Singapore's Regulator Just Made Banks Personally Accountable for AI Their Vendors Built. US Examiners Are Already Asking the Same Questions.

TL;DR

• On October 7, 2026, Singapore’s MAS finalized binding AI governance guidelines requiring financial institutions to remain personally accountable for AI built and operated by vendors
• Core requirements: AI inventory, risk materiality grading, independent assurance (not self-attestation), compensating controls for transparency gaps, and willingness to limit or replace high-risk third-party AI services
• US regulators are already asking the same questions in routine exams — without a formal rulebook yet
• SR 26-2 (April 2026) explicitly excludes generative and agentic AI; the interagency RFI covering AI specifically hasn’t been published; the gap between examiner expectations and formal requirements is real and widening
• Practical starting point: AI inventory that captures vendor-embedded AI, not just models you built yourself

Here’s a problem that’s growing at most banks: AI is now in places nobody mapped.

It’s in the fraud detection vendor your operations team switched to in 2024. It’s in the CRM platform your relationship managers use to score which clients to call. It’s in the core banking system’s overdraft decision module — not because you asked for AI, but because your vendor updated the product and added it. You’re running AI you didn’t evaluate, didn’t inventory, and couldn’t shut off on a normal timeline without a business disruption.

Singapore’s financial regulator just made that a first-order governance problem, and US examiners are asking the same questions — just without the formal rulebook yet.

What MAS Finalized on October 7

The Monetary Authority of Singapore published final AI Risk Management Guidelines for financial institutions on October 7, 2026. The guidelines came after a consultation paper and industry feedback that asked for more implementation time.

The framework is organized around five themes:

Board and senior management accountability — AI is not a technology department problem. The guidelines place oversight responsibility at the governance level, requiring boards and senior management to understand the AI risk profile of their institution and ensure adequate controls exist.

AI identification and inventory — Institutions must identify every AI system operating in their services, maintain an up-to-date catalog, and periodically review it. The scope explicitly includes AI that third parties have built or operate on the institution’s behalf.

Risk materiality assessment — Not all AI carries the same risk. Institutions must grade each AI system’s materiality based on factors like the consequences of errors, the population affected, and whether the AI is making consequential decisions autonomously.

AI lifecycle controls — Higher-risk AI systems require controls across their full lifecycle: development or procurement, testing, deployment, monitoring, and retirement. This includes documentation, performance monitoring, explainability standards, and change management.

Third-party AI management — This is the most operationally significant section for institutions heavily dependent on vendor-supplied technology.

The Third-Party Accountability Rule

The MAS guideline’s core principle on vendor AI: institutions remain accountable for AI in their services regardless of who built or operates it.

What this means in practice:

• A vendor’s self-attestation that its AI is compliant generally isn’t adequate assurance. MAS expects substantive independent assessment — testing results, validation documentation, access to enough information about the model to assess its behavior.
• Where vendors won’t provide independent assurance (common in commercial AI products where the model is proprietary), institutions must apply compensating controls: run validation testing on their own data, set up monitoring for outcome drift, establish human override processes for consequential decisions.
• If risks cannot be brought within the institution’s risk appetite through assurance or compensating controls, the institution should consider limiting, suspending, or replacing the third-party AI service. Not the vendor. The service.

That last point deserves emphasis. MAS is telling institutions that “we couldn’t get assurance from the vendor” is not a risk acceptance — it’s a decision point about whether to continue using the product. US examiners are moving toward the same logic.

The Timeline

The guidelines take effect in two stages:

The phasing reflects industry feedback about the difficulty of applying controls retroactively to third-party AI already in production. But Phase 1 — inventory and materiality — is the foundational work. Without it, Phase 2 controls have no structure to attach to.

Why This Matters Now for US Institutions

The obvious objection: MAS regulates Singapore banks, not US ones. So why does this matter for a community bank in Ohio or a fintech in New York?

Three reasons.

First, US examiners are already asking the same questions. Reuters reported in June 2026 that the OCC and Federal Reserve have made AI a standing topic in routine examinations, with every bank review now including discussion of AI governance, vendor oversight, subcontractor exposure, and contingency plans for AI system failures. They’re using existing supervisory tools — model risk, third-party risk, consumer protection — as the framework. The MAS guidelines aren’t ahead of where US regulators are heading. They’re codifying what US examiners are already doing informally.

Second, SR 26-2 left a gap that regulators are filling with exam questions. The April 2026 interagency model risk guidance explicitly excluded generative and agentic AI from scope. The agencies have announced a follow-on request for information on AI model risk, but it hasn’t been published. Until that RFI produces formal guidance, there is no equivalent of SR 26-2 for the AI systems most actively being deployed today. Institutions are left trying to satisfy examiner expectations without a formal standard — which is exactly when looking at what well-developed international regulators require becomes useful.

Third, the vendor-embedded AI problem is real and growing. Unlike AI models you built and deployed intentionally, AI in vendor SaaS products often enters without a formal procurement or risk assessment decision. The vendor updated the product; you got AI. Examiners are already asking: do you know where AI is running in your institution, including in vendor software?

