SINGAPORE, 7 AUG 2026 — A Member of Parliament asked the Monetary Authority of Singapore on 5 August whether it intends to move from the current industry-led framework for autonomous AI agents to mandatory supervisory requirements, and if so on what timeline. The written reply confirmed that agentic AI falls within the scope of guidelines MAS has not yet issued. It did not give a date.
That distinction is doing a lot of work, and some of the coverage since has collapsed it.
What was asked
The question came from Ms Mariam Jaafar, MP for Sembawang GRC, in three parts: what MAS assesses the near-term risks of increasingly autonomous AI agents in financial services to be; whether MAS intends to move from the Safeguards for Agentic Finance at Runtime framework towards mandatory supervisory requirements; and on what timeline.
The four-paragraph answer from Mr Gan Kim Yong, Deputy Prime Minister and Chairman of MAS, opens by confirming a principles-based approach. Given the fast-evolving nature of AI, MAS wants financial institutions to apply risk management practices proportionately.
On the second and third parts, the reply does not say yes and does not say no. There is no timeline in it beyond the statement that the proposed guidelines will be finalised soon.
Three instruments, and none of them is in force
The reply names three instruments, and it helps to be precise about what each one currently is.
| Instrument | What it is | Status as at this report |
|---|---|---|
| Guidelines on AI Risk Management | MAS supervisory expectations: board and senior management oversight, risk management frameworks, AI life cycle controls | Consultation paper issued 13 Nov 2025, consultation closed 31 Jan 2026. Not issued. MAS says it will be finalised soon, with no date given |
| Project MindForge AI Risk Management Toolkit | Industry-developed implementation resources to help institutions apply the Guidelines | Published. An implementation aid, not a rule |
| SAFR | A runtime governance layer that evaluates each proposed agent action before it executes | White paper, version 1.0, July 2026. MAS describes it in the reply as a potential approach |
Status compiled by RECATOOLS from the 5 August 2026 written reply, the MAS consultation page for the proposed Guidelines, and the SAFR white paper itself. The middle column paraphrases; the status column is our characterisation.
The scope confirmation is the substantive part of the answer. MAS issued the consultation paper on those Guidelines on 13 November 2025 and closed it on 31 January 2026. The reply states that the Guidelines apply to all AI use cases by financial institutions, including agentic AI. An institution planning an agentic deployment now knows it will not sit outside the framework when the framework arrives.
What the reply does not do is make anything binding today, because the instrument that would carry the obligation has not been issued.
SAFR says of itself that it is not guidance
SAFR, the framework the question was built around, is unusually explicit about its own standing. The white paper states that it does not constitute regulatory guidance or supervisory expectations, and that it does not prescribe or anticipate future directions for such guidance or expectations. Each institution, it says, remains responsible for determining how its deployment aligns with applicable supervisory expectations.
It carries MAS copyright and was written with contributions from eight institutions: Ant International, Circle, HSBC, J.P. Morgan Chase, Manulife, Mastercard, OCBC and Visa. That authorship is the point, not a footnote. An industry reference model published by the regulator is not the same as a regulatory instrument.
What SAFR actually proposes
Underneath the status question is a piece of engineering that deserves to be reported on its own terms.
SAFR puts a governance checkpoint between an agent's decision and its execution. Every proposed action is packaged into what the paper calls a governance envelope, carrying the action itself, the action trace — the tool calls made, data retrieved and checks performed in reaching the proposal — and context metadata including the agent's identity and the applicable mandate.
Four components then act on it. Agent Identity binds the action to a registered agent and rejects the envelope if the identity cannot be verified. The Controls Repository holds the institution's configurable rulebook. The Disposition Engine evaluates the action against those controls. The Audit Log records every decision in a tamper-evident, append-only form.
| Disposition | When it applies |
|---|---|
| Deny | Violates a hard regulatory or policy constraint, or sits above defined risk thresholds. Rejected before execution, with a reason recorded |
| Escalate | Within scope and below hard constraints, but above the threshold for autonomous execution. Held for human review |
| Auto-Execute | Within scope, below hard constraints, within risk thresholds. Proceeds without human intervention |
| Observe | Permitted to proceed, but flagged and logged for later review |
The four outcomes the SAFR Disposition Engine produces for every in-scope action, as set out in the white paper. All four feed the Audit Log regardless of outcome. Calibration factors the paper lists: action reversibility, financial materiality, customer impact severity and regulatory sensitivity.
