Managing AI risk for financial institutions is no longer a peripheral experiment in Singapore’s financial sector — and neither is AI risk management more broadly. Today, AI systems are now actively deployed across credit assessment, fraud detection, customer onboarding, advisory tools, and operational automation. Regulators expect firms to manage the risks these systems create with the same discipline as any other core function. These systems increasingly influence decisions with direct financial and consumer impact, which is why understanding AI risk in financial institutions has become a board-level priority.
In November 2025, the Monetary Authority of Singapore (MAS) issued a consultation paper. It proposed new Guidelines on Artificial Intelligence (AI) Risk Management (the Guidelines). These Guidelines are timely and important: they make clear that AI now sits firmly within MAS’s oversight rather than functioning as an innovation side project.
AI Risk for Financial Institutions: From Innovation Tool to Regulated Risk
Until recently, firms treated AI systems as technology enablers, and IT teams or external vendors owned and managed them outside traditional AI risk management frameworks. The Guidelines decisively change this approach. The Guidelines now position AI as a formal risk category, comparable to credit, market, operational, and compliance risk.
Under the Guidelines, Regulated Financial Institutions should implement controls across the full AI lifecycle, including:
- board and senior management oversight,
- end-to-end model lifecycle governance,
- data quality and bias management,
- explainability and transparency,
- system robustness and resilience, and
- continuous monitoring and review.
The rationale is straightforward: when AI systems influence financial outcomes, failures or bias can directly impact investors, market integrity, and regulatory standing.
Real-World AI Risk Case Studies: Why Governance Matters
1. Bias and Fairness in AI-Driven Decision-Making
A widely cited global example is the Apple Card controversy. Critics alleged that the credit-limit algorithm offered significantly higher limits to men than to women with similar financial profiles. The lack of transparency around how decisions were made triggered public backlash and regulatory attention.
While Singapore has not experienced a similarly publicised case, the authorities have been clear that the absence of public enforcement does not imply regulatory tolerance. Rather, Singapore’s approach is preventative. AI systems used in onboarding, credit assessment, transaction monitoring, and customer segmentation are expected to undergo fairness testing and outcome monitoring to avoid “silent harm” before it escalates.
Lesson for financial institutions:
AI models used for credit or risk decisions must be explainable, auditable, and demonstrably fair. Even perceived bias in AI-driven decision systems, whether used in onboarding, client segmentation, or risk scoring, can erode trust and attract regulatory attention. MAS’ emphasis on fairness, data governance, and explainability is designed to prevent such outcomes before they escalate.
2. Historical Data and Embedded Bias
Globally, several major banks have faced allegations that AI-influenced mortgage lending systems resulted in discriminatory outcomes across certain demographic groups. These cases highlight how historical data can embed and perpetuate bias when firms fail to assess it properly before using it to train AI models.
This risk is particularly relevant in Singapore’s data-rich financial environment, where firms rely heavily on behavioural and transactional datasets. Without disciplined governance, AI systems trained on legacy patterns may unintentionally reinforce exclusionary or skewed outcomes in credit scoring, fraud thresholds, or customer risk profiling.
Lesson for financial institutions:
In Singapore’s data-rich environment, AI models trained on behavioural or transactional datasets may unintentionally reinforce skewed outcomes in areas such as client risk profiling, transaction surveillance thresholds, or suitability assessments. MAS expects firms to actively test for bias and monitor outcomes throughout the AI lifecycle — not merely at deployment.
3. Regulatory Consequences of Weak AI Governance
In the United States, regulators have imposed significant financial penalties on banks whose algorithmic credit models disproportionately rejected applications from minority groups. Investigations cited biased training data, insufficient oversight, and weak governance frameworks as contributing factors.
Lesson for financial institutions:
Responsibility for AI outcomes rests squarely with boards and senior management. This holds regardless of whether firms develop models internally or source them from third-party vendors.
4. AI-Driven Fraud and External Threats — A Singapore Reality
In Singapore, AI risk is not limited to internal models. AI-powered fraud is already a material external threat. Recent industry reporting in Singapore highlights that AI-assisted scam tactics are already affecting the local financial ecosystem. These include:
Recent industry reporting highlights how fraudsters increasingly use AI-assisted impersonation, synthetic messaging, and automated social-engineering techniques to bypass traditional controls. These tactics allow fraudsters to scale scams more efficiently and tailor them to specific victims, making detection significantly more challenging for Regulated Financial Institutions.
Reports indicate that digital banks in Singapore have recorded millions of dollars in scam-related losses. Alongside rising dispute volumes and operational strain. While not all incidents are explicitly labelled as “AI-driven”, the increasing sophistication and automation of scam methods point to the growing role of AI-enabled tools in facilitating these attacks.
Singapore authorities, including MAS, the Singapore Police Force (SPF), and the Cyber Security Agency (CSA), have issued public advisories warning of scams that use AI-generated deepfake audio and impersonation. Such scams often target finance teams and senior management. They exploit trust in internal processes to induce fraudulent payments or disclosure of sensitive information.
Global research and reporting shows that fraudsters increasingly use AI to enhance the sophistication of investment and cryptocurrency scams. Analysts note that AI tools can generate realistic phishing content, fabricate fake trading platforms and endorsements, and automate social-engineering campaigns. These tactics can deceive investors into transferring funds or engaging with fraudulent services. Deepfake technology, in particular, is being used to impersonate trusted figures and exploit investor trust in online environments. While these trends are documented internationally, they reflect risk patterns that are directly relevant to Singapore’s investor and digital asset landscape.
