MAS AI Risk Management Guidelines for Credit Teams

Core definitions

Put similar concepts in the right place

Each component solves a different problem. Complete lending operations depend on clear data and workflow hand-offs.

Put similar concepts in the right place
Item	What it does in practice
01Board and senior management oversight	The board sets the appetite for AI risk and approves key policies; senior management runs AI risk management. A dedicated AI committee is not required if existing structures give one consolidated view.
02AI inventory	An accurate, current list of AI use cases, with detail in proportion to risk. A spreadsheet can be enough.
03Risk materiality assessment	Each use case is rated on impact, complexity and reliance. The rating sets how strict its controls must be.
04Lifecycle controls	Data management, fairness, transparency and explainability, human oversight, evaluation and testing, security, reproducibility, pre-deployment review, monitoring and change management.
05Third-party AI	AI bought from or embedded by vendors is in scope, including generative AI and agents: onboarding controls, notice of vendor updates, vendor transparency and contract terms.
06Timeline	Oversight framework and inventory within 12 months; full implementation within 24 months; high-risk use cases as soon as possible.

Background

What the guidelines mean for a credit team

The guidelines cover every AI use case in a financial institution. This section picks out what matters most when the use case touches a lending decision.

Why credit scoring sits at the top

MAS names credit scoring as an example of high-impact AI because it affects customers’ access to credit and what they pay for it. Fairness, transparency and explainability are expected to be applied more rigorously there, and MAS points to its 2018 FEAT principles as a reference for defining fair outcomes.

Human oversight is a design choice

The guidelines expect the level of human oversight to match the risk, and say review of every decision may be appropriate for credit decisioning. In practice that means deciding, for each AI use case in the credit process, which outputs a person must confirm, who that person is and how the confirmation is recorded.

Your vendor’s AI is your AI

AI inside a vendor’s software is in scope. Before deployment, ask the vendor where AI is used, what it can and cannot change, how outputs are checked, how you will hear about model changes and what records you can inspect. Those answers belong in your inventory and your materiality assessment.

One process across markets

Groups that lend in several markets face similar expectations elsewhere. The HKMA issued its circular on the Responsible Adoption of Artificial Intelligence on 15 October 2026, and Taiwan’s Financial Supervisory Commission issued guidelines for AI in the financial industry in June 2024. A single inventory and materiality method, mapped to each regulator, avoids running three parallel programmes.

Book an AI governance walkthrough

A working session on where AI sits in your credit workflow and how it is controlled.

Workflow

Bringing a credit AI use case under the guidelines

01
List the use case
Add it to the AI inventory with its purpose, owner, model and vendor.
02
Rate its materiality
Assess impact on customers and the institution, model complexity and how much the decision relies on it.
03
Set the human checkpoints
Decide which outputs a person must confirm before they are used, and who has authority to confirm them.
04
Test before deployment
Evaluate accuracy, fairness and explainability on your own data, and record the results.
05
Monitor in production
Track performance, overrides and drift, and re-test when the model or the data changes.
06
Keep the evidence
Retain the records that show who confirmed what, on which version, so the decision can be reconstructed.

Practical evaluation

Three practical points

Start with the inventory

The 12-month deadline covers the framework and the inventory. Most institutions find AI they did not know they had, much of it inside vendor software.

Keep the grade explainable

A grade produced by rules the credit team can read is far easier to explain and test than one produced by a model nobody can inspect.

Record the confirmation

Human oversight that leaves no record is hard to evidence. Tie each confirmation to a person, a time and a version.

Frequently asked questions

Quick answers

When did the MAS AI risk management guidelines take effect?

MAS published its response to the consultation on 7 October 2026. Institutions have 12 months to put the oversight framework and AI inventory in place and 24 months for full implementation, with high-risk use cases expected to get controls as soon as possible.

Do the guidelines apply to AI supplied by a software vendor?

Yes. AI bought from or embedded by third parties is in scope, including generative AI and AI agents.

Is credit scoring treated as high risk?

MAS uses credit scoring as an example of high-impact AI, because it affects customers’ access to credit and its price, and expects fairness, transparency and explainability to be applied more rigorously there.

How does Covenant Desk use AI in a credit file?

AI reads documents and prepares the figures, and a credit officer confirms each value before it is used. The SME scorecard is a versioned set of rules, a file that cannot be graded cannot be approved, and every action is written to an append-only, hash-chained log.

Primary sources

Official sources and editorial note

This guide reflects official material available on the review date. Requirements can change; each institution should check the latest licence conditions and obtain legal or compliance advice. This page is not legal advice. Read our editorial and corrections policy.

The MAS AI risk management guidelines, applied to credit decisions