Compliance · June 2026 · 8 min read

OpenAI Deletes Your API Logs in 30 Days. MAS Wants 5 Years of Records. Here's the Gap.

If your Singapore fintech uses OpenAI, Google Gemini, or Anthropic Claude to make or assist with credit decisions, you almost certainly have a live compliance gap — and you may not know it. The AI vendor's data retention policy and MAS's audit trail requirement are on a collision course.

What the AI Vendors Actually Retain

When you call the OpenAI API to run a credit scoring model, generate a loan decision explanation, or flag a suspicious transaction, that request and response passes through OpenAI's infrastructure. How long does OpenAI keep those records?

If your fintech is running credit decisions through any of these APIs and relying on the vendor's logs to reconstruct what happened when MAS comes to examine you — that is not a viable compliance strategy.

What MAS Actually Requires

The relevant requirements come from two sources: the MAS Technology Risk Management (TRM) Guidelines and the MAS FEAT (Fairness, Ethics, Accountability, Transparency) Principles for AI in Financial Services.

MAS TRM Guidelines §7.3 — Activity Logs

Section 7.3.3 of the MAS TRM Guidelines states that financial institutions should retain activity logs for a minimum period as required by applicable laws and regulations — with MAS examinations typically expecting 5 years of records for material systems. For any system that touches a credit decision, loan approval, or risk assessment, that system is material.

The key phrase is "activity logs." MAS expects to see:

• What inputs were provided to the system
• What the system returned
• Which version of the model was used
• When the decision was made
• Whether and how the output was used in the final decision

MAS FEAT Principles — Accountability and Transparency

The FEAT Accountability principle requires that your institution be able to identify who or what made a decision and why. For AI-assisted decisions, this means the model's reasoning — not just the final output — must be traceable. The Transparency principle requires that individuals affected by AI decisions can receive an explanation.

Why Logging Just the Final Output Is Not Enough

Some teams respond to this by adding a database write after each API call: store the final credit score, the decision (approve/decline), and a timestamp. This is better than nothing, but it fails the FEAT audit test for three reasons.

1. You can't reconstruct what the model "saw"

A credit decision is not just the output number. It's the full context: the applicant's input features, the prompt template that framed the question, any retrieved context from a RAG system, and the specific model version. Without capturing the complete input, you cannot explain why the model scored an applicant the way it did — even if you know the score itself.

2. Model versions change without an obvious audit trail

OpenAI regularly updates models. When you call gpt-4o, you are not pinned to a specific snapshot. The model you called in January 2026 may behave differently from the model you call today under the same model name. If a customer disputes a decision made 8 months ago, you need to know which exact model version was in use — not just the alias you called.

3. The chain of custody must be tamper-evident

MAS does not just want records. For a material system, MAS expects those records to be integrity-protected — you should be able to demonstrate that the record has not been altered since the time of the decision. A database row that an engineer can UPDATE is not sufficient evidence of an unaltered audit trail.

Three Architectures, Three Risk Profiles

Here is how three common implementation approaches map to MAS compliance risk.

How to Fix It

If you're currently running Architecture A or B, you have two options.

Option 1: Build It Yourself

The engineering scope for a compliant in-house solution includes:

• An interceptor layer (middleware or SDK wrapper) that captures full request/response before and after the API call
• Model version resolution — reliably extracting the exact model snapshot from each API response
• A write-once, append-only log store (e.g., S3 with Object Lock, or a purpose-built immutable DB)
• Hash-chain construction on each record to detect tampering
• A 5-year retention policy with lifecycle management
• Query and export interface for examination requests
• Encryption at rest and in transit with key management

Realistic build estimate for a two-engineer team: 3–6 weeks to get to production, longer to get to MAS examination quality. Every LLM integration in your stack needs to be instrumented separately. Ongoing maintenance is non-trivial.

Option 2: Veritrail — 3 Lines of Code, 1 Day

Veritrail is a drop-in audit trail layer for AI decisions. It intercepts your LLM API calls, captures the complete decision record (inputs, outputs, model version, timestamp), generates a tamper-evident hash chain, and writes to a MAS TRM-compliant immutable store — all before returning control to your application.

# Python — wrap your existing OpenAI client
from veritrail import audit

client = audit(openai.OpenAI(), retain_years=5)

# Use exactly as before — audit trail is automatic
response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": credit_prompt}]
)

Every call now produces a cryptographically signed, tamper-evident record in your audit store. Records are retained for 5 years, indexed by customer ID, decision type, and timestamp. When MAS requests records, you export a signed audit package — not a database dump.

The Bottom Line

The gap between a 30-day vendor retention window and a 5-year regulatory requirement is not a theoretical risk. It is a live compliance gap for every Singapore fintech using LLM APIs in a decision workflow today.

MAS thematic inspections on AI risk management are increasing. The FEAT principles are moving from guidance to examination criteria. Getting examined with an 18-month gap in your AI decision logs — because you assumed the vendor kept them — is not a position you want to defend.

The fix is not expensive or slow. But it needs to happen before the next examination, not after.