Regulation · June 2026 · 10 min read

MAS AI Risk Management Guidelines 2025: What Every Singapore Fintech Must Do Before the Next Inspection

The Monetary Authority of Singapore has raised the bar on AI governance significantly. If your fintech uses AI for any material decision — credit scoring, fraud detection, insurance underwriting, customer segmentation — you are expected to document, explain, and audit it. Here is what that means in practice, and what most fintechs are getting wrong.

What Are the MAS FEAT Principles?

FEAT stands for Fairness, Ethics, Accountability, and Transparency. MAS published the FEAT Principles in 2019 as guidance for financial institutions using AI and data analytics in customer-facing or risk-management decisions. They have since evolved from aspirational guidelines into active examination criteria.

FEAT is not a checkbox compliance exercise. It is a framework for demonstrating that your institution can answer for every material AI decision — to customers, to regulators, and in the event of a dispute or complaint.

Who Is Affected — and When MAS Examines

FEAT applies to all MAS-licensed financial institutions operating in Singapore that use AI or machine learning in material decisions. This includes:

• Digital banks and neobanks (licensed under the Banking Act)
• P2P lending platforms (licensed under the Securities and Futures Act)
• BNPL providers where credit risk assessment is model-driven
• Licensed moneylenders using automated decisioning
• Insurtech firms using AI for underwriting or claims
• Payment service providers using AI for fraud detection

Critically, FEAT applies not just to models you build in-house but to any AI system you deploy, including third-party models accessed via API. If you use OpenAI's models for a credit decision, you are responsible for the FEAT compliance of that decision — not OpenAI.

The Four Pillars: What MAS Actually Examines

1. Fairness — Bias Testing and Monitoring

MAS expects evidence that you have tested your AI systems for differential impact across protected characteristics. This does not mean your model cannot produce different outcomes for different demographic groups — it means you have measured, documented, and taken reasonable steps to ensure those differences are not driven by illegitimate proxies.

What MAS examiners look for:

• Fairness assessment report produced at model deployment
• Ongoing fairness monitoring (not just a one-time pre-launch check)
• Evidence that protected characteristics are not used directly or as proxies
• Process for reviewing and responding to fairness alerts

2. Ethics — Human Oversight Mechanisms

For consequential decisions — loan approvals above a threshold, adverse actions (declines, credit limit reductions), fraud flags that trigger account restrictions — MAS expects human oversight to be demonstrably in place. Pure straight-through AI processing for high-stakes decisions, with no human review mechanism, is a FEAT risk.

This does not mean every decision needs human approval. It means your processes must show:

• Clear criteria for which decisions trigger mandatory human review
• Evidence that human reviewers exercise genuine judgment (not rubber-stamping)
• Escalation paths for edge cases and model anomalies

3. Accountability — Ownership, Versioning, and Audit Trails

This is where most fintechs have their most significant gaps. Accountability requires:

4. Transparency — Explainability for Customers and Examiners

Transparency has two audiences: the customer and the regulator.

For customers: Anyone materially affected by an AI decision — a loan decline, a credit limit reduction, a fraud flag — must be able to receive a meaningful explanation of why the decision was made. "Our model assessed your risk profile" is not an explanation. The explanation must reference the factors that drove the outcome.

For examiners: MAS expects that for any specific past decision, your team can produce — within a reasonable timeframe during an examination — the decision record with input features and the model's reasoning or scoring output. If you cannot reconstruct a decision from 18 months ago because the records do not exist, that is a material finding.

The Five Most Common FEAT Compliance Gaps

Based on the pattern of MAS examinations and FEAT assessment reports, these five gaps appear repeatedly across Singapore fintechs at the Series A–C stage.

Gap 1 — Relying on the AI Vendor for Your Audit Trail

If you use OpenAI, Google Gemini, Anthropic, or any LLM API, you are responsible for retaining the complete decision record — not the vendor. OpenAI retains API logs for 30 days. MAS expects 5 years. This is not a theoretical gap. It is a live compliance exposure for every fintech using LLM APIs in a credit or risk workflow today.

See our full analysis of the OpenAI log retention gap →

Gap 2 — No Record of Which Model Version Made a Decision

LLM providers update models frequently, often without explicit versioning at the alias level (e.g., gpt-4o is not a pinned snapshot). If a customer disputes a credit decision made six months ago, you need to know which exact model was in use — not just the alias you called. Most fintechs do not capture model version metadata per decision.

Gap 3 — Explainability Is Available at Demo Time, Not in Production

Many fintechs build SHAP or LIME explainability into their model validation workbooks, but the explanation is generated at training time for sample predictions — not for each live production decision. When a customer requests an explanation of their specific loan decline, the team cannot produce the SHAP values for that exact prediction.

Gap 4 — Fairness Testing Is Pre-Launch Only

Running a fairness assessment before launch satisfies the minimum bar. It does not satisfy the ongoing monitoring expectation. Data distributions shift. Customer demographics change. A model that was fair at deployment may show differential outcomes six months later. MAS expects periodic reassessment — at minimum annually, and after any significant model change.

Gap 5 — Human Oversight Is Documented but Not Practiced

Your compliance documentation says human reviewers approve all adverse decisions above SGD 10,000. Your operational reality is that reviewers approve 99% of AI recommendations within 30 seconds, with no documented basis for disagreement. This is not human oversight — it is a rubber stamp. MAS examiners can distinguish between the two.

Where FEAT Meets the TRM Guidelines

FEAT and the MAS Technology Risk Management (TRM) Guidelines operate in the same space but address different dimensions. The intersection is where most examination risk sits.

Pre-Inspection Checklist for AI Risk Managers

Use this checklist to identify your most critical gaps before a MAS thematic inspection or routine examination.

Fairness

• Fairness assessment completed and documented for all production AI models
• Ongoing fairness monitoring in place (periodic reassessment, at minimum annual)
• Protected characteristics not used directly or via high-correlation proxies
• Process exists to detect and respond to fairness alerts in production

Ethics

• Human oversight criteria documented — which decisions require human review
• Evidence that human reviewers exercise genuine judgment, not rubber-stamping
• Escalation path for edge cases and model anomalies
• Customer communication process for AI-driven adverse actions

Accountability

• Named model owner for each production AI system
• Complete model version history maintained and accessible
• Full decision audit trail captured (inputs, outputs, model version, timestamp)
• Audit trail is tamper-evident (cryptographic integrity, write-once)
• Audit trail retained for minimum 5 years
• Vendor API logs NOT relied upon as primary audit record
• Process to retrieve any specific decision within 48 hours of a request

Transparency

• Explainability capability available per live decision (not just at training time)
• Customer-facing explanation can be generated for any specific past decision
• MAS examination package can be produced — signed records, model version details, decision log
• Staff trained on how to respond to customer explanation requests