The sharpest paragraph in the paper is about a failure mode most governance designs skip. Because the action trace and the action details are both declared by the agent inside the same envelope, both can be fabricated together by an adversarial injection that keeps the envelope internally consistent while departing from the original instruction. The paper's conclusion is that the envelope must be treated as a document to be authenticated against its origin, not as a trustworthy record of what the agent reported.
That is a warning against the obvious implementation. An audit log fed by the agent it is auditing proves less than it appears to.
The risk the paper is actually built around
The reply does not set out an assessment of near-term agentic risk, which was the first thing the question asked for. The white paper does, and it is more specific than the reply.
Its starting point is that existing control frameworks were designed for human decision-making and are less well suited to autonomous systems operating at machine speed and scale. Where a system can initiate consequential actions directly, the paper argues, the risks change shape. It points to actions taken outside the intended scope, actions that are difficult to reverse, and incomplete records of the basis on which an action was taken.
Then it makes a systemic argument. Where multiple institutions deploy similar models or depend on a small number of common AI service providers, behaviour may become correlated under stress. The paper attributes that concern to the Financial Stability Board, which has identified correlated AI model behaviour across institutions as a specific systemic vulnerability and noted that concentration among a few providers amplifies it.
This makes the case for governing the individual action, not just the model. Model-level review happens before deployment and cannot see what an agent does at three in the morning in a live payment queue. SAFR's controls are designed, in the paper's words, to limit the scope of harmful actions that may correlate and propagate across institutions.
What already exists underneath
The reply's reference to Project MindForge points at work that is further along than SAFR.
MindForge is a collaboration between MAS and a consortium of banking, insurance and capital markets institutions. Its second phase launched in November 2024 and was published at the Singapore FinTech Festival a year later, producing an Executive Handbook setting out 17 considerations across four sections, and an Operationalisation Handbook that treats agentic AI as a distinct category.
The practices that handbook specifies are recognisable to anyone who has secured a service account: least privilege for agent tool and data access, certification for reusable agent components, division of accountability fixed at design time, kill switches and timeouts to contain autonomous action, and traceability through searchable logging.
None of that is binding either. But an institution asking what to build while it waits for the Guidelines has more to work from than the parliamentary reply suggests.
Why principles-based is a decision, not a delay
Reading the reply as evasion would be a mistake. A principles-based approach applied proportionately is a deliberate regulatory posture, and MAS says why it chose it: AI is fast-evolving. Rules written to a particular architecture age badly when the architecture changes, and agentic systems are changing quickly enough that a prescriptive runtime standard issued today would likely be describing last year's deployments.
The reply also commits to continuing to review supervisory expectations and update them where necessary, through partnership with industry via the Future of Finance Institute.
The cost of that posture falls on institutions that want certainty before they build. They now know the scope, and they do not know the date or the specificity.
The claim that this is already binding
Coverage published the day after the reply reported it as confirmation that agentic AI sits inside binding supervisory rules, and framed Singapore as ahead of other jurisdictions.
The first half overstates the record. Supervisory expectations set out in guidelines that have not been issued are not binding, and MAS's own description of SAFR in the reply is a potential approach. The reply confirms what the Guidelines will cover, not that they are in force.
We make no assessment of how Singapore compares with other regulators, because the reply does not address it and we did not examine the position in any other jurisdiction.
What to watch
Two things would answer the question that was actually asked.
The first is the issuance of the Guidelines, which the reply says is imminent without saying when. Their treatment of agentic AI will show whether the scope confirmation means specific runtime obligations or the general lifecycle controls already consulted on.
The second is whether anything from SAFR is carried into a supervisory instrument. Governance envelopes, agent registries and mandatory disposition logging are implementable requirements. If they appear in the final Guidelines, Ms Jaafar's second question will have been answered with a yes.
