What do the MAS AI risk management guidelines expect?
From 7 October 2027, the MAS AI risk management guidelines expect financial institutions to hold an AI inventory and a risk materiality rating per use case, under board oversight. On our reading, your marketing stack is in; your low-impact uses can run on basic policies (2.3).
MAS's release says the final Guidelines "apply to all FIs and all forms of AI technologies", and "FIs remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties." Leapbuzz's AI strategy work builds this with you; this is marketing guidance, not legal advice.
"Realising these benefits sustainably requires financial institutions to understand and manage the risks that come with increasingly capable AI systems."
Ho Hern Shin, Deputy Managing Director, MAS, in the MAS media release of 7 October 2026
Does marketing AI fall under the MAS guidelines?
Yes, on the paragraph 1.3 definition of AI, although the word "marketing" appears once in the MAS AI risk management guidelines. Mapping them onto your stack is our inference.
| MAS text | What it pulls into your inventory |
|---|---|
| 1.3: AI "derive outputs through learned premises" | Your bidding, creative tools, chatbots, propensity models |
| Footnote 6: generative AI, AI agents | Agents in; rule-based tools out |
| 2.4(e): image generators for marketing | Basic tier, if people check outputs (footnote 13) |
| Footnote 10: third-party AI | Agency agents in your accounts; ad platform AI |
| Footnote 21: SaaS "not explicitly sold as AI" | Your analytics tools with an AI summary |
For MAS-regulated banks and finance brands, nearly everything you run meets the 1.3 definition, shadow AI included (4.4; see our post on company data in AI tools). The open question is the tier.
Which marketing tools belong in the AI inventory?
Every marketing use case you rely on, as far as practicable, agency agents in your accounts included, each with the ten attributes paragraph 4.7 says it may include. Our enterprise AI tiers guide fills the "data used" column.
| Your use case | Our starting band | Ask your vendor for |
|---|---|---|
| Bidding to a cost or value target | Standard | Change notices, spend caps |
| Generated images and ad copy | Basic, with human approval | Approved tool list |
| Your chatbot on a third-party model | Enhanced | Own-script tests, kill switch |
| Propensity model choosing who sees an offer | Enhanced | Lineage, fairness check, audit right |
| Agent operating ad accounts or reports | Standard to Enhanced, by its actions | Access scope, action logs |
Standard and Enhanced are our bands; MAS defines only the basic tier (2.3). 5.7 flags AI that "may lead to unfair access or denial of financial services"; footnote 12 names credit scoring (offer targeting is our inference). On our reading of 5.6, rate insurer quote filters with underwriting.
How do you rate the risk materiality of a marketing use case?
You score Impact, Complexity and Reliance (paragraph 4.12) before and after your controls (4.11); your residual rating should sit inside risk appetite before go-live.
Add the ticked points. Our bands: 0 to 1 BASIC, 2 to 4 STANDARD, 5 to 8 ENHANCED.
No rating yet
Score 0 of 8. Tick what applies to one tool.
MAS publishes no scoring sheet: you set the method (4.10), and your control function arbitrates or approves each rating (4.13).
What assurance must a bank get from AI vendors and agencies?
You need enough to test the tool on your own data and hear about AI changes first (paragraph 5.10), plus the eight considerations in 5.11, expected by 7 October 2028. Our check scores the evidence you hold.
OPEN: 0 of 19 points, 3 must-haves missing.
Fix first: test the tool on your own data and use cases (5.10).
"The decision to onboard and use third-party AI is ultimately a decision of the FI, and the FI retains primary accountability for its use of third-party AI"
MAS Guidelines, paragraph 5.11
Give each of your rows one exit line: what runs if you suspend the tool tomorrow (5.3, 5.11(e)); 5.26 covers decommissioning. Each layer of our agentic marketing operating model needs one. Do you sell AI to banks instead? Our parent company, Origin Pi, lists the evidence pack a bank may ask its vendors for.
How do IMDA's agentic framework and PDPC's GenAI guidelines fit?
IMDA's and the PDPC's guidance sit beside MAS: IMDA supplies the agent practice MAS points you to (footnote 11), and the PDPC gives you, as deployer, personal data duties.
| Document | Date and status | What it asks of you |
|---|---|---|
| MAS Guidelines on AI Risk Management | 7 Oct 2026; supervisory expectations | Inventory, rating, vendor assurance |
| IMDA Agentic AI framework | Version 1.5, 20 May 2026 | Bound agent risk; keep humans accountable |
| PDPC GenAI Advisory Guidelines | 20 Jul 2026; "not legally binding" | Deployers answer for prompts, outputs, agent data |
Name all three in your chatbot or agent row; our fintech marketing compliance guide covers the conduct rules beside them.
The timeline to 7 October 2027, and what to do today
The MAS AI risk management guidelines expect Sections 3 and 4 from 7 October 2027, about eleven months after this post, and Sections 5 and 6 a year later.
Do this today:
- Open your sheet: the ten 4.7 columns, plus our "vendor assurance held" and "exit plan".
- Add a row per marketing AI use you run, your agency's tools included.
- Score each with our four questions; send it to your AI risk owner, or ask us for a draft.
Our house rule (MAS sets none): no marketing AI tool goes live without a row and an exit line, and anything ENHANCED waits for your control function.