MAS AI Risk Management Guidelines: Turning AI governance into operational reality for financial institutions
While AI can unlock significant value, financial institutions remain accountable for understanding, governing and managing the risks arising from its use.
On 7 October 2026, the Monetary Authority of Singapore (MAS) has published its Guidelines on Artificial Intelligence Risk Management for Financial Institutions, outlining supervisory expectations to support the responsible adoption of AI. Applied proportionately, the Guidelines cover AI use cases, systems and models, including third-party AI. They set expectations for governance, risk assessment, lifecycle controls, third-party oversight and organisational capabilities, reflecting AI’s growing role in financial services and the associated risks.
The Guidelines signal that AI governance is entering a new phase. While many organisations have established AI principles and pilot programmes, the challenge now is operationalising them at scale. Financial institutions should view the Guidelines not simply as a compliance exercise, but as an opportunity to strengthen trust and confidence in AI adoption and build sustainable foundations for future innovation.
What financial institutions should do now
With governance requirements taking effect from 7 October 2027, and lifecycle controls and capability requirements in October 2028, financial institutions have an opportunity to assess their readiness, address gaps and operationalise AI governance across the enterprise.
Risk management operating model
As AI becomes embedded in products, processes and decision-making, financial institutions need clear accountability for managing the risks, from the board and senior management through to the first, second and third lines of defence. With AI risk now part of the risk taxonomy, institutions should enhance their risk and control operating models to ensure AI risks are consistently identified, assessed, controlled, monitored and reported alongside other enterprise risks. Institutions leveraging Group-level frameworks should ensure they remain locally relevant and meet MAS's expectations.
As agentic AI systems take on more autonomous, operating model should also define where human oversight is required, set clear boundaries and enable timely intervention.
Key areas of support:
- AI risk and control operating model uplift as expanded ERM scope
- Roles and responsibilities across the three lines of defence
- AI risk appetite, metrics and reporting
- Overall readiness and gap assessment against the Guidelines
- Future-proofing the risk management and control operating model for agentic and autonomous AI
AI inventory and materiality assessment
Financial institutions cannot manage what they cannot see. A complete and up-to-date AI inventory is the foundation for proportionate risk management, enabling institutions to understand where AI is used across the organisation, including third-party solutions and end-user tools. Each use case should be consistently assessed based on factors such as impact, complexity and reliance, applying oversight and controls proportionate to the risks.
Key areas of support:
- AI use case identification and inventory build
- Risk materiality assessment methodology
Data governance
As AI adoption grows, strong data governance becomes critical. Financial institutions should understand what data (structured, semi-structured and unstructured) is used by AI systems, where it resides, who is accountable for it, and whether appropriate controls are in place to maintain data quality, security and privacy, particularly as AI increasingly relies on unstructured data.
Key areas of support:
- Unstructured data governance as an expanded scope
- Data governance and risk management
- Data quality, security and privacy considerations
Cyber resilience
AI is reshaping the cyber threat landscape, introducing risks ranging from deepfakes and social engineering attacks to data leakage, prompt injection and vulnerabilities associated with autonomous AI agents. Effective cybersecurity controls are critical to protecting data, privacy and supporting operational resilience.
Key areas of support:
- AI-related cyber risk assessment
- Cybersecurity and resilience strategies
- AI security and control considerations throughout AI lifecycle
Third-party AI oversight
As financial institutions increasingly adopt AI-enabled solutions from third parties, maintaining visibility and oversight is critical. Institutions should understand where third-party AI is being used, the purpose and the risks it may introduce. While AI may be provided by external vendors, accountability remains with the financial institution.
Key areas of support:
- Third-party AI risk management
- Third-party assurance considerations
AI talent and capabilities
Effective AI risk management requires the right skills and knowledge. Boards and senior management need sufficient understanding of AI to provide meaningful oversight, while risk, compliance and audit functions must be equipped to challenge and provide assurance over AI use. Building these capabilities, alongside the supporting technology infrastructure, takes time and should begin well before October 2028.
Key areas of support:
- Board and senior management AI risk training
- Risk culture in the age of AI
- Skills development for second- and third-line functions
- AI capability and infrastructure roadmap
We are one of the accredited third-party AI testing service providers under the AI Tester Accreditation Programme by the AI Verify Foundation to assess the safety and reliability of AI systems.
AI testing capability has been independently assessed
Testing approach aligned with IMDA's Starter Kit for Testing LLM-Based Applications
Credible, third-party evidence clients can rely on ahead of go-live
Risk areas covered by our accreditation:
- Hallucination and inaccuracy
- Undesirable content
- Data leakage
- Vulnerability to adversarial prompts
- Bias and fairness
Preparing for the next phase of AI governance
Speak to our AI, risk and regulatory specialists to understand what the Guidelines could mean for your organisation
We can help identify gaps, strengthen governance frameworks and develop a practical roadmap for implementation.
Contact us
Julia Leong
Banking and Capital Markets Risk Services Leader, PwC Singapore
Kyra Mattar
Partner, Financial Services Technology Risk Services, PwC Singapore
Bhagya Perera
Partner, Technology Risk Services and Cybersecurity, PwC Singapore
+65 9670 7491
Contact