If the answer is “we’re not sure,” you have the same inventory gap MAS is requiring Singapore institutions to close by October 2027.

The Practical Gap: Most Institutions Are Running AI They Didn’t Evaluate

Reuters’ June 2026 reporting included a notable quote from the examination context: examiners are asking whether the AI vendors banks contract with — and the subcontractors those vendors use — are held to governance expectations comparable to what regulators require of banks directly.

That’s a four-party chain: your institution, your vendor, your vendor’s AI provider, and the underlying model. If your third-party due diligence process asks about cybersecurity but doesn’t ask about AI governance, you have a gap in your vendor risk management that’s increasingly on examiner radar.

The MAS framework addresses this explicitly. Under its proportionality principle, institutions don’t need to apply the same rigor to every AI system — a spell-checker in an email platform gets less scrutiny than an AI model making credit decisions. But you have to be able to make that distinction, which requires knowing where AI is running in the first place.

What a US AI Governance Program Needs to Address Now

Drawing from the MAS framework and current US examiner expectations:

1. AI Inventory (the foundational step)

Map every AI system your institution uses — including AI embedded in vendor products. For each:

• What decisions or outputs does it produce?
• Who owns it (internal or vendor)?
• What data does it use, and does that include PII or protected class information?
• What business processes depend on it?
• What’s the consequence of an error?

This inventory doesn’t have to be perfect on day one. It has to exist and be maintained.

2. Materiality Grading

Not all AI requires the same oversight. Grade each system based on:

• Consequential impact: does a wrong output affect a customer’s access to credit, services, or products?
• Scale: how many decisions does it touch per day?
• Auditability: can you explain a specific output if a customer or regulator asks?
• Reversibility: can a decision be reviewed and reversed?

High-materiality AI — credit decisions, fraud scoring, customer segmentation — requires deeper governance, more frequent monitoring, and stronger assurance standards than low-materiality AI.

3. Vendor AI Due Diligence

For any vendor whose product includes AI in a consequential function:

• What documentation does the vendor provide about the model’s design and performance?
• What validation or independent testing has been done?
• Can you access error rate data, drift monitoring results, or demographic impact statistics?
• Who is the model’s subcontractor or underlying provider?

Vendors that can’t answer these questions are flagging a transparency gap. That gap requires either compensating controls — like running your own outcome monitoring — or a risk decision about whether the product is appropriate for its intended function.

4. Monitoring and Human Override

For any AI system making or materially influencing consequential decisions:

• Is there a human in the loop for high-stakes outputs?
• Is outcome drift being monitored?
• Is there a documented process for identifying when the AI is producing unexpected or discriminatory outputs?
• What happens if the system needs to be shut down on short notice?

The MAS framework explicitly asks institutions to have contingency plans if third-party AI services need to be limited or replaced. US examiners are asking equivalent questions.

The Examiner’s Perspective

The June 2026 Reuters reporting that US bank examiners are asking about AI came with a caveat from supervisors: the questions are meant to deepen regulators’ understanding of how banks are using AI, not to penalize institutions for a rulebook that doesn’t yet exist.

That’s a reasonable characterization of where the US is now. But the trajectory is clear. MAS finalized its framework after a consultation process. The EU AI Act’s financial services provisions are in force. The interagency AI RFI has been announced but not published. US formal AI governance requirements are a question of when, not whether.

The institutions that will be in the best position when those requirements arrive are the ones that don’t wait for them. An AI inventory built today, a vendor due diligence process updated to cover AI governance, and a materiality framework that identifies which systems require deeper scrutiny — these aren’t compliance document exercises. They’re the foundation for demonstrating to an examiner that you understand and control the AI running in your institution.

The MAS framework gives you a clear structure for building that foundation now.

So What?

If you’re running AI governance at a US financial institution, October 7, 2026 is a useful calibration date — not because MAS regulates you, but because MAS just codified what sound AI governance of third-party systems looks like. US examiners are already asking those questions.

The two most urgent gaps in most institutions: an AI inventory that accounts for vendor-embedded AI (not just models you built), and a vendor due diligence process that evaluates AI governance alongside cybersecurity.

Both gaps are closeable before the next exam cycle. Both will be significantly harder to close in the middle of an examination.

Resources:

• MAS AI Risk Management Guidelines (October 7, 2026): Fintech Singapore and OpenGov Asia coverage
• MAS Makes Banks Answerable for Third-Party AI Risk: Fintech Global summary
• MAS Makes Banks Find the AI Hidden in Their SaaS by October 2027: beri.net analysis
• US Bank Regulators Probe Industry Use of AI: Quartz/Reuters reporting on OCC and Fed exam practices
• OCC, Fed Lock AI Governance Into Routine Bank Exams: AIWeekly summary

Related reading on this site:

• Vendor AI Risk Assessment: What TPRM Programs Are Missing
• Your AML Transaction Monitoring Runs on AI. Your Examiner Is About to Treat It Like a Model Under SR 26-2.
• The Banking Agencies Just Proposed to Throw Out the TPRM Checklist. Here’s What the New Risk-Based Framework Actually Requires.