MAS Chief Outlines AI Governance, Cyber Resilience, and Payments Priorities for Financial Institutio

Key Takeaways

• In a speech at Global FinTech Fest 2026, MAS Managing Director Chia Der Jiun signaled that supervisory focus is on AI governance, agentic AI safeguards, and cyber resilience as AI-enabled threats escalate.
• The speech points to the pending Guidelines for AI Risk Management, the SAFR framework, and Nexus payments connectivity.
• Compliance teams should treat these as indicators of upcoming supervisory expectations, even though the speech itself is not binding.

Deep Dive

In a speech at Global FinTech Fest 2026, MAS Managing Director Chia Der Jiun signaled that supervisory focus is on AI governance, agentic AI safeguards, and cyber resilience as AI-enabled threats escalate. The speech points to the pending Guidelines for AI Risk Management, the SAFR framework, and Nexus payments connectivity. Compliance teams should treat these as indicators of upcoming supervisory expectations, even though the speech itself is not binding.

Several documents shape expectations. MAS has issued Guidelines for AI Risk Management for public consultation, setting out supervisory expectations for governance, risk management, and AI life cycle controls, including risk materiality assessments. These work alongside the two AI Risk Management Handbooks published jointly with industry in 2025, which describe how to implement the requirements. The 2023 Gen AI risk framework and the July 2026 SAFR (Safeguards for Agentic Finance at Runtime) white paper add to this. SAFR covers establishing an agent's identity and authority, evaluating agent actions against controls before execution, and maintaining a clear audit record. No finalization date for the Guidelines was given. The speech also referenced the Reserve Bank of India's FREE-AI framework, a useful comparator for firms with cross-border operations.

On cybersecurity, MAS described 2026 as a watershed year. It cited AI-driven vulnerability discovery and autonomous agent attacks, a six-fold rise in high-severity CVEs to 2,200, and a reported 89% increase in AI-enabled attacks (per CrowdStrike). Deepfake-enabled deception is also growing. MAS stressed that multi-layered defenses remain effective (strong authentication, rapid patching, network segmentation, access control, endpoint detection, database monitoring, incident response), but expects guardrails to be jailbroken as models improve. It wants institutions to use the current window to strengthen these layers and to adopt AI for defense, including continuous code scanning, faster testing and patching, and real-time threat detection. MAS is also testing AI models with law enforcement and banks, using cross-bank and public-private data to detect suspicious accounts and transactions, with findings expected by the end of 2026.

Recommended actions: (1) Review the draft AI Risk Management Guidelines and consider submitting consultation feedback; (2) perform a gap assessment against the Guidelines, Handbooks, and SAFR, including an AI inventory and risk materiality assessments; (3) establish identity, authority, pre-execution control, and audit logging for any AI agents in use or planned; (4) test cyber controls against AI-accelerated threats, including patch timelines and deepfake-resistant verification; (5) monitor the outcomes of MAS's scam-detection work and its Nexus and UPI-PayNow payments developments, and assess financial crime and operational implications of faster money movement; (6) plan for AI training and process redesign. MAS also flagged future financial stability implications of agent-driven transactions, so expect further policy development.

Risk impact is moderate to high for institutions with material AI deployments. Key exposures are model and third-party AI risk, agentic AI accountability gaps, cyber and operational resilience, and fraud and scam losses. Early alignment should reduce remediation burden once the Guidelines are finalized.

Source: Monetary Authority of Singapore