What MAS announced on 7 October 2026
Singapore’s financial institutions now have a final framework for managing artificial intelligence (AI) risk. On 7 October 2026, the Monetary Authority of Singapore (MAS) issued its Guidelines on Artificial Intelligence Risk Management, following the November 2025 consultation.
Your firm needs to know where it uses AI, assess what could go wrong, assign responsibility and keep evidence that the controls work. Buying AI from a vendor leaves the financial institution accountable for its use.
The guidelines set out supervisory expectations that complement existing legislation and MAS guidance. The Fairness, Ethics, Accountability and Transparency (FEAT) principles continue to apply. For know your customer (KYC) teams, existing anti-money laundering and countering the financing of terrorism (AML/CFT) requirements still govern customer due diligence and approval decisions.
This guide explains the final guidelines for compliance leaders, fund managers and teams considering AI-assisted KYC. Paragraph references below refer to the final MAS text. The KYC examples and implementation suggestions are ours.
Two deadlines: October 2027 and October 2028
MAS allows phased implementation under paragraph 1.8:
- From 7 October 2027: meet Sections 3 and 4. These cover AI oversight and the systems, policies and procedures for identifying AI, maintaining an inventory and assessing the risk of each use case.
- By 7 October 2028: meet Sections 5 and 6. These cover controls throughout the AI life cycle, staff capabilities and capacity, and the technology infrastructure supporting AI.
The guidelines take effect on 7 October 2027. The later deadline does not defer existing obligations on data protection, technology risk, outsourcing or AML/CFT. A sensible first step is to identify who owns the implementation programme and compare current controls with each section.
Who is covered, and when basic governance is enough
The guidelines apply to all financial institutions within the definition in Section 2 of the Financial Services and Markets Act 2022. They cover all forms of AI, including machine learning, generative AI and AI agents. Third-party services and AI features embedded in existing software also need attention.
A tool whose outputs follow only predefined programming rules would not ordinarily count as AI under this definition. An AI service does not fall outside the framework simply because the procurement team calls it “document processing”.
MAS takes a risk-proportionate approach. Under paragraph 2.3, basic governance may be sufficient where poor performance or unavailability of the AI services or tools used by the institution is unlikely to have a material adverse impact on the firm, customers or other stakeholders. Firm size alone does not decide this.
MAS gives examples such as proofreading emails and summarising meeting notes for internal reference, with humans checking outputs before use. Even then, paragraph 2.5 expects:
- clear accountability for AI oversight;
- permitted and prohibited uses, together with effective human oversight;
- an approved list of AI tools and a process for approving new ones;
- staff education on AI policies;
- regular compliance checks;
- periodic and trigger-based reassessment of whether the basic-governance criteria still hold.
A KYC summary that influences a customer risk rating deserves a different assessment from a summary of an internal meeting. Consider the actual consequences of an error before assigning the workflow to the basic-governance category.
Make AI use visible and assign responsibility
Sections 3 and 4 address governance at both the institution and individual use-case levels. The board and senior management should oversee AI risk, establish responsibilities and ensure the firm’s risk appetite explicitly addresses AI.
You do not need a new AI committee solely to meet the guidelines. MAS says existing structures can work if they provide adequate oversight and coordination across functions. A global group framework can also be used, but local senior management remains accountable for Singapore-specific considerations.
The AI inventory should be useful to the people overseeing the work. Paragraph 4.7 gives examples of attributes to record: the purpose, approved scope, models, data, dependencies, owners, risk rating and links to relevant documentation. An existing inventory can be expanded if it supports the necessary oversight.
Risk assessment should cover at least impact, complexity and reliance. In plain language: how much harm could an error cause, how difficult is the AI to understand, and how much does the business depend on its output? Assess risk before controls and the risk remaining after controls. The latter must fit the institution’s risk appetite before deployment.
For an AI-assisted KYC workflow, we recommend documenting which tasks the AI performs, which decisions remain with people, what customer information it processes and who can stop its use. Include the provider and relevant dependencies so the procurement record and AI inventory describe the same service.
Test the workflow and keep humans able to intervene
Section 5 covers the full AI life cycle, from selection and development through deployment, monitoring, changes and retirement. It includes data governance, transparency and explainability, fairness, human oversight, security and documentation.