Lesson for financial institutions:
Financial institutions must extend AI governance beyond internal models to address external threats, particularly where malicious actors use AI to exploit trust, speed, and automation. In this context, MAS’ focus on resilience, monitoring, and escalation reflects the reality that AI is also reshaping the threat landscape that fund managers must defend against, including risks to payment controls, authorisation workflows, and operational security.
5. Over-Reliance on AI Outputs and Operational Oversight
A governance-focused example involved a major bank reversing workforce decisions after discovering that an AI voice bot failed to deliver the expected efficiency gains. The issue was not technological failure alone, but over-reliance on AI outputs without adequate validation or human oversight.
Lesson for financial institutions:
AI-driven insights should inform, not replace, human judgement. MAS’ emphasis on human-in-the-loop controls and fallback mechanisms is especially relevant where AI outputs influence investment decisions, surveillance alerts, or operational responses.
What MAS’s AI Risk Guidelines Are Guarding Against
Taken together, these cases illustrate the risks MAS seeks to address through its AI Risk Management Guidelines:
- opaque “black-box” decision-making,
- untested bias in AI outputs,
- over-reliance on third-party vendors,
- insufficient board awareness of AI risks,
- and weak escalation or incident-response frameworks.
In articulating these risks, MAS has also made clear that it developed the proposed Guidelines alongside earlier information papers and supervisory work. They build on earlier information papers and supervisory work on artificial intelligence, advanced analytics, and model risk management, which identified similar governance gaps and good practices across the industry. The proposed Guidelines consolidate these earlier insights into a more structured and comprehensive governance framework.
MAS’ message is not anti-innovation. Rather, it reflects the expectation that AI systems influencing financial outcomes must meet the same governance standards as any other critical function.
Practical Implications of AI Risk for Financial Institutions
To align with MAS’ proposed supervisory expectations, effective AI risk management starts with a proportionate, risk-based approach — beginning with an assessment of whether, and how, the organisation uses AI. This is particularly important because tools and systems may contain AI features that firms do not always consciously identify as ‘AI’.
Assessing AI Use and Exposure
As an initial step and as a Regulated Financial Institution it should be determined:
- whether AI is currently deployed or embedded in business processes, including within investment, risk, compliance, operational or support functions;
- the nature, purpose and materiality of those use cases, considering the extent to which AI influences decisions, outcomes or controls;
- the potential risks arising from such usage, including governance, data, fairness, operational and regulatory risks and;
- whether AI-enabled features embedded in third-party platforms or tools may access, process, store, or analyse sensitive or confidential information without having explicit awareness or intent.
In particular, such entities should recognise that certain “always-on” or default AI features within email, cloud, document management, or productivity platforms may process data automatically. Even where there is no intention to deploy AI, such features may still interact with sensitive information unless actively restricted.
Accordingly, Regulated Financial Institutions should assess:
- what data such AI-enabled features can access,
- whether third-party providers may retain, analyse, or use that data to improve their models, and
- whether the firm can practically restrict, disable, or switch off such AI functions where the associated risks are not acceptable.
Key AI Risk Management Controls
Based on this assessment, such entities should then focus on the following:
- AI Use-Case Mapping: Identify and maintain a clear inventory of where and how AI is used (or embedded by default) across the organisation, together with an assessment of the associated risks.
- Governance & Accountability: Assign clear ownership for AI use and AI-related risks at senior management and board levels. Ownership should match the extent and materiality of AI adoption.
- Policy & Control Frameworks: Institute basic policies governing the use of AI. Cover permitted and disallowed uses, data access boundaries, and review mechanisms, scaled to the firm’s level of AI adoption.
- Vendor Oversight: Strengthen due diligence and contractual controls for third-party AI solutions, including clarity on data access, retention, and training practices.
- Monitoring & Review: Where AI is integrated into business processes or platforms, implement ongoing checks to identify bias, model drift, unintended data exposure, or control weaknesses.
- Training & Awareness: Ensure staff receive adequate training on applicable AI guidelines, understand how AI-enabled features operate, the types of data they may access or process, and the relevant escalation pathways and governance expectations.
Proactive and proportionate action will not only reduce regulatory exposure. It will also help Regulated Financial Institutions avoid inadvertent data leakage, strengthen investor confidence, and improve inspection readiness.
Conclusion: Getting AI Risk Governance Right for Financial Institutions
The Guidelines are timely and pragmatic. Global and local experience shows that AI-related failures, whether due to bias, opacity, or weak oversight, can escalate rapidly into regulatory, legal, and reputational crises.
This applies broadly: Singapore fund managers, payment entities handling cross-border and domestic money transfers, crypto-related businesses, trust service providers, and similar firms. For all of them, disciplined AI governance is no longer optional. It is a core component of sustainable operations, regulatory credibility, and long-term trust.
How Curia Regis Can Support
Curia Regis works with Regulated Financial Institutions in Singapore across the Capital Markets space, as well as Payment Services. We also work at the inflection point between the two. This includes:
- designing AI governance and risk frameworks,
- integrating AI into compliance and enterprise risk management,
- conducting independent AI readiness and control assessments,
- and aligning operational practices with MAS supervisory expectations.
As regulatory focus on AI intensifies, proactive governance will be the differentiator between resilient regulated entities and ill-prepared ones.
Ensure your operational response is seamless. You can reach us here or email admin@curiaregis.com to get in touch.
