MAS Guidelines on AI Risk Management, 7 October 2026: What Singapore Expects Banks and Insurers to Do About AI Inventories, AI Agents and Kill Switches by 2027 and 2028
On 26 February 1995 Barings, Britain's oldest merchant bank, was placed in administration. The losses had been built up in Singapore by a single trader, Nick Leeson, who ran both the trading desk and its back-office settlement at the Singapore International Monetary Exchange. He hid the losses in an error account numbered 88888. An internal audit of the Singapore subsidiary in August 1994 had pointed to weaknesses in its risk management structure and controls, but, as a Reserve Bank of Australia summary of the Bank of England inquiry puts it, its recommendations were not acted upon quickly enough, or not at all. The case left every financial supervisor with a lasting lesson about any actor that can commit the firm: know it exists, know what it may touch, and keep the power to stop it.
The same lesson runs through the document the Monetary Authority of Singapore published on 7 October 2026. Its Guidelines on Artificial Intelligence Risk Management are the final version of a consultation MAS opened in November 2025. They are supervisory guidelines whose verb is "should", and they set out what MAS examiners will expect to see. And the newest actor in the document is the AI agent, which MAS describes as software that may be "granted greater autonomy and access to tools."
Practical takeaway. From 7 October 2027, a Singapore financial institution with material AI use is expected to identify its AI, list it in an inventory, rate each use case for impact, complexity and reliance, and give its board an AI risk appetite; institutions whose AI is unlikely to have a material adverse impact may apply a shorter set of basic policies. Life cycle controls, including fallback plans for high-risk AI and tested activation protocols where an institution has built a kill switch, may be phased in until 7 October 2028. AI agents are inside the scope now; MAS has said that more specific agentic guidance will come through a consultation in 2027.
Who the MAS guidelines cover and when each section applies: 7 October 2027 and 7 October 2028
The scope is broad. The guidelines apply to financial institutions as defined in Singapore's Financial Services and Markets Act 2022, which covers banks, insurers, capital markets firms and payment providers, and they apply on a group basis to locally incorporated institutions under consolidated MAS supervision or that own critical information infrastructure. MAS defines AI as a machine-based system that derives outputs "through learned premises such as the data or inputs it receives." A footnote lists machine learning, deep learning, natural language processing, computer vision, generative AI including large language models, and "AI agents (including multi-agent systems)." Rule-based systems, spreadsheets with hand-written formulas and robotic process automation that does not learn are excluded.
The timetable comes in two steps. Paragraph 1.8 says the guidelines take effect on 7 October 2027, when institutions should meet Sections 3 and 4 on oversight, identification, inventory and risk rating. Sections 5 and 6, on life cycle controls and on capability and capacity, may be met by 7 October 2028. The sequence is sensible: an institution cannot apply controls to AI it has not yet found.
There is a lighter path. Paragraph 2.3 lets an institution apply only basic policies when the failure of its AI tools "is unlikely to have a material adverse impact" on the firm or its customers. MAS gives examples: drafting emails, summarizing meeting notes, generating charts for internal use, internal search chatbots. Even then the institution needs a named senior manager accountable for AI, a list of permitted and prohibited uses, an approved list of tools and staff training.
How MAS wants each AI use case rated: impact, complexity and reliance
The core of the document is Section 4. An institution should identify AI across every business line, including AI embedded in services from material third-party providers, and maintain an inventory of AI use cases, systems and models. Paragraph 4.7 suggests what each entry holds: purpose, approved scope of use, model type, data, dependencies, life cycle status, risk rating, review status, owners and links to documentation.
Each use case is then rated for risk materiality, before and after controls, and the residual rating must sit within the board's appetite before deployment. Paragraph 4.12 names three minimum dimensions. Impact covers the consequences of failure for the institution and for customers, including fairness and consumer protection. Complexity covers the novelty of the technology and how explainable it is, and for bought-in AI, how much the institution can see inside it. Reliance covers how much the decision depends on the AI, "including the extent of autonomy granted to the AI system or model and the degree of human involvement or oversight." A designated control function, separate from the business unit, arbitrates the rating.
That third dimension, reliance and autonomy, is where agents enter the arithmetic. An agent that drafts a reply for a human to send carries low reliance. An agent that executes a payment, amends a customer record or calls an external tool without review carries high reliance, and the rating rises with it. Footnote 25 adds that for agents the inventory may record "agent-specific identifiers, information on the tools and systems the agent can access, its components, and the guardrails imposed to manage risk." At Barings, supervision and follow-up failed to hold Leeson's actual activity to his mandate; for agents, MAS now asks institutions to write down both the tools an agent can reach and the guardrails on it.
