• The Monetary Authority of Singapore issued its AI risk guidelines on 7 October 2026; they take effect on 7 October 2027.
• Sections 3 to 4 apply from 7 October 2027, and Sections 5 and 6 by 7 October 2028, according to MAS.
• The Guidelines apply to all financial institutions and all forms of AI, with controls scaled to the materiality of each use case.
• Institutions remain accountable for AI supplied by third parties and should seek sufficient assurance from providers.
• Independent review is reported by Finextra, but the MAS media release does not mention it; read the Guidelines text before planning compliance work.

Singapore's central bank has finalised its rules for AI at financial institutions, but the most-quoted detail is the least documented. Finextra reports that banks must seek independent review of forthcoming AI projects before implementation. The Monetary Authority of Singapore's own media release, issued on 7 October 2026, sets out scope, materiality-based controls, third-party accountability and a phased timeline, and does not mention independent review. Both facts matter to any bank sizing the compliance work.

The Guidelines take effect in October 2027

MAS says the Guidelines on Artificial Intelligence Risk Management take effect on 7 October 2027. Institutions can phase implementation: Sections 3 to 4 apply from that date, and Sections 5 and 6 by 7 October 2028. That gives banks roughly a year before the first obligations bite and two before the full set applies, which is enough time to inventory AI use cases and build review processes rather than retrofit them.

Controls scale with materiality, not with size

According to MAS, institutions should assess the risk materiality of their AI use cases and apply controls accordingly. Basic policies may suffice where poor performance or unavailability of an AI tool is unlikely to have a material impact on the institution, its customers or other stakeholders. The Guidelines apply to all financial institutions and all forms of AI, so the proportionality sits in the control depth, not in who is covered.

Third-party AI stays the bank's responsibility

MAS states that institutions remain accountable for AI used in the services they deliver, including AI from third parties. They should obtain sufficient assurance from providers and apply compensating controls where gaps arise. If risks fall outside risk appetite, MAS says institutions should consider limiting, suspending or replacing the service. In practice this moves vendor due diligence from a procurement step into a continuing risk-management duty.

What is reported, and what is documented

Finextra's summary says banks must seek an independent review of forthcoming AI projects before implementation. The MAS release refers to testing and monitoring across the AI life cycle but says nothing about independent review or who qualifies as independent. Until the Guidelines text is read, the review requirement, its materiality threshold and its definition of independence should be treated as reported rather than confirmed.

What compliance teams should do now

Teams should read the full Guidelines, then build a register of AI use cases with a materiality rating for each, including AI embedded in vendor services. The register drives everything the MAS release describes: which controls apply, which providers need assurance, and where review is needed. It also gives the bank evidence of progress well ahead of the October 2027 effective date.