Singapore VCC insights

MAS AI Risk Management Guidelines: What Fund Managers and VCCs Must Do Now

By VCC Editorial Team · Published 14 October 2026 · Updated 16 October 2026

Short answer: MAS issued its Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They apply to all financial institutions, including licensed and venture capital fund management companies, and take effect on 7 October 2027. Oversight, AI identification, inventory and risk materiality assessment must be in place by then, with full life cycle controls and capability expected by 7 October 2028.

This article is general information only and is not legal, tax or investment advice. For matters needing legal advice, we work with a panel of experienced Singapore law firms.

The MAS AI risk management guidelines set out what a fund manager’s board, senior management and control functions are expected to do about artificial intelligence (AI). This article covers the instrument itself: scope, timetable, proportionality and the deliverables a licensed fund management company (LFMC) or VCC manager should plan for. Staff-level guardrails for generative AI are covered in our piece on generative AI controls for VCC operations. All sources were checked on 14 October 2026.

What did MAS publish on 7 October 2026?

MAS published the Guidelines on Artificial Intelligence Risk Management and a Response to Feedback Received (reference P017-2025), both dated 7 October 2026. The Guidelines set supervisory expectations for how financial institutions (FIs) manage AI risk at enterprise and use case level.

The MAS media release names four expectations: oversight with clear accountabilities; identifying, assessing and managing AI risks across the life cycle; managing third-party AI; and risk-proportionate application. MAS intends to consult again in 2027 on additional guidance for agentic AI.

The six sections cover introduction, application, AI oversight (Section 3), key AI risk management systems, policies and procedures (Section 4), AI life cycle controls (Section 5) and AI capability and capacity (Section 6). They complement existing MAS instruments: the Fairness, Ethics, Accountability and Transparency (FEAT) principles continue to apply, and MAS outsourcing and third-party expectations apply to third-party AI.

Paragraph 1.3 defines AI as machine-based systems or models that derive outputs through learned premises such as the data or inputs they receive. Generative AI and AI agents are in scope; rule-based tools and robotic process automation without learning would not ordinarily be AI (footnote 6).

Do the MAS AI risk management guidelines apply to fund managers and VCCs?

Yes for fund managers. The MAS Guidelines page lists “Licensed Fund Management Company”, “Venture Capital Fund Management Company” and “REIT Management” among covered entity types, alongside banks, insurers and trust companies.

The Guidelines define an FI by reference to section 2 of the Financial Services and Markets Act 2022, and paragraph 2.1 states that they apply to all FIs “in a proportionate manner, according to their size and risk profile”. MAS’s response to feedback adds that the expectations apply regardless of where an FI is incorporated.

For a variable capital company (VCC), the practical point is the manager. Section 46 of the Variable Capital Companies Act 2018 requires a VCC to have, at all times, a manager that holds a capital markets services licence for fund management, is an exempt person under section 99(1)(a) to (d) of the Securities and Futures Act 2001, or is otherwise prescribed. The licensed and exempt categories are all FIs regulated by MAS. The Guidelines do not mention VCCs as such, so the obligations land on the manager. A VCC board should expect its manager to show how AI used for the sub-funds is inventoried and controlled. Our guide to the fund management licence in Singapore sets out the licensing side.

An LFMC in an international group may leverage group AI frameworks that meet the Guidelines (paragraph 1.5), but local senior management remains accountable for Singapore-specific requirements and must be able to demonstrate its oversight to MAS (paragraph 3.6).

Are exempt single family offices in scope?

MAS does not say. Neither the Guidelines nor the response to feedback refers to family offices, and SFOs are not in MAS’s list of entity types.

The statutory definition is wider than the list. Limb (q) of the FSMA 2022 definition of “financial institution” includes persons regulated under an MAS scheduled Act and expressly includes persons exempted from being licensed or regulated, subject to classes MAS may exclude by regulations. A single family office (SFO) relying on the class licensing exemption under the revised framework that took effect on 15 June 2026 is therefore not obviously outside the definition, but MAS has not said it expects SFOs to adopt the Guidelines. We draw no conclusion either way.

An SFO should take advice and, if it uses AI in investment or reporting work, consider adopting at least the light basic governance in paragraph 2.5. Where the SFO’s VCC is managed by a third-party LFMC, the Guidelines apply to that manager. Our articles on whether an SFO can manage its own VCC and the 15 June 2027 SFO transition cover the structural questions.

When do fund managers have to comply?

