MAS Guidance

Key dates

2026-10-28

MAS published its statement reinforcing banks’ existing environmental-risk management expectations in the context of transboundary haze, pollution and deforestation.

Suggested considerations

• Banks should consider mapping customers, counterparties and financed activities that may be linked to open burning, deforestation, peatland development or other haze-related pollution, at both customer and portfolio level.
• Compliance and risk teams may wish to establish a process for capturing, validating and escalating relevant NEA information and notices issued under the Transboundary Haze Pollution Act.
• Banks should consider enhancing customer due diligence for potentially haze-linked customers, including obtaining evidence of land ownership or control, fire-prevention and response arrangements, concession and supply-chain information, environmental permits, incident history and remediation measures.
• Banks may wish to document customer engagement, responses, management decisions and escalation criteria so that the rationale for continuing, conditioning, reducing or terminating exposure is demonstrable.
• Credit committees and relationship teams should consider incorporating environmental-risk findings into new-financing approvals, renewals, covenant-setting, pricing, collateral assessments and ongoing monitoring.
• For higher-risk customers, banks may wish to consider enhanced measures such as site visits, independent environmental expertise, satellite or geospatial monitoring and contractual rights to obtain information or suspend further drawdowns.
• Banks should consider defining governance triggers for cases involving suspected or confirmed breaches, with senior-management or board escalation where exposure limits or relationship exit is contemplated.
• Banks may wish to review public environmental-risk disclosures and transition plans for consistency with the strengthened supervisory focus, while recognising that the statement itself does not create a new disclosure deadline.

What changed

MAS has expressly linked banks’ environmental-risk processes to haze-related pollution and deforestation risks. Banks should consider relevant information released by the National Environment Agency under the Transboundary Haze Pollution Act and engage customers potentially connected to haze-producing activities to obtain sufficient information about their role, including controls to prevent, detect and stop fires.

Key dates

2026-10-07

MAS issued the Guidelines on Artificial Intelligence Risk Management following its November 2025 consultation.

2027-10-07 Deadline

The Guidelines take effect. FIs should meet the expectations in Sections 3 and 4 from this date.

2027-10-07

MAS intends to consult the financial sector during 2027 on what additional guidance on agentic AI would be useful.

2028-10-07 Deadline

FIs should meet the expectations in Sections 5 and 6 by this date under the phased implementation timetable.

Suggested considerations

• FIs should establish or update an enterprise inventory of AI systems, models, embedded AI functionality and third-party AI services, using a level of granularity appropriate to their risk profile.
• Compliance and risk teams may wish to classify individual AI use cases by materiality, including potential effects on customers, prudential soundness, operational resilience, other financial institutions and the wider financial system.
• Boards and senior management should consider documenting AI risk appetite, ownership, escalation routes and the allocation of responsibilities across business, risk, compliance, technology, cybersecurity, data and model-governance functions.
• FIs should map existing AI controls across the lifecycle, including data governance, development and validation, testing, human oversight, cybersecurity, monitoring, incident management and change management, and identify gaps against the Guidelines.
• Procurement, outsourcing and third-party-risk functions should consider adding AI-specific due diligence, assurance, contractual rights, performance monitoring, incident notification and exit or substitution arrangements for external AI providers.
• FIs should assess whether existing governance committees and risk frameworks provide sufficient cross-functional oversight, rather than assuming that a new dedicated AI committee is necessary.
• FIs may wish to define evidence that supports proportionality decisions, including why basic policies and procedures are adequate for lower-materiality AI use cases.
• Implementation planning should distinguish the expectations in Sections 3 and 4, which should be met from 7 October 2027, from Sections 5 and 6, which should be met by 7 October 2028.

What changed

The Guidelines introduce an enterprise- and use-case-level framework for managing AI risk. Boards and senior management are expected to oversee AI risk, define accountabilities, set risk appetite, and maintain suitable risk-management frameworks, policies and procedures; existing governance structures may be used and a dedicated AI committee is not required solely for compliance.

Key dates

2025-12-30

MAS issued the revised Notices FAA-N27, 508 and SFA 04-N24 and published its response to feedback.

2026-08-24

MAS published the circular and FAQs explaining the revised misconduct-reporting requirements and the discontinuation of the existing system.

2027-01-01 Deadline

The revised Notices FAA-N27, 508 and SFA 04-N24 take effect; the existing Notices FAA-N14, 504 and SFA 04-N11 are cancelled; and the existing misconduct reporting system is discontinued.

2027-01-22 Deadline

Default deadline for reporting qualifying pre-2027 misconduct matters that were not reported under the cancelled Notice, calculated as 21 calendar days after 1 January 2027, unless MAS permits a longer period in writing.

