The MAS Technology Risk Management Guidelines expect Singapore financial institutions to have competent people managing technology, from the board down to the staff who run systems day to day. For AI agents, that means operators trained in change control for agent briefs, access to agent credentials, incident response when an agent misbehaves, and oversight of model and platform providers.
What do the TRM Guidelines ask of the people who run agents?
The MAS Technology Risk Management Guidelines set out risk management principles and best practices for technology in financial institutions. They are guidelines, applied in proportion to each firm's size and risk, but MAS expects firms to follow them and examines against them. In substance they cover:
- Governance. The board and senior management oversee technology risk. Board members should have the knowledge to do so, and firms should provide training where needed. Staff in technology roles should be competent for what they do.
- A technology risk management framework, including identifying and assessing risks before new technology goes live.
- Change and service management. Changes to production systems should be assessed, tested, approved and recorded. Incidents should be managed, escalated and learned from.
- Access control. Access, especially privileged access, should be granted on need, reviewed and monitored.
- Cyber security. Firms should run security awareness training for all staff, and monitor and respond to threats.
- Third-party risk. Firms stay responsible for services provided by others and should assess and monitor them.
None of this names AI agents. All of it applies to them. The system view is set out in MAS Technology Risk Management Guidelines and AI agents. This piece is about the operators.
Who do they apply to?
Financial institutions supervised by MAS, including banks, insurers, capital markets intermediaries and payment service providers. Inside them, the people who operate agents include:
- Workspace operators who run agents day to day, monitor verdicts and handle held actions.
- Agent owners who maintain each agent's brief, sources and bounds.
- Technology and platform staff who manage connections, credentials and environments.
- Incident and operations staff who respond when an agent fails.
- Vendor managers overseeing model and platform providers.
- Senior management and the board, who need enough understanding to oversee. Boards in other sectors face the same question, as what AI agent training a telecoms operator board needs shows.
What competence do the guidelines imply when agents act?
Change control for agents. Changing an agent's brief, adding a source or raising its depth is a production change. Operators must route it through change management: assess, test, approve, record. Raising a capability's depth needs evidence; depth is earned through certification against the firm's own cases, not set by editing a configuration. A certification run that clears no depth drops the agent to depth 1 the same day, and operators must know what that does to the work in flight.
Access to agent credentials. Agents hold connections to core systems. Those connections are privileged access. Operators must treat them as such: least privilege, review, and no sharing of credentials between agents or with people.
Recognising incidents. An agent that acts outside its bounds, produces a run of wrong answers, or is manipulated by a prompt injection in an external document is having an incident. Operators must recognise it, stop the agent if needed, and escalate under the firm's incident process, which may involve notifying MAS.
Reading the record. Every verdict is filed in an append-only record. Operators must be able to reconstruct what an agent did, which bound decided each verdict, and who released held actions.
Security awareness for agents. General security training covers phishing. Operators also need to know how agents are attacked: instructions hidden in documents, pressure in chat, forged evidence. Facts from outside arrive as external; an external claim cannot authorise a payment.
Third-party oversight. Vendor managers must know what data reaches the model provider, where it is processed, how changes to the provider's model are communicated, and what the firm's exit plan is.
A useful frame for all of this is operator certification: a checkable statement that a person can run a live workspace.
How do you meet the guidelines and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Competent staff | Operators trained and assessed on agents before access | Assessment results; access grants |
| Board knowledge | Board briefing on agent depth, verdicts and incidents | Board training records; minutes |
| Risk assessment before go-live | AI risk assessment for each agent | Approved assessment |
| Change management | Brief, source and depth changes go through change control | Change tickets with approvals |
| Privileged access | Agent credentials scoped, reviewed and monitored | Access reviews; monitoring logs |
| Incident management | Operators trained to stop agents and escalate | Incident records; post-incident reviews |
| Security awareness | Module on agent-targeted attacks | Training records |
| Third-party risk | Assessment and monitoring of model and platform providers | Vendor assessments; contracts |
The risk assessment row is covered in what an AI risk assessment is.
What will MAS or an auditor ask?
- Who operates each agent, and how were they trained?
- Show us the change record for the last change to this agent's brief.
- Who can access the agent's credentials to core systems?
- What happened in the last agent incident, and how quickly was it stopped?
- How do you oversee your model provider?
- What does the board know about agent risk?
What do the guidelines not cover?
They do not address fairness or customer outcomes; the FEAT principles do, as covered in MAS FEAT principles and training staff who oversee AI agents. They do not replace the Personal Data Protection Act 2012. They do not prescribe specific training courses. And outside finance, IMDA's Model AI Governance Framework offers voluntary guidance. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Is changing an agent's brief really a production change?
Yes. A brief change alters what the agent does with live data. Treat it like any other production change.
Who should be able to stop an agent?
Named, trained operators, with a clear stop control and a defined process for work in flight.
Do board members need hands-on agent training?
They need enough understanding to oversee: what agents do, at what depth, how incidents are handled and what the record shows.