Blog
MAS raises the bar on AI risk for financial institutions. Here is how to govern the AI agents behind it.
On 7 October 2026, the Monetary Authority of Singapore (MAS) issued its Guidelines on Artificial Intelligence Risk Management. They set out what MAS expects from Singapore's banks, insurers and other financial institutions (FIs) across AI oversight, risk management systems, life cycle controls, and the people and technology needed to run AI responsibly. The Guidelines apply to generative AI and to newer developments such as AI agents, and they take effect on 7 October 2027, with the life cycle and capability expectations (Sections 5 and 6) to be met by 7 October 2028.
For identity, security and risk teams at financial institutions, one message stands out. You cannot govern AI you cannot see, and you cannot control an AI agent you cannot tie to an owner.
Why AI agents raise the stakes
MAS ties AI risk to the core risks of a financial institution: financial, operational, conduct, financial crime and reputation. Agents amplify them, and MAS is direct about why. An agent with access to tools can take unauthorized or erroneous actions on its own, and a compromised agent with access to internal systems can be used to exfiltrate sensitive data or run malicious commands at scale.
That is an identity problem. An agent enters an organization's environment, holds credentials, receives permissions, and acts on data at machine speed. It behaves like a privileged non-human identity, and it needs the same governance a privileged human user gets, only faster.
What MAS expects from financial institutions
The Guidelines build on a simple chain of expectations:
- Identify AI use across the business, including AI embedded in third-party services and shadow AI.
- Inventory every AI use case, system, and model, with attributes such as purpose, owner, dependencies, and, for agents, the tools and systems each agent can access.
- Assess risk materiality by impact, complexity, and reliance, including how much autonomy an AI has, how much human oversight sits around it and what credential is needed, to reduce attack surface of agents.
- Apply life cycle controls in proportion to that risk: human oversight, third-party AI management, security and access control, change management and ongoing monitoring.
- Build the capability to do all of this, with clear accountability from the board down.
MAS also keeps this proportionate. Low-risk uses, such as drafting emails or summarising notes, can follow basic governance: a named senior owner, permitted and prohibited uses, an approved tool list, and regular checks.
The gap most organisations still have
SailPoint®'s 2026 research, "The year of the AI agent", surveyed 100 security and identity leaders at Fortune 500 and Global 2000 companies. It is a global, cross-industry sample (18% from financials and insurance), not a Singapore one, but it shows how far practice is from what regulators now expect:
- 91% of organisations are deploying or evaluating AI agents.
- Only 30% have complete, real-time visibility into their agents.
- Only 11% have fully implemented least-privilege access for AI agents.
- 65% assign agent ownership to a whole team rather than a named person, and 17% have no clear ownership at all.
- Governance policies are still in development at 57% of organisations.
How SailPoint Agentic Fabric™ helps
SailPoint Agentic Fabric extends SailPoint's identity security platform to AI agents, non-human identities, and shadow AI. It works across three pillars: Discover, Govern, and Protect. Here is how those pillars can support with what MAS asks FIs to do.
| What MAS calls for | How Agentic Fabric helps |
|---|---|
| Identify AI use, including shadow AI and AI inside third-party services (Section 4) | Discover: Continuous discovery across cloud platforms, SaaS applications, browsers, and endpoints, with endpoint and browser sensors that help surface shadow AI. |
| Keep an accurate AI inventory, including agent-specific attributes (Section 4) | Discover: A single agent registry covering agents, machine accounts, MCP servers, and exposed credentials, linked through the Identity Graph to owners, entitlements, and sensitive data. |
| Assign clear roles and accountability (Sections 3 and 5) | Govern: Human ownership for every governed agent, with succession planning when owners change roles or leave, and a self-service portal for owners. |
| Human oversight (Section 5) | Govern: Access requests, certification campaigns, and lifecycle workflows for agents, designed to support least-privilege entitlements. |
| Security and access control (Section 5) | Protect: Real-time authorization at gateways and in developer tools, plus effective privilege analysis that shows what an agent can really do. |
| Ongoing monitoring of deployed AI, with kill switches considered for high-risk use (Section 5) | Protect: Behavioral monitoring and drift detection, dynamic risk scoring, automated response, and a policy-driven kill switch for compromised or unsanctioned endpoint agents. |
| Logs and records for auditability (Section 5) | Govern: An audit-ready trail of agent activity, permission changes, and policy changes, with certification evidence. |
| Retire AI cleanly (Section 5) | Govern: Deprovisioning and decommissioning agents and their machine identities when they are no longer needed. |
From a list of agents to a map of risk
MAS asks FIs to judge each AI use case by impact, complexity, and reliance. A flat list of agents cannot do that. You need context: who owns the agent, what credentials it uses, which entitlements it holds, and which data it can reach.
The Identity Graph helps provide that context, tracing the path from human owner, to an agent, to its entitlements, credentials that an agent uses and the data underneath. That gives risk and compliance teams something concrete to feed into a materiality assessment, and it can help show where sensitive data may be exposed.
Prove it, and contain it
Two moments will test any AI governance program. The first is the audit: can you explain what an agent did, which policy applied, and who was accountable? The second is the incident: can you stop a misbehaving agent quickly?
Agentic Fabric is designed to support both. Continuous monitoring flags unusual behavior; risk scores can trigger automated workflows such as revoking entitlements or disabling an agent identity, and signals can be shared with supported SIEM, SOAR, and XDR tools your security operations team already uses.
A note on scope
The Guidelines also cover areas that sit outside identity, such as model validation, fairness testing, and workforce capability. Agentic Fabric does not replace those. What it provides is the identity, access, and runtime control layer that many of those controls depend on, because every AI agent that touches your data or systems needs an owner, a defined set of permissions, and a record of what it did.
Start now, ahead of 2027
For Singapore financial institutions, the first expectations (Sections 3 and 4) apply from 7 October 2027. Institutions that belong to a global group can lean on group frameworks, but local senior management stays accountable for showing MAS how oversight works in Singapore. The practical first steps are within reach today:
- Find out which agents and AI tools are already running, including shadow AI.
- Assign a named human owner to agents.
- Move agents toward least-privilege, time-bound access.
- Put monitoring and a response plan in place before an incident, not after.
SailPoint Agentic Fabric can help you do all four from a single identity security platform. Learn more about SailPoint Agentic Fabric.
DISCLAIMER: The information contained herein is for informational purposes only, and nothing conveyed herein is intended to constitute any form of legal advice. SailPoint cannot give such advice and recommends that you contact legal counsel regarding applicable legal issues. The development, release, and timing of any features, functionality, capabilities, or services described for SailPoint's products that are not currently available remain at SailPoint's sole discretion on a when, and if, available basis and may not be delivered at all and must not be relied on in making a purchasing or investing decision.
