The Register Failures of third-party services no excuse for island nation’s financial sector
Artificial IntelligenceRisk Management for Financial Institutions, published on Wednesday, warns that AI increases risk. “The use of AI can improve performance across business and functional areas but its complexity and probabilistic nature can lead to greater uncertainty, as well as unexpected or more biased behaviour that is harder to identify compared to the use of simpler methods,” the guidelines state. And that’s MAS’s view of old-school AI: it rates
generative AIas even riskier. “The greater complexity of Generative AI gives rise to even greater uncertainty and unexpected behaviour compared to AI,” MAS warns, citing “noise that is inherent in
trainingdata, training data that may not be representative, or when the model encounters scenarios that are not present in its training data” as sources of risk. The regulator fears
agentic AI“could further amplify these risks.” MAS therefore calls for financial institutions (FIs) to expand their risk management frameworks to cover AI and expects board and senior management to make that happen. The regulator also wants all AI use cases to undergo independent review before going into production. “Prior to deployment, an FI should subject the AI use case, including its underlying systems or models, to reviews by parties not involved in its development to ensure that the relevant controls, such as
evaluationand testing, have been adhered to,” the guidelines state. MAS also wants regulated entities to run technology and cybersecurity reviews “to ensure that AI can be deployed into the production environment in a controlled and secure manner.” If an AI project survives those reviews, MAS wants ongoing monitoring of both the FI’s own systems and any third-party AI powering an application. “Given the uncertainties associated with AI, their dynamic nature and the potential for model staleness and performance degradation due to data or model drifts over time, ongoing monitoring is critical to ensure that deployed AI operates as intended and remains fit for purpose over time,” the guidelines state. MAS does not see failings by third-party AI suppliers as an acceptable excuse for AI problems at entities it regulates, and it wants FIs to monitor their suppliers’ products and services to ensure they remain stable and secure. “FIs remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties,” the regulator explained. “FIs should obtain sufficient assurance from third-party providers, assess whether third-party AI is suitable for their intended use, and apply compensating controls where practical constraints or assurance gaps arise. If the risks cannot be brought within the FI’s risk appetite, it should consider limiting, suspending or replacing the use of the third-party AI service.” The regulator also wants Singaporean FIs to maintain up-to-date inventories of all AI used in their business. If that’s not possible due to third-party services using AI without revealing it, financial institutions need to find ways to manage the risk of unknowable AI contributions. Another of the guidelines calls for FIs to develop contingency plans and fallback options for AI used in high-risk applications. Those plans should include “alternative systems or manual processes, to ensure business continuity in case of AI failure or unexpected behavior.” The guidelines come into force on October 7, 2027. ®
Get AI news in your inbox
Daily digest of what matters in AI.
Key Terms Explained #
Agentic AI Agentic AI refers to AI systems that can autonomously plan, execute multi-step tasks, use tools, and make decisions with minimal human oversight.
Artificial Intelligence The science of creating machines that can perform tasks requiring human-like intelligence — reasoning, learning, perception, language understanding, and decision-making.
Evaluation The process of measuring how well an AI model performs on its intended task.
Generative AI AI systems that create new content — text, images, audio, video, or code — rather than just analyzing or classifying existing data.