What MAS expects for AI agents, fallback plans and kill switches
Paragraph 1.11 states the agent risk plainly. An agent with tool access "could autonomously execute unauthorised or erroneous actions" when its interpretation of a goal diverges from the institution's objectives or the customer's interest, and a compromised agent with access to internal systems "could be used to exfiltrate sensitive data or execute malicious commands at scale." MAS points institutions to the Model AI Governance Framework for Agentic AI published by Singapore's Infocomm Media Development Authority, and, according to its media release, will consult industry in 2027 on what further agentic guidance would help.
The controls that already apply are in Section 5. For any use case rated high risk, paragraph 5.3 asks for contingency plans with fallbacks such as alternative systems or manual processes, reviewed and tested under a range of operating conditions. Where an institution has built a kill switch, which MAS defines as a mechanism to deactivate AI "expeditiously if they exceed risk tolerances," clear activation protocols should exist and be tested regularly. Paragraph 5.23 asks institutions to monitor deployed AI against defined thresholds and, where relevant, to monitor "reasoning processes, actions taken, tools used." For high-materiality AI it asks institutions to consider kill switches or override mechanisms, and to name an accountable person for incidents.
Quentir's reading of the Congressional Research Service sidebar on AI agents and federal criminal intent found that US law struggles to name a responsible human when an agent breaks a rule nobody intended it to break. The MAS document approaches the same gap from the supervisory side and before deployment: a designated control function rates the agent, an accountable person owns its incidents, and, for high-risk uses, a fallback plan exists and any kill switch has a tested activation protocol.
Why a bank that buys its AI from a vendor stays accountable
Most institutions will buy their AI from vendors. Paragraph 5.11 is direct: the decision to use third-party AI "is ultimately a decision of the FI," and the institution "retains primary accountability" for it. Contracts should give the institution visibility over the introduction of AI into a service and over later model changes. Third-party AI should be tested against the institution's own use cases and data, with compensatory testing where vendor disclosure is thin, and certifications should come from independent parties, "not self-attestations." If residual risk cannot be brought within appetite, the institution should consider limiting or suspending the service or replacing the provider. Footnote 18 suggests a quantitative appetite measure: the number of material AI use cases that depend on a single provider.
The consequences reach well beyond Singapore. A global AI vendor selling to a Singapore bank will face contract clauses asking for change notification, test access and independent assurance. The household on the other side sees the result in credit scoring, insurance underwriting and financial advice, the uses MAS singles out in footnote 12 for transparency, explainability and fairness controls.
How Quentir Reads It
Singapore has taken the supervisory route. The EU AI Act lists creditworthiness assessment among its high-risk uses and attaches fixed obligations to that category. MAS instead asks each institution to rate its own uses on stated dimensions and then examines whether the rating and the controls are credible. The US remains closer to the second model than the first: bank AI is handled through model risk and third-party guidance, and the debate continues over whether AI firms themselves should be chartered like banks, a proposal Quentir tested in its read of Pramila Jayapal's National AI Charter Act framework. Singapore's document goes a step further on agents than a general risk framework: it suggests that the inventory entry for an AI agent list the tools and systems it can access and the guardrails imposed on it.
Two things will show whether it works. The first is the 2027 agentic consultation, which will indicate whether MAS keeps agents inside the general framework or adds specific controls on tool permissions and delegation. The second is the first round of supervisory inspections after 7 October 2027, which will show how completely institutions have found and listed their AI, to the extent MAS makes its findings public. Institutions that follow AI regulation across Singapore, the EU and the US can find this post and the earlier analyses it links in one place through the All-access membership, which carries the full Quentir archive.
Sources: Monetary Authority of Singapore, Guidelines on Artificial Intelligence Risk Management, 7 October 2026 (paragraphs 1.3, 1.5, 1.8, 1.11, 2.3 to 2.5, 3.4, 4.2, 4.7, 4.12, 4.13, 5.3, 5.10, 5.11 and 5.23 and footnotes 6, 12, 18, 25 and 29), with the guidelines page and response to feedback; Monetary Authority of Singapore, "MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions", media release, 7 October 2026; Infocomm Media Development Authority, Model AI Governance Framework for Agentic AI; Reserve Bank of Australia, "Implications of the Barings Collapse for Bank Supervisors", Bulletin, November 1995, summarizing the Bank of England Board of Banking Supervision report of July 1995.
Published intelligence, built to inform your own decisions. Published: October 12, 2026.