For KYC, a useful test set should include difficult files: a blurred identity document, conflicting ownership records, a similarly named sanctions match and missing source-of-wealth evidence. Our recommendation is to measure whether the workflow identifies the problem and routes it correctly. A fast, confidently written case with the wrong beneficial owner is still a failed case.
MAS expects testing against measurable thresholds before deployment. Paragraphs 5.18–5.20 call for reviews by parties not involved in development, with independence proportionate to risk. High-risk use cases should undergo formal independent validation before deployment. A human checking individual KYC files serves a different purpose from independent validation of the AI system.
Human oversight also needs substance. Paragraph 5.9 addresses competent people with the authority and ability to intervene, clear escalation paths, records of interventions and reviews of their effectiveness. MAS explicitly calls out automation bias and decision fatigue. A reviewer who routinely accepts the AI’s conclusion without checking the evidence provides weak assurance.
After launch, monitor performance and incidents, review material changes and keep records of remedial action. High-risk use cases should have tested fallback plans. Section 6 also expects sufficient staff skills, resources and supporting infrastructure; a policy document alone cannot provide those.
Third-party AI still needs your oversight
Using a managed service does not transfer accountability for AI risk. Paragraphs 5.10–5.11 address third-party assurance, suitability for the intended use and visibility into changes. Contracts should support a risk-appropriate level of visibility when AI is introduced or updated.
Before relying on an AI KYC provider, our suggested due-diligence questions are:
- What does the AI do, which models or services does it depend on, and what are its known limitations?
- What testing and independent assurance can we inspect for our intended use?
- Where does customer data go, who can access it, and what are the retention and model-training arrangements?
- How are human interventions, exceptions and incidents recorded and escalated?
- How will we learn about material changes, and what happens if the service fails or must be stopped?
MAS recognises that providers may not disclose everything. Additional testing or stronger human oversight can help compensate for gaps. If the remaining risk cannot be brought within the institution’s risk appetite, it should consider limiting, suspending or replacing the service. A certification is useful only to the extent that its scope covers the risks being assessed.
AI agents deserve particular attention because they can access tools and take actions. We recommend checking their permissions, approval boundaries and ability to affect customer records. MAS plans to consult the sector in 2027 on useful additional agentic AI guidance. The current guidelines already cover AI agents; firms should not wait for that consultation to assess them.
How AgentKYZ supports this approach to AI KYC
AgentKYZ combines AI-assisted case preparation with qualified human review. Our operating model supports several controls MAS describes, particularly policy-led work, human oversight and evidence that a reviewer can inspect.
The workflow starts with your AML policy, checklists and risk appetite. AgentKYZ agents read documents, chart ownership, screen sanctions, politically exposed persons and adverse media, and prepare the case with documented reasoning. A qualified compliance reviewer checks the work and tests the conclusions. Overrides require a written reason; high-risk and complex cases go to senior compliance.
The delivered file includes a risk assessment, screening rationale, indexed documents and an audit trail. Your money laundering reporting officer (MLRO) retains final approval. Teams can use AgentKYZ’s review software themselves or engage our managed KYC service in Singapore.
That separation of case preparation, review and client approval gives an institution a practical basis for human oversight. Documented reasoning and source records support scrutiny of individual KYC conclusions. Assess model-level explainability separately as part of the deployment review.
Client documents are not used to train a model. Before deployment, confirm the engagement’s data flows, hosting, access and retention arrangements, alongside the testing evidence and change-notification process your institution needs. Your firm remains responsible for its AI inventory, risk assessment, vendor due diligence and ongoing oversight.
Start with one defined KYC use case
For a first deployment, we recommend a bounded workflow such as preparing periodic-review files for human assessment. Set the permitted tasks, data boundaries, accountable owner and acceptance criteria before processing live cases. Have the appropriate control functions assess the risks and determine the necessary testing, review and approvals.
Use the results to decide whether to proceed, narrow the scope or strengthen controls. Keep the AI risk assessment alongside your AML/CFT obligations; our MAS AML/CFT requirements guide covers the separate fund-manager and VCC framework.
To assess AgentKYZ for that workflow, talk to us about your Singapore KYC requirements. Bring the proposed use case, your AML policy and the assurance questions your risk team needs answered.