MAS, Basel and the missing control layer.

01 / What MAS requires

A proportionate framework across the AI lifecycle.

The Guidelines set high-level supervisory expectations and let financial institutions scale their approach to the nature and materiality of their AI use. Existing governance structures can be used where they provide effective oversight and cross-functional coordination; MAS says a dedicated AI committee is not required solely to meet the Guidelines.

Scope

All financial institutions to which the Guidelines apply, and all forms of AI technology.

Oversight

The board and senior management oversee AI risk, with clear accountabilities, risk appetite and coordination across functions.

Inventory and materiality

Identify AI use, maintain an inventory and assess the materiality of each use case.

Lifecycle controls

Apply proportionate controls for data, testing, human oversight, cybersecurity, monitoring and change management.

Third-party AI

The institution remains accountable, seeks risk-appropriate assurance and considers limiting, suspending or replacing a service when residual risk exceeds its appetite.

Implementation

The Guidelines take effect on 7 October 2027. Institutions may meet Sections 3–4 from that date and Sections 5–6 by 7 October 2028.

The Guidelines cover agents as AI rather than establishing a separate agent rulebook. They do, however, call out agent-specific inventory details such as identifiers, tools and systems the agent can access, its components and the guardrails applied. MAS also says firms should review controls as autonomous systems and tool access grow, and plans to consult the financial sector in 2027 on what additional agentic-AI guidance would be useful.

MAS Guidelines on AI Risk Management · MAS media release, 7 October 2026

02 / Different instruments, same challenge

These authorities are answering different questions.

MAS asks how an institution governs AI. Basel asks whether its operational-risk event categories remain adequate. The FSB offers international reference points; the FCA examines whether existing accountability regimes can flex; the EU sets obligations for high-risk AI systems and the organisations that provide or deploy them.

The Basel Committee’s own wording is telling: integrating AI into critical functions “will require careful governance, robust risk management and ongoing supervisory attention.” Supervisory expectations on runtime control are also becoming clearer through MAS and SAFR. Each institution still has to show that its controls are implemented, effective and open to independent challenge.

Basel Committee, 1 October 2026 · FSB Chair’s note, 12 October 2026 · FCA-commissioned Mills Review, pp. 8 and 107

03 / Governance at design time, control at runtime

Approval and live authority need different evidence.

MAS expects monitoring and change management across the AI lifecycle. In practice, governance evidence is often strongest at approval, while autonomous activity needs continuous evidence that controls remain effective. This is an analytical distinction, not MAS’s formal classification.

An inventory can show that an agent was approved. It cannot show whether the agent’s actions stay within its authorised boundaries. A human approval step is not an effective control if the person approving cannot understand the chain of actions they are authorising.

MAS’s SAFR work points in the same direction. The Safeguards for Agentic Finance at Runtime white paper was developed with financial institutions and fintechs under BuildFin.ai. In his 9 October keynote, MAS Managing Director Chia Der Jiun said version 1.1 had been published with a wider group of contributors, and that an open-source reference implementation was available through the Future of Finance Institute.

SAFR describes three runtime elements: establish agent identity and authorisation; check proposed actions against the user’s mandate before execution; and maintain accountability and auditability. The reference implementation makes that design more concrete. It supports experimentation and implementation; it does not certify a firm’s regulatory compliance. SAFR remains an industry-developed framework, while MAS’s Guidelines set the supervisory expectations.

MAS Managing Director Chia Der Jiun, 9 October 2026 · SAFR white paper

04 / The RCSA test

Does your framework see the agent or just the application?

Consider an illustrative scenario. An AI agent is approved to support payment investigations. It can retrieve customer information, query transaction systems and draft recommendations. Over time, its permissions are widened so it can modify records and start workflow actions.

On paper, the framework looks complete: an approved use case, an accountable business owner, a materiality rating and completed model testing. The test is whether it can answer six further questions:

1. 01

   Who authorised the additional permissions?

2. 02

   Was the change assessed against the use that was originally approved?

3. 03

   What stops the agent acting outside its mandate?

4. 04

   Can control teams reconstruct the full sequence of decisions it took?

5. 05

   Who can stop it, and how quickly?

6. 06

   Would the incident be visible through existing KRIs, RCSA and incident reporting?

Traditional risk assessment processes often put more emphasis on approval and periodic reassessment than on changing permissions and operational authority. If an RCSA describes the application but not the agent’s current authority, a boundary breach may surface through its consequences rather than through a control.

A practical division of labour is for the first line to operate the technical controls that detect and prevent unauthorised actions, while operational risk provides the framework, challenge, aggregation and escalation. An RCSA is not itself a runtime detection mechanism. It should establish that runtime controls exist, have clear owners and are working.

The evidence also has to be independently reconcilable. An agent’s declaration of what it intends to do is not necessarily reliable evidence of what it actually did. The harder test is whether the institution can reconcile authorised actions, actual execution, policy decisions and subsequent exceptions.

05 / What this means for EMEA operational risk

Integrate the controls firms already have.

For EMEA institutions the challenge is integration rather than regulatory invention. UK model-risk expectations, operational-resilience frameworks and European third-party and AI obligations already create overlapping responsibilities. The PRA’s SS1/23, for example, includes a principle on identifying and managing AI risks for UK-incorporated banks, building societies and PRA-designated investment firms with internal model approvals. Its scope is not universal across UK banks, but it is a relevant comparator.

The question is whether these arrangements together cover an agent’s operational authority, changing permissions and ability to act across systems, without leaving gaps between risk and control owners. Four practical implications follow. They are analysis rather than regulatory requirements.

1. Separate ownership of risk from ownership of controls. Accountability for the business use, technical system, control design and independent challenge can sit with different people. The test is whether each responsibility is unambiguous across organisational boundaries.
2. Inventory what agents can do. Record the tools an agent can call, the permissions it holds and changes to those permissions over time, alongside the model and use case. MAS specifically highlights agent identifiers, accessible tools and systems, components and guardrails as relevant inventory attributes.
3. Plan for third-party exit. MAS expects firms to consider limiting, suspending or replacing a third-party AI service if risk cannot be brought within appetite. Map that alongside DORA’s register of information and the EBA’s third-party risk Guidelines, which have a two-year transition.
4. Mind the Singapore clock. A group with a MAS-supervised entity has its first implementation date on 7 October 2027. A common group baseline may be simpler to operate than regional variants, while preserving local tailoring and proportional treatment for low-materiality use.

PRA SS1/23 · DORA, Regulation (EU) 2022/2554 · EBA third-party risk Guidelines, 18 September 2026

The control question

Can the institution prove what its AI is authorised to do?

The test of AI governance is no longer only whether a system was approved or whether its risks were assessed. It is whether the institution can establish what that system is authorised to do, detect when it exceeds those boundaries and intervene before an error becomes an incident. For operational-risk functions, that means looking beyond the application to the controls governing the actions it can take.