MAS AI risk management guidelines are final: what banks must do by 2027 and 2028

What MAS issued¶

The Guidelines on Artificial Intelligence Risk Management carry a publication date of 7 October 2026. MAS states that they "apply to all financial institutions (FIs) and all forms of AI technologies." FIs are defined by reference to Section 2 of the Financial Services and Markets Act 2022, and the Guidelines apply on a group basis to locally incorporated FIs that are subject to consolidated supervision by MAS or own critical information infrastructure.

The definition of AI turns on learned behaviour. AI refers to "machine-based systems or models that derive outputs through learned premises such as the data or inputs it receives." Rule-based systems, formulae specified by hand, and robotic process automation that follows fixed instructions without learning fall outside it. The illustrative list of what falls inside includes generative AI and "AI agents (including multi-agent systems)."

The Guidelines complement existing MAS instruments. The FEAT principles (Fairness, Ethics, Accountability and Transparency) continue to apply, and MAS' outsourcing and third-party expectations apply to third-party AI. An FI in a global group may use its group framework where that framework meets the Guidelines, and local senior management must be able to show MAS how it discharges its oversight responsibilities.

Two application dates¶

Paragraph 1.8 sets the timetable: "These Guidelines take effect on 7 October 2027. FIs may meet the expectations set out in Sections 3 to 4 from 7 October 2027, and Section 5 and 6 of the Guidelines by 7 October 2028." The consultation paper had proposed a single 12-month transition after issuance. The final text keeps 12 months for the governance layer and gives a further year for the controls layer.

The split follows the structure of the document. Sections 3 and 4 decide who owns AI risk and which AI the FI has. Sections 5 and 6 decide how each use case is built, tested, monitored, changed, and retired. An FI cannot calibrate life cycle controls before it has an inventory and a materiality rating, so the order of the dates matches the order of the work.

What must be in place by 7 October 2027¶

Oversight. The board, or a committee it delegates, approves the overall governance approach for AI risk management and ensures that risks from AI use are addressed in the risk appetite framework, "including qualitative statements and quantitative measures for such risks as appropriate." MAS gives examples of quantitative measures: thresholds on the number or financial impact of AI-related incidents, the number of material AI use cases that depend on a single provider, and the number of material use cases in breach of performance thresholds. Senior management sets roles across the three lines, establishes "an internal escalation process for managing material risks and exceptions from AI use, such as AI incidents," and updates the board on material AI risk issues in a timely manner.

Identification. A designated control function owns the identification process and is "the final arbiter on whether a given use constitutes AI use." Identification must cover AI embedded in services from material third-party providers, including software sold without an AI label.

Inventory. The FI keeps an accurate inventory of AI use cases, systems, or models. Suggested attributes include purpose, approved scope of use, model type, data used, dependencies, lifecycle status, risk materiality rating, review status, owners, and links to documentation. For agents, footnote 25 adds "agent-specific identifiers, information on the tools and systems the agent can access, its components, and the guardrails imposed to manage risk."

Risk materiality. Each AI use case is assessed on at least three dimensions: impact, complexity, and reliance. Reliance includes "the extent of autonomy granted to the AI system or model and the degree of human involvement or oversight." The assessment covers inherent and residual materiality, and the residual rating must sit within risk appetite before deployment. A designated control function approves or arbitrates the ratings.

What must be in place by 7 October 2028¶

Section 5 asks for controls across the life cycle of each use case, scaled to its risk materiality. Four expectations matter most for agents.

Human oversight (5.9). Clear roles with "escalation and decision-making processes," personnel with "the necessary authority and ability to intervene," systems designed with "mechanisms to escalate AI outputs or recommendations for human review where pre-defined conditions (e.g., on reliability and accuracy) are met," and documented review of oversight decisions and interventions, including near misses. The text also names automation bias and decision fatigue.

Pre-deployment review (5.18–5.19). Review by parties not involved in development, and formal independent validation before deployment for high-materiality use cases.

Monitoring and incidents (5.23). Metrics with tiered thresholds and drift checks. "Where relevant, information flow and decision-making paths across workflows that use AI, such as reasoning processes, actions taken, tools used should also be monitored." For high-materiality AI, FIs should consider "kill switches" or override mechanisms, and for AI agents "enhanced documentation" such as logging prompts and model responses with model versions and reasoning processes.