The Guidelines take effect on 7 October 2027, with a second phase to 7 October 2028. MAS had proposed 12 months; respondents most often asked for 18 to 24, and MAS phased the more resource-intensive areas.

Deadline	What must be in place	Source
Now	Life cycle controls for high-risk AI use cases “as soon as possible”, not deferred to the end of the transition	Response to feedback, para 13.5
7 October 2027	Section 3 (board and senior management oversight) and Section 4 (AI identification, inventory and risk materiality assessment)	Guidelines, para 1.8
7 October 2027	Basic AI governance policies, for FIs that qualify under para 2.3	Response to feedback, para 13.6
7 October 2028	Section 5 (AI life cycle controls) and Section 6 (AI capability, capacity and technology infrastructure)	Guidelines, para 1.8
2027 (date not set)	Further MAS consultation on additional guidance for agentic AI	MAS media release, 7 October 2026

Can a small fund manager rely on basic AI governance policies?

Often, yes. Under paragraph 2.3, an FI may apply basic AI governance policies where poor performance or unavailability of its AI services or tools is unlikely to have a material adverse impact on the FI, its customers or other stakeholders.

The test covers financial, operational, regulatory, legal and reputational impact on the FI and impact on customers, including fairness and consumer protection. Paragraph 2.4 examples that would generally qualify include drafting or proofreading emails, summarising documents or meeting notes for internal reference, generating formulas or charts, and internal chatbots that help staff find policies, with humans reviewing outputs before use (footnote 13).

Basic policies must at minimum include, under paragraph 2.5:

• clear accountability for AI oversight, for example a designated member of senior management;
• permitted and prohibited uses, such as no client information in public AI tools, with mandatory human review points;
• an approved list of AI tools and a process for approving new ones;
• regular compliance checks; and
• periodic and trigger-based review; MAS encourages at least an annual review, documented even where nothing changes.

Two points catch managers out. First, an FI that has not adopted AI at all is still expected to have basic AI-related policies stating whether and how staff may use AI (response to feedback, para 3.14). Second, AI that influences investment decisions is unlikely to meet the paragraph 2.3 test: footnote 12 and the response to feedback single out fund management services for more rigorous transparency, explainability and fairness controls.

What must the board and senior management do?

The board, or a committee it delegates, owns the governance approach. Senior management owns implementation. A dedicated AI committee is not required; MAS dropped that consultation proposal and now allows existing structures, provided the FI can show a consolidated, coordinated view of AI risk.

Under paragraph 3.4, the board or its delegated committee approves and reviews the AI governance approach, keeps AI risk within appetite (footnote 18 suggests measures such as the number or financial impact of AI incidents, or material use cases dependent on one provider), sets roles and ensures it understands AI well enough to challenge management.

Under paragraph 3.5, senior management implements and reviews the framework, assigns roles across business and control functions, sets an escalation process for AI incidents and threshold breaches, updates the board on material issues and resources the work. The three lines of defence model may be used (footnote 19).

An LFMC with outsourced or designated-staff compliance should map the Guidelines’ “designated control function” onto that arrangement before October 2027.

What does an AI inventory and risk materiality assessment involve?

Section 4 links three processes: identifying AI use, recording it in an inventory and rating each use case for risk materiality, each overseen by a designated control function that is the final arbiter of what counts as AI.

Identification must cover AI embedded in, or used to deliver, services from material third-party service providers (paragraph 4.2). Footnote 21 cites software-as-a-service with AI features not sold as AI; for a fund manager that can include portfolio analytics, investor portal and document platforms. Where shadow AI or poor vendor disclosure prevents full identification, the FI must mitigate the residual risk (paragraph 4.4).

The inventory may extend existing registers or stand alone, but should link to them, for example through vendor identifiers in the outsourcing register (paragraph 4.6). Paragraph 4.7 suggests attributes such as purpose, approved scope, model type, data used, dependencies, life cycle status, materiality rating, owners and documentation links. If you already keep a board-ready outsourcing inventory, use its vendor identifiers.

The materiality assessment must consider, at minimum, impact, complexity and reliance (paragraph 4.12), assessed on both an inherent and a residual basis (paragraph 4.11).

Dimension (para 4.12)	What MAS asks you to consider	Fund manager illustration
Impact	Consequences of failure or poor performance for the FI and its customers, plus the sensitivity of data processed	A model that ranks securities for a sub-fund’s portfolio scores higher than a meeting-note summariser
Complexity	Nature and novelty of the technology, data used, explainability of outputs and, for third-party AI, visibility into the model	A vendor’s large language model inside a research platform with limited disclosure
Reliance	Degree of reliance on the output, autonomy granted and level of human involvement	An AI agent that can place or amend orders, compared with a tool whose output a portfolio manager re-checks

Which life cycle and third-party controls apply by 2028?

