk RFI promised | Stand-alone high-risk obligations from 2 Dec 2027 after the Digital Omnibus |
The US counterpart is SR 26-2, issued on 17 April 2026 by the Federal Reserve, OCC (Bulletin 2026-13) and FDIC, which replaced SR 11-7. It is model risk guidance, most relevant to banking organisations above $30 billion in assets. It states that generative AI and agentic AI models ‘are not within the scope of this guidance’, and the agencies said they would issue a request for information on AI and model risk. MAS’s Guidelines cover exactly the AI that SR 26-2 leaves out. Our MAS AI Risk Management Guidelines vs SR 26-2 comparison sets the two side by side, clause by clause.
The EU counterpart is a law. Regulation (EU) 2024/1689, the EU AI Act, entered into force on 1 August 2024. It classifies AI used to evaluate the creditworthiness of natural persons as high-risk under Annex III point 5(b), with a carve-out for systems used solely to detect financial fraud. Following the 2026 Digital Omnibus amendment, stand-alone high-risk obligations apply from 2 December 2027, eight weeks after Singapore’s first phase on 7 October 2027. Penalties reach €35 million or 7% of worldwide turnover for prohibited practices. Singapore has no penalty regime specific to AI; enforcement runs through MAS supervision, Notice 658 and the PDPA. For how the EU Act compares with a US state AI law, see EU AI Act vs Colorado AI Act.
What must a bank operating in Singapore and the US reconcile?
A bank supervised in both places, such as a US bank with a Singapore branch or a Singapore group with US operations, runs into five gaps. Each item below is drawn from the documents in the table and the SR 26-2 entry in our tracker.
- Scope of the inventory. SR 26-2 puts generative and agentic AI outside model risk scope; MAS’s Guidelines cover all forms of AI, including both. A US model inventory will therefore miss AI that the Singapore inventory must hold, rate and control from 7 October 2027.
- What counts as AI. MAS’s consultation defined AI as models or systems that learn or infer from inputs to generate estimates, predictions, content, recommendations or decisions, and excluded tools that rely solely on predefined rules. SR 26-2 narrows the model definition to complex quantitative methods. The two filters do not select the same population, so the bank needs one mapping between them.
- Third-party AI. In Singapore, Notice 658 is binding: a semi-annual register to MAS and due diligence on material outsourced services repeated within 24 months. MAS’s AI Guidelines also say the bank keeps primary accountability for third-party AI and should consider limiting, suspending or replacing it if the risk cannot be brought within its risk appetite. Vendor-model reviews done to US standards need to produce that Singapore evidence.
- Personal data. A credit, fraud or marketing model moved from the US to Singapore needs a PDPA basis for its data (consent or an exception such as Business Improvement or Legitimate Interests) and a proportionate notice to customers. The PDPC’s example is a bank publishing a credit-assessment policy statement. Under the 2026 guidelines, the bank as deployer carries primary responsibility for generative AI systems it buys.
- Governance form. MAS no longer expects a dedicated AI committee, so an existing US-style model risk committee can serve if it provides cross-functional oversight. What MAS does expect is board-level accountability, an AI risk appetite and materiality ratings across impact, complexity and reliance. SR 26-2 ‘does not set forth enforceable standards’, so the Singapore timetable is the firmer deadline.
The 2025 consultation said branches and subsidiaries of foreign parents may rely on the parent’s AI risk management framework if it meets MAS’s expectations. Our tracker’s record of the final Guidelines does not restate that point. A foreign bank relying on its group framework should check it against the issued text.
Is there an AI law in Singapore?
No. Singapore has no AI-specific statute for banks or any other sector. Bank AI is governed by MAS’s Guidelines on AI Risk Management (issued 7 October 2026) and other MAS guidance, binding rules that reach AI without naming it (Notice 658 on outsourcing, the Technology Risk Management Notices and the Personal Data Protection Act 2012), and voluntary PDPC and IMDA frameworks.
Are the MAS AI Risk Management Guidelines binding?
They are guidelines, not a notice or a statute, and Singapore has no AI law behind them. They set out what MAS calls supervisory expectations, which MAS supervises against, applied proportionately to each institution’s risk profile and scale of AI use. Institutions should meet Sections 3–4 from 7 October 2027 and Sections 5–6 by 7 October 2028.
Do the MAS Guidelines require a dedicated AI committee?
No. The November 2025 consultation proposed a dedicated cross-functional committee where AI risk exposure is material, but the final Guidelines dropped it. MAS’s 7 October 2026 release says existing governance structures may be used where they provide adequate oversight and cross-functional coordination, and FIs ‘need not establish a dedicated AI committee solely to meet this expectation’.
Does PDPC's advisory apply to banks?
Yes. The PDPC’s advisory guidelines on AI recommendation and decision systems (1 March 2024) and on generative AI (20 July 2026) apply to any organisation using personal data in AI, banks included. They are not legally binding, but they interpret the binding PDPA, and MAS’s AI Guidelines cite both as the data-privacy reference for financial institutions.
What is AI Verify?
AI Verify is Singapore’s open-source AI governance testing framework and toolkit, developed by IMDA and run with the community through the AI Verify Foundation since 7 June 2023. It tests AI systems against 11 principles, including transparency, explainability, fairness, robustness and human oversight, maps to the NIST AI RMF and ISO/IEC 42001, and is voluntary.
Do the Guidelines cover agentic AI?
Yes. The final MAS Guidelines cover all forms of AI, including generative AI and AI agents, and point to IMDA’s Model AI Governance Framework for Agentic AI (version 1.5, 20 May 2026). MAS said it intends to consult in 2027 on what additional agentic-AI guidance would be useful; the SAFR white paper offers a voluntary runtime-control design.
