MAS TRM and AI Governance: What Singapore and Global Banks Must Implement

MAS's Technology Risk Management Guidelines, last substantively revised in 2021, and its 2018 FEAT Principles together set the AI governance baseline for Singapore-regulated banks. Both are guidelines rather than law — MAS supervises adherence to them through its inspection and supervisory powers rather than through a direct statutory penalty attached to the Guidelines themselves, though related MAS Notices, which do carry legal force, fill part of that gap. For institutions running AI across Singapore and India, MAS's expectations sit alongside RBI's and the DPDP Act's, and the two regimes don't reduce to one program by accident.

MAS TRM 2021: guidance, not law, but examined as if it were

MAS's Technology Risk Management Guidelines cover all technology risk, not AI specifically, which is exactly why institutions underestimate how much of it applies to AI systems. Several thematic areas carry direct AI governance implications: board and senior management accountability for technology risk appetite, risk assessment and testing before any new system — including third-party and vendor systems — goes into production, change management for significant technology changes, access controls and segregation of duties over systems that can be modified, third-party and outsourcing due diligence, and data quality, lineage, and classification requirements.

Treat each of those as applying to AI without waiting for a separate AI-specific framework. A model retraining cycle is a change that needs change-management sign-off under the same logic as any other significant IT change. The data scientists who can push a new model to production need the same segregation-of-duties scrutiny as anyone else with privileged production access. A vendor-hosted LLM API needs the same due diligence as any other outsourced technology arrangement. Precise clause numbering within the current edition of the Guidelines should be confirmed directly against MAS's published text before citing specific section numbers in a board paper — MAS periodically restructures the document, and secondary commentary can lag the current numbering.

One distinction that trips up institutions new to Singapore: TRM itself is guidance, but it doesn't sit alone. MAS Notice 644 on Cyber Hygiene is legally binding on banks and several other classes of financial institution, and it sets baseline security requirements — administrative account controls, patching timelines, security configuration standards — that apply directly to the infrastructure an AI system runs on. A bank that treats TRM as "soft" and assumes nothing underneath it is enforceable still has to get the cyber-hygiene baseline right for every AI inference endpoint and training pipeline it operates, because that specific layer is law, not guidance.

MAS FEAT Principles: the customer-facing AI overlay

Where TRM governs the technology control environment, MAS's FEAT Principles — Fairness, Ethics, Accountability, Transparency, published in 2018 — set governance standards specifically for AI that materially influences a decision about a customer's financial products, services, or access.

Fairness requires testing for proxy discrimination and disparate impact across protected characteristics in credit, insurance, and advisory AI, with a remediation pathway for unfair outcomes found after deployment. Ethics requires an ethical review before deployment and prohibits using AI against customer interests — predatory pricing or discriminatory retention logic, for instance.

Accountability requires a named human owner for every AI decision chain, an explainability capability, and a human override pathway for consequential decisions. Transparency requires disclosing to customers when AI materially influences a decision affecting them, including updates to product disclosure documents.

FEAT is principles-based, not a checklist, which means an institution's own documentation of how it interpreted and applied each principle matters as much as the outcome. MAS's supervisory conversations tend to focus on whether the institution can explain its reasoning, not just on whether an outcome looks fair in hindsight.

The Singapore–India dual regulatory challenge

DBS, OCBC, and UOB — Singapore's three locally headquartered banks — must satisfy MAS TRM and FEAT for every AI system they run. Standard Chartered, along with global banks such as HSBC, Citi, and JPMorgan, run significant India operations alongside large Singapore regional-headquarters functions, so the same dual-regulatory design problem applies to them even though their global headquarters sit elsewhere.

The dual requirement isn't additive — it's a constraint on how the AI platform itself has to be architected.

The practical failure mode here isn't a missing policy document — it's a shared model validation team that signs off a Singapore-only model under TRM's lighter validation bar, then discovers six months later that the same model got reused for an India deployment without ever going through RBI's independent-validation requirement.

Third-party and vendor AI: more than one MAS instrument applies

Vendor and outsourced AI due diligence under TRM's third-party risk provisions is necessary but not sufficient. MAS's separate Guidelines on Outsourcing govern the broader vendor-concentration, exit-planning, and business-continuity obligations that apply to any significant technology outsourcing arrangement, AI included. For AI vendors specifically, due diligence needs to cover the vendor's own governance evidence — can they demonstrate independent validation, bias testing, and explainability for their models, not just claim it — how institutional and customer data is handled in the vendor's training and inference pipeline, concentration risk if the same vendor serves multiple Singapore banks, exit and portability without losing model performance or explainability capability, and the vendor's AI system availability SLA and failover architecture.

Concentration risk deserves particular attention right now. As a handful of foundation-model providers end up underpinning AI deployments across most of Singapore's banking sector, MAS's thematic reviews are increasingly likely to ask what happens to the whole sector if one vendor has an outage or a governance failure, not just what happens to any single institution.

What to do if you run AI across Singapore and India

1. Don't treat "guideline" as "optional." MAS examines technology risk programs against TRM and FEAT as the de facto standard, and binding instruments like Notice 644 fill the enforceable gaps underneath them.
2. Separate your outsourcing due diligence from your TRM risk assessment. Vendor concentration, exit planning, and business continuity for AI vendors sit primarily under MAS's Guidelines on Outsourcing, not TRM alone.
3. Build data residency routing into the platform, not the policy manual, for any AI system serving both Singapore and Indian customers — DPDP Act localisation and MAS data governance expectations cannot both be satisfied by one global inference endpoint.
4. Re-run bias testing with jurisdiction-specific protected-characteristic sets before reusing a credit, insurance, or advisory model across both markets.
5. Confirm current clause numbering and specific obligations against your own current-edition copy of the TRM Guidelines and FEAT Principles before citing section numbers in a board paper or regulatory submission — MAS revises periodically, and any secondary source, including this one, should be checked against the primary text.