The Monetary Authority of Singapore told banks and insurers on 7 October that they remain accountable when third-party chatbots mishandle customer data or misstate policy terms, publishing phased AI guidelines that start with governance inventories in October 2027 and tighten testing by October 2028.
“Financial institutions remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties,” MAS said, addressing a gap where vendors marketed “plug-in” large language models to call centres without board-level oversight.
Phased compliance clock
From 7 October 2027, firms must maintain registries of AI tools, conduct risk assessments, and document contingency plans when models behave unexpectedly. A year later, institutions need rigorous monitoring, human-in-the-loop controls, and staffing to operate systems safely. MAS said it will consult further on agentic AI in 2027, acknowledging tools that can chain actions without per-step approval.
Why DBS, OCBC and UOB care
Retail apps already use AI for spending insights and fraud alerts. Vendor contracts will now need explainability clauses, exit ramps if a model drifts, and audit rights for MAS examiners. Wholesale banks experimenting with document summarisation for trade finance face similar forms.
Link to the Digital Infrastructure Bill
Parliament passed the Digital Infrastructure Bill the same week, tightening data-centre resilience. AI workloads hosted in licensed halls will therefore face both facility-level continuity rules and model-level governance, a stacked compliance picture for chief technology officers.
Customer-facing impact
Borrowers may see slower rollouts of flashy chat features, but more explicit disclosures when bots answer loan queries. MAS emphasised that human agents must remain reachable when AI confidence scores fall below internal thresholds.
For scam-weary customers, the guidelines dovetail with police advisories: banks should not let generative tools improvise payment instructions without hard-coded guardrails. Whether that reduces phishing success will depend on implementation, not the PDF alone.
Insurers experimenting with claims triage bots must document training data provenance and bias tests before MAS exams in 2028. Fintech challengers that white-label bank rails will inherit the same accountability chain, closing a loophole where start-ups argued the sponsor institution bore sole liability.
Union leaders representing bank IT staff said the guidelines should come with hiring budgets; MAS responded that skills plans are part of the second-phase compliance package rather than optional annexes.