Which Singapore rules apply when a bank uses a third-party AI vendor?
Notice 658 and the Guidelines on Outsourcing (Banks) where the service is an outsourced relevant service; the TRM Guidelines’ controls on third-party code and APIs; and the AI Guidelines’ third-party section, under which the bank retains primary accountability. MAS’s proposed Third-Party Risk Management Guidelines (P004-2026) would extend expectations to all third-party services.
- Guidelines on Artificial Intelligence Risk Management for Financial Institutions — Monetary Authority of Singapore, Oct 7, 2026 (mas.gov.sg) · our page on MAS Guidelines on Artificial Intelligence Risk Management
- MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions (media release) — Monetary Authority of Singapore, Oct 7, 2026 (mas.gov.sg)
- Consultation Paper on Guidelines on Artificial Intelligence Risk Management (P017-2025) — Monetary Authority of Singapore, Nov 13, 2025 (mas.gov.sg) · our page on MAS Consultation Paper P017-2025 (AI Risk Management Guidelines)
- Notice 658 Management of Outsourced Relevant Services for Banks — Monetary Authority of Singapore, Dec 11, 2023 (mas.gov.sg) · our page on MAS Notice 658 on outsourced relevant services
- Consultation Paper on Proposed Amendments to Notices on Technology Risk Management (P012-2026) — Monetary Authority of Singapore, Jun 10, 2026 (mas.gov.sg)
- Technology Risk Management Guidelines (January 2021) — Monetary Authority of Singapore, Jan 18, 2021 (mas.gov.sg) · our page on MAS Technology Risk Management Guidelines
- Guidelines on Outsourcing (Banks) — Monetary Authority of Singapore, Dec 11, 2023 (mas.gov.sg) · our page on MAS Guidelines on Outsourcing (Banks)
- Consultation Paper on Proposed Guidelines on Third-Party Risk Management (P004-2026) — Monetary Authority of Singapore, Mar 6, 2026 (mas.gov.sg) · our page on MAS third-party risk management consultation (P004-2026)
- Artificial Intelligence Model Risk Management: Observations from a Thematic Review — Monetary Authority of Singapore, Dec 5, 2024 (mas.gov.sg) · our page on MAS AI Model Risk Management information paper
- Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) — Monetary Authority of Singapore, Nov 12, 2018 (mas.gov.sg) · our page on MAS FEAT Principles
- Veritas Initiative — Monetary Authority of Singapore, Jun 26, 2023 (mas.gov.sg) · our page on MAS Veritas Toolkit 2.0
- AI Risk Management: Operationalisation Handbook (Project MindForge) — Monetary Authority of Singapore / MindForge consortium, Mar 20, 2026 (mas.gov.sg) · our page on MAS MindForge AI Risk Management Toolkit
- Safeguards for Agentic Finance at Runtime (SAFR) — Monetary Authority of Singapore, Jul 3, 2026 (mas.gov.sg) · our page on MAS SAFR white paper on AI agents
- Cyber Risks Associated with Generative Artificial Intelligence (MAS/TCRS/2024/05) — Monetary Authority of Singapore, Jul 30, 2024 (mas.gov.sg) · our page on MAS Circular MAS/TCRS/2024/05
- Cyber Risks Associated with Deepfakes (MAS/TCRS/2025/06) — Monetary Authority of Singapore, Sep 18, 2025 (mas.gov.sg) · our page on MAS Circular MAS/TCRS/2025/06
- Managing Director's remarks at the MAS Annual Report 2025/2026 media conference — Monetary Authority of Singapore, Jul 28, 2026 (mas.gov.sg)
- MAS and ABS Establish Taskforce to Strengthen Cyber and Technology Resilience against AI-driven Threats — Monetary Authority of Singapore, Jul 28, 2026 (mas.gov.sg)
- PDPA Overview — Personal Data Protection Commission, Nov 3, 2023 (pdpc.gov.sg)
- Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems — Personal Data Protection Commission, Mar 1, 2024 (pdpc.gov.sg) · our page on PDPC Advisory Guidelines on AI Recommendation and Decision Systems
- Advisory Guidelines on Use of Personal Data in Generative AI — Personal Data Protection Commission, Jul 20, 2026 (pdpc.gov.sg) · our page on PDPC Advisory Guidelines on Personal Data in Generative AI
- Model Artificial Intelligence Governance Framework, Second Edition — PDPC / IMDA, Jan 21, 2020 (imda.gov.sg) · our page on Model AI Governance Framework (Second Edition)
- Model AI Governance Framework for Generative AI — IMDA / AI Verify Foundation, May 30, 2024 (aiverifyfoundation.sg) · our page on IMDA Model AI Governance Framework for Generative AI
- AI Verify Testing Framework — AI Verify Foundation, Jun 7, 2023 (aiverifyfoundation.sg) · our page on AI Verify Testing Framework
- Model AI Governance Framework for Agentic AI — IMDA, May 20, 2026 (imda.gov.sg) · our page on IMDA Model AI Governance Framework for Agentic AI
- SR 26-2: Revised Guidance on Model Risk Management — Federal Reserve, Apr 17, 2026 (federalreserve.gov) · our page on SR 26-2
- Regulation (EU) 2024/1689 (Artificial Intelligence Act) — EUR-Lex, Jul 12, 2024 (eur-lex.europa.eu) · our page on Regulation (EU) 2024/1689
When this rule moves, the next morning's brief says so
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning