MAS AI Risk Management Guidelines: Turning AI governance into operational reality for financial institutions
While AI can unlock significant value, financial institutions remain accountable for understanding, governing and managing the risks arising from its use.
On 7 October 2026, the Monetary Authority of Singapore (MAS) has published its Guidelines on Artificial Intelligence Risk Management for Financial Institutions, outlining supervisory expectations to support the responsible adoption of AI. Applied proportionately, the Guidelines cover AI use cases, systems and models, including third-party AI and establish expectations across panning governance, risk assessment, AI lifecycle controls, third-party AI oversight, and organisational capabilities, reflecting both the growing importance of AI in financial services and the risks associated with its use.
The Guidelines signal that AI governance is entering a new phase. While many organisations have established AI principles and pilot programmes, the challenge now is operationalising them at scale. Financial institutions should view the Guidelines not simply as a compliance exercise, but as an opportunity to strengthen trust in AI adoption and build sustainable foundations for future innovation.
Key takeaways at a glance
Strengthened governance and accountability
Clear board and senior management oversight to support responsible AI adoption.
Visibility into AI use
Robust AI inventories and risk assessments to help institutions understand where AI is used and the risks it may pose.
Lifecycle risk management
Proportionate controls across the AI lifecycle, from development and deployment to monitoring and oversight.
Accountability for third-party AI
Institutions remain responsible for risks arising from third-party AI models, services and providers.
What organisations should do now
With governance requirements taking effect from 7 October 2027, followed by AI lifecycle controls and capability requirements in October 2028, financial institutions have an opportunity to assess their readiness, address gaps, and strengthen their AI governance frameworks.
As part of this process, institutions should evaluate how AI may create, alter or amplify risks within their existing risk management frameworks, including:
- Financial risk: AI may lead to inaccurate decisions and financial losses
- Operational risk: AI may disrupt critical processes and controls
- Conduct risk: AI may create unfair or unsuitable customer outcomes
- Financial crime risk: AI may enable financial crime or reduce detection effectiveness
- Reputational risk: AI failures may damage trust and reputation
Preparing for the next phase of AI governance
Speak to our AI, risk and regulatory specialists to understand what the Guidelines could mean for your organisation
We can help identify gaps, strengthen governance frameworks and develop a practical roadmap for implementation.
Contact us
Julia Leong
Banking and Capital Markets Risk Services Leader, PwC Singapore
Bhagya Perera
Partner, Technology Risk Services & Cybersecurity, PwC Singapore
+65 9670 7491
Contact