Change management (5.25). Significant changes trigger review and re-approval, change control runs with human oversight, and version control supports the ability to roll back. Section 6 then asks for competent staff, adequate resources, and technology infrastructure sized for the use case.

Change control is where our own testing taught us the most. In KLA, publishing a policy change creates a two-person approval, and the new version stays inactive until a different approver signs it off. In our test tenants, an agent run against a policy that was approved but not yet active failed closed with a generic verification message, and the operator could not tell why. We changed the message to name the reason and the next step. The lesson for 5.25 is that every policy version needs a visible state (draft, approved, active), and the record of each agent action should name the version that was active when it ran.

What the final text says about AI agents¶

Agents appear in four places. Paragraph 1.5 states that the Guidelines set expectations "as they deploy AI, including Generative AI and newer developments such as AI agents." Paragraph 1.11 describes the risk: an agent with tool access "could autonomously execute unauthorised or erroneous actions that are not aligned with an FI's business objectives or in a customer's best interests," and compromised agents could "exfiltrate sensitive data or execute malicious commands at scale." The inventory footnote lists agent attributes, and the monitoring paragraph names actions and tools.

MAS also points FIs to IMDA's Model AI Governance Framework for Agentic AI as a reference for agent-specific practices. The media release adds the forward step: "In 2027, MAS intends to further consult the financial sector on what additional guidance on agentic AI would be useful." Until then, the Guidelines are the supervisory baseline for agents, applied through the same inventory, materiality, oversight, and monitoring expectations as any other AI.

Read together, these passages describe an agent program MAS can supervise: every agent registered with its tools and guardrails, autonomy scored under reliance, a defined point where proposed actions escalate to a person with authority to intervene, a record of actions and tool calls, and a tested way to stop the agent.

What changed from the consultation draft¶

Timing. The consultation proposed 12 months from issuance. The final text gives 12 months for Sections 3 and 4 and 24 months for Sections 5 and 6.

Committees. The consultation proposed a dedicated cross-functional committee where an FI's AI risk exposure is material. The media release states that existing governance structures may be used and a dedicated AI committee is not required. The board or a committee it delegates carries the Section 3 responsibilities.

Basic policies. Paragraphs 2.3 to 2.5 set a defined route for FIs whose AI use would not have a material adverse impact if it performed poorly or became unavailable. Those FIs may apply basic AI governance policies: an accountable senior manager, permitted and prohibited uses with human review requirements, an approved list of AI tools, staff education, regular compliance checks, and periodic review of whether the FI still qualifies. The examples are drafting assistance, internal summaries, and internal search. An agent that acts inside a production workflow does not fit them.

Where SAFR stands¶

The final Guidelines do not mention SAFR (Safeguards for Agentic Finance at Runtime), the white paper from MAS' BuildFin.ai programme. Two days after the Guidelines, on 9 October 2026, BuildFin.ai published SAFR version 1.1, which clarifies scope and implementation approach and adds case studies. Version 1.1 states that SAFR "does not constitute regulatory guidance or supervisory expectations, nor does it prescribe or anticipate future directions for such guidance or expectations."

SAFR therefore remains a voluntary reference, and MAS has made no commitment to make it mandatory. Its value for an FI is practical: it describes runtime machinery (agent identity, mandates, a disposition for each proposed action, and an audit log) that produces the oversight and monitoring records Section 5 asks for. The SAFR explainer covers the specification, and How to implement SAFR walks through a worked mandate and decision record.

What to do before 7 October 2027¶

The first deadline is a governance deadline, and most of its work is discovery. Three tasks fit the next two quarters. Name the control functions for identification, inventory, and materiality, and get the board to approve the governance approach and AI risk appetite measures. Build the inventory with the agent attributes from footnote 25, third-party and embedded AI included. Rate every use case on impact, complexity, and reliance, so that the high-materiality agents are known before the life cycle work starts.

For high-materiality agents, start the 2028 work early. A runtime checkpoint that evaluates each proposed action before it executes, routes defined cases to a named reviewer, and records the action, the policy version, the outcome, and any human decision produces the oversight and monitoring evidence Section 5 describes. KLA Control Plane implements this pattern with four outcomes: allow, warn, require_approval, and block.