Section 5 sets proportionate controls from inception to decommissioning, under headings including data management, transparency and explainability, fairness, human oversight, third-party AI, evaluation and testing, cybersecurity, pre-deployment review, post-deployment monitoring and change management.

Three expectations stand out for asset managers. For high-risk use cases, paragraph 5.3 requires tested contingency plans with fallback options such as manual processes, and tested activation protocols for any “kill switch”. Paragraph 5.9 requires human oversight that accounts for automation bias, by reviewers able to intervene. Paragraph 5.23 requires monitoring of all deployed AI, including third-party AI, against defined metrics and thresholds. Our article on validating a portfolio risk model for a VCC covers the testing discipline.

On third-party AI, paragraph 5.11 states that the decision to use it is the FI’s and that the FI retains primary accountability. Considerations include transparency (independent certifications, not self-attestations), supply chain, concentration risk, change notification, contingency plans and legal agreements covering performance, data protection, audit rights and notice when AI is introduced or updated. If residual risk cannot be brought within appetite, the FI should limit, suspend or replace the service.

Section 6 adds staff competence, training and adequate technology infrastructure.

How should a fund manager implement the Guidelines?

Work backwards from 7 October 2027 and treat the inventory as the critical path. A practical sequence for an LFMC or VCC manager:

1. Appoint an accountable senior manager for AI oversight and choose the existing committee that will carry AI risk; minute the decision.
2. Adopt a basic AI policy now: permitted and prohibited uses, approved tools, an approval route and mandatory human review points.
3. Designate the control function for identification, inventory and materiality, including how outsourced compliance or group functions fit in.
4. Sweep front office, operations, investor relations and material vendors for AI, including embedded features.
5. Build the inventory, linked to the outsourcing register.
6. Rate each use case on impact, complexity and reliance, inherent and residual, and decide which can stay under basic governance.
7. Apply life cycle controls to high-risk use cases immediately.
8. At contract renewal, add AI notification, audit and data protection terms, and document how each third-party AI tool was tested.
9. Set board-level AI risk appetite statements, reporting and incident escalation.
10. Plan Section 5 and 6 work (monitoring, testing, change management, training, infrastructure) to complete by 7 October 2028, and diarise at least an annual review.

VCC boards should add to the annual manager review the AI inventory entries for their sub-funds and how high-risk use cases are controlled.

Frequently asked questions

Are the MAS AI risk management guidelines legally binding?

They are issued as guidelines rather than as a notice. MAS describes them as setting out clear supervisory expectations for FIs, so managers should expect supervisory engagement on them from 7 October 2027. Take legal advice on the consequences in any specific case.

Does a VCC need its own AI policy?

The Guidelines do not refer to VCCs; they apply to the FI managing the VCC. A VCC board should normally obtain assurance from its manager rather than duplicate the framework.

Can a Singapore LFMC use its parent’s global AI framework?

Yes, if it meets the Guidelines’ expectations. Local senior management stays accountable for Singapore-specific requirements.

Is a rules-based screening or allocation tool “AI” under the Guidelines?

Not ordinarily. Tools whose outputs are fully determined by manually specified rules or formulae, and robotic process automation without learning, are outside the definition. Hybrid systems with learned components should be assessed.

Sources

• MAS, Guidelines on Artificial Intelligence Risk Management for Financial Institutions, 7 October 2026
• MAS media release, MAS Sets Out Supervisory Expectations on Responsible AI Adoption by Financial Institutions, 7 October 2026
• MAS, Response to Feedback Received on Guidelines on Artificial Intelligence Risk Management (P017-2025), 7 October 2026
• Financial Services and Markets Act 2022, section 2
• Variable Capital Companies Act 2018, section 46

Raffles Corporate Services helps fund managers, VCC boards and family offices put governance in place, from VCC incorporation and family office set-up to the board papers and policy records that MAS expects to see. Email hello@rafflescorporateservices.com or Call/SMS/WhatsApp +65 8501 7133, or visit Raffles Corporate Services. For company secretarial support, see Singapore Secretary Services.

Last reviewed: 14 October 2026. The Editorial Team, Variable Capital Companies Act.

Discuss your fund, family office or trust structure

Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.

• Email: hello@rafflescorporateservices.com
• WhatsApp: +65 8501 7133
• WhatsApp: +65 9018 0072

Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.