Suggested considerations

• Compliance teams may wish to map existing misconduct, incident, whistleblowing, investigation, HR and police-referral processes to the revised definition and categories of reportable misconduct.
• Firms should consider establishing a documented escalation test for when reasonable grounds to believe misconduct occurred arise, rather than waiting for a final investigation finding, and configuring workflow controls around the 21-calendar-day initial-reporting deadline.
• Firms may wish to obtain and operationalise the prescribed misconduct-report, investigation-report and update-report formats before the existing system is discontinued.
• Internal investigation procedures should be reviewed to ensure that the prescribed investigation information, supporting evidence, investigator assessment, corrective action and appeal information can be produced concurrently with the initial MAS report where an investigation has commenced.
• Police-report handling should be updated so that available police reports and required accompanying details are captured and submitted with the misconduct report, with subsequent police or criminal-proceeding developments tracked for update reporting.
• Firms should consider controls for providing representatives with copies of initial misconduct reports and subsequent updates within the prescribed timelines, including appropriate treatment of former representatives and confidentiality or privilege issues.
• A transitional review of open matters may be appropriate to identify cases where reasonable grounds arose before 1 January 2027 but no report was filed under the cancelled Notice; those matters may need to be reported by 22 January 2027, subject to any written extension from MAS.
• Record-retention policies, case-management systems and management information should be tested against the minimum five-year retention requirement and the requirement that electronic records remain accessible, retrievable and readable.

What changed

From 1 January 2027, Notices FAA-N27, 508 and SFA 04-N24 replace and cancel the existing Notices FAA-N14, 504 and SFA 04-N11. The initial misconduct report must generally be submitted within 21 calendar days after the firm has reasonable grounds to believe that reportable misconduct was committed or is likely to have been committed; a conclusive investigation finding is not required before reporting.

Key dates

23 August 2018

– Initial version of CMI 27/2018 “Controls and Disclosures to be Implemented by Licensed Securities-Based Crowdfunding Operators” published by MAS

08 October 2018

– MAS publishes FAQs on Lending-based Crowdfunding, clarifying licensing and prospectus requirements and interacting with SCF-related guidance

05 March 2021

– Updated version of CMI 27/2018 and Annex A / A1 / A2 for issuer default notification uploaded, refining default reporting and controls expected of SCF operators

21 January 2025

– Revision of Guidelines on Criteria for the Grant of a Capital Markets Services Licence (SFA 04-G01), which interact with licensing expectations for SCF operators

14 July 2026

– Last revised date of circular CMI 27/2018, signalling the most recent MAS expectations on controls and disclosures for licensed SCF operators

Suggested considerations

• Review existing issuer due diligence policies and procedures and update them to align with MAS’s expectations on structured checks, documentation, and investor disclosure of due diligence scope for all SCF offers.
• Implement a formal policy prohibiting the use of new loans to repay existing overdue loans, except where legitimate reasons exist; define those reasons, approval thresholds and documentation requirements for exceptions.
• Enhance lending workflows to ensure that, when new loans are extended to borrowers with outstanding loans, the platform system automatically collates and presents total outstanding exposure and the rationale for the new loan to investors in pre-investment disclosures.
• Develop and approve a detailed issuer default management framework that defines escalation triggers, recovery options, decision criteria, investor communication templates, and record-keeping requirements.
• Update investor terms and conditions and consent mechanisms so that investors explicitly agree to any potential recovery-related costs, with clear fee schedules and scenarios disclosed before costs are incurred.

What changed

• - Licensed SCF operators must implement structured due diligence checks on issuers, including clear policies on information to be obtained, risk assessment criteria and documentation standards, and...
• Lending-based SCF operators are generally prohibited from allowing a borrower to take up a new loan to repay an existing overdue loan, unless there are legitimate, documented reasons to extend a new...
• Where a lending-based SCF operator does extend a new loan to a borrower with outstanding loans, it must disclose the borrower’s total outstanding loans and the reasons for extending the new loan so...
• SCF operators must establish formal policies and procedures for issuer default management, documenting circumstances under which the operator will pursue various recovery options (e.g.
• Operators must disclose to investors the different recovery options and associated costs and must seek and obtain investors’ consent before incurring any recovery-related costs that will be borne by...

Key dates

18 October 2023

Consultation Paper on Guidelines on Transition Planning for Insurers issued; (P013-2023)

18 December 2023

Consultation closing date

05 March 2026

MAS response to consultation and issuance of final Guidelines/addendum; Last Revised Date for related Environmental Risk Management Guidelines; .[https://www.mas.gov.sg/regulation/circulars/id04_26]

Suggested considerations

• Establish Transition Planning Process: Develop risk-proportionate frameworks for identifying, assessing, and managing climate transition/physical risks, integrated into governance, risk management, and strategy.
• Conduct Assessments: Perform scenario analyses (short/medium/long-term), materiality reviews, and multi-year planning beyond typical horizons.
• Engage Stakeholders: Collaborate with customers, asset managers, and investees to support decarbonization/adaptation plans; avoid premature withdrawal of finance/insurance.
• Disclose Risks: Report meaningfully on climate risks, interdependencies (e.g., climate-nature), and trade-offs to stakeholders.
• Board Oversight: Ensure senior management/governance integration, with documentation for MAS supervision.

