MAS gives Singapore's financial firms until October 2028 to fully comply with new AI risk guidelines

"Financial institutions should obtain sufficient assurance from third-party providers, assess whether third-party AI is suitable for their intended use, and apply compensating controls where practical constraints or assurance gaps arise," the central bank said ^[3]. The cost sits in the last clause. MAS writes the assurance gap in as an ordinary condition of buying AI ^[3]. The buyer closes it, using the testing, monitoring and human oversight it already has to run on each use case ^[6].

The guidelines were issued on Wednesday. They start to bind 12 months later and apply in full after 24 ^[13]. That gives a bank one year to write evidence and exit terms into its vendor contracts before the obligations start, and a second year to finish the work across every use case in its inventory.

There are a few ways the gap gets paid for. The large AI vendors could publish standard assurance packages mapped to the guidelines, so the cost is borne once and shared across every Singapore client. Vendors could instead decline, leaving each bank to close the gap with staff time that eats into whatever saving the tool was bought to deliver. Or banks could keep vendor AI to use cases they rate as low risk, where MAS asks only for proportionate controls ^[6].

For the most capable models, I'd expect the second outcome. According to CNA, Josephine Teo, Singapore's Minister for Digital Development and Information, said last week that the safeguards frontier AI companies have put in place are not enough to deal with the risks that increasingly capable systems pose ^[10]. A government that holds that view is unlikely to let a bank treat those same safeguards as sufficient assurance.

The counter-case is in the verbs. Limiting or replacing a vendor is something a firm should consider ^[4], measured against a risk appetite set under its own board's oversight ^[9]. The release does not say how MAS will test that judgement. "MAS will continue to work with the industry to advance sound AI risk management practices in a practical and industry-grounded manner," said Ho Hern Shin, MAS deputy managing director ^[12].

MAS also spared firms a new governance layer. A dedicated AI committee is unnecessary where existing structures provide adequate oversight and cross-functional coordination ^[7]. The money goes into controls on each use case and into managing vendors.

The view is wrong if, by the Oct 7, 2028 deadline ^[5], Singapore banks are running vendor models with little added human review and have dropped no vendor. That would mean vendor paperwork, or a wide board risk appetite, closed the gap at no extra cost to the bank.