What changed

• - Addendum to Existing Guidelines: Supplements the Guidelines on Environmental Risk Management with specific guidance on transition planning processes, focusing on managing transition risks (e.g.,...
• Risk-Proportionate Approach: Insurers must establish transition planning proportionate to factors like business size, exposure, and complexity, including internal strategic planning, risk management,...
• Holistic Integration: Emphasizes multi-year assessments, scenario analysis, and collaboration over divestment, accepting short-term emissions increases if aligned with net-zero pathways; integrates...
• Supervisory Expectations: Non-binding but sets clear MAS benchmarks for "sound" practices, building granularity on prior environmental risk frameworks.

Key dates

19 February 2021

19 March 2021; - Consultation period on proposed revisions to Notices 124, 125, and 126

30 September 2022

- Last revision of MAS Notice 126 on ERM, including ORSA guidelines (effective 01 January 2023)

30 September 2022

- MAS response to consultation feedback on ERM revisions

02 January 2026

- Publication of ID 01/26 circular reminding of ORSA submission requirements under Notice 126

Suggested considerations

• Review current ORSA processes to confirm entity-specific reports are produced, not mere group report adoptions.
• Conduct gap analysis against Notice 126: Ensure ORSA covers risk identification, solvency assessment, stress testing (e.g., macroeconomic, liquidity), and forward-looking horizons aligned with business planning.
• Update board and senior management oversight of ERM, documenting rationale for any group influences while maintaining local tailoring.
• Submit ORSA reports to MAS as per ongoing Notice 126 timelines (typically annually); remediate any past lapses via voluntary disclosure if needed.
• Enhance internal controls, training, and audit trails for ORSA compliance to avoid future observations.

What changed

No new regulatory changes are introduced; this is a reminder and clarification of existing MAS Notice 126 requirements on ORSA submissions. Key emphasis: Insurers cannot fully rely on group ORSA reports—local entities must produce their own tailored ORSA reports reflecting entity-specific risks, time horizons, and business strategies. It reinforces ORSA as a core ERM tool involving own risk assessment, solvency projections, and stress testing (e.g., macroeconomic scenarios).

Key dates

16 December 2025

- Circular published, announcing updated template and process

1 February 2026

- Mandatory use of updated FI Incident Reporting Template on MAS-Tx for all subsequent incident reports (initial notifications follow existing prescribed timelines). https://www.mas.gov.sg/regulation/circulars/circular-on-financial-institution-incident-reporting

Suggested considerations

• Review and familiarize with the updated FI Incident Reporting Template (downloadable from MAS site).
• Integrate MAS-Tx platform access and training for compliance, IT, and risk teams to handle submissions.
• Update internal incident response plans to ensure initial notifications occur "as soon as possible but no later than prescribed timelines" under relevant rules (e.g., Technology Risk Management Notices), followed by template-based reports via MAS-Tx post-1 February 2026.
• Conduct gap analysis against related TRM Notices (e.g., FSM-N05 for banks, FSM-N25 for trust companies) to align incident detection and reporting. https://panorays.com/blog/mas-trm-compliance/
• Test processes via simulations, as recommended in TRM guidelines for incident response readiness. https://panorays.com/blog/mas-trm-compliance/

What changed

• - Updated Reporting Template: FIs must use the new FI Incident Reporting Template (65.8 KB) for submitting details of reportable incidents on MAS-Tx, replacing prior formats.
• Dual Reporting Process: Initial notification required "as soon as possible, but no later than the timeline prescribed" in relevant acts, regulations, notices, circulars, or guidelines; followed by...
• Platform Mandate: All subsequent reports must be filed through MAS-FI Transactions Platform (MAS-Tx), streamlining MAS oversight.

Key dates

1 January 2026

- Effective date; capital instruments subject to new criteria and non-retail restriction

Suggested considerations

• Review and update capital instruments: Assess existing and planned AT1/Tier 2 issuances against new criteria; amend terms if needed to qualify under RBC 2.
• Implement distribution controls: Establish processes to ensure instruments are sold exclusively to non-retail investors in Singapore (e.g., accredited investors, institutions); update investor eligibility checks, prospectuses, and distribution agreements.
• Update internal policies: Revise capital management, valuation, and reporting procedures per amended Notice 133/FHC-N133; integrate into RBC 2 calculations.
• Board/ senior management oversight: Document compliance gap analysis, remediation plans, and training for finance/treasury teams.
• Reporting: Monitor and report capital positions under RBC 2, notifying MAS of material changes.

What changed

• - Amendments add additional criteria for capital instruments to qualify as AT1 or Tier 2 Capital, aligning with international prudential standards under RBC 2 (Risk-Based Capital 2 framework).
• Key condition: Instruments must be sold only to persons who are not retail investors in Singapore, prohibiting retail distribution to mitigate risks from less sophisticated investors.
• Updates apply to valuation and capital requirements in Notice 133 (for licensed insurers) and Notice FHC-N133 (for Designated Financial Holding Companies).
• Follows MAS review of consultation feedback, proceeding with proposed enhancements originally outlined in the March 2025 Consultation Paper.