Banks' AI Rules Converge: FSB, Singapore, India, UAE, Japan
Financial regulators from Basel to Singapore are asking banks for the same four things on AI: board accountability, a model inventory, human oversight and control of third-party AI. The paperwork differs: Singapore has a dated deadline, India still has a draft, and the UAE and Japan have guidance and a discussion paper.
Key takeaways
- On 15 October 2026 the Financial Stability Board (FSB) finalised 12 "sound practices" for responsible AI adoption in finance. It describes them as a practical toolkit, not binding rules [1][2].
- Singapore's central bank (MAS) issued AI risk-management guidelines on 7 October 2026. They take effect on 7 October 2027, with two sections due by 7 October 2028 [4][5].
- India's central bank (RBI) proposed model risk rules on 24 June 2026, including kill-switch arrangements for AI. We found no final version by 22 October [6][7].
- A Bank for International Settlements (BIS) official warned in Beijing this week that banks using similar AI models could move together in a shock [11].
What the FSB published
The FSB, which coordinates financial regulation across major economies, published its final sound practices on 15 October 2026, after a consultation in June [1][2]. Four practices cover organisation-wide governance, such as board oversight, clear roles and documenting AI use. Eight cover the AI lifecycle: risk assessment, technology choice, data governance, explainability, performance checks, human oversight, cyber risk and dependence on third-party AI [1].
The FSB calls the set a practical toolkit that firms can tailor, and says it will monitor developments and update the practices [1]. According to Forbes, guidance on agentic and multi-agent systems, where software agents take actions with limited human input, is still immature [3].
Singapore: the first dated deadline
MAS published its Guidelines on Artificial Intelligence Risk Management on 7 October 2026, after a November 2025 consultation. They apply to all financial institutions and all forms of AI [4].
Boards and senior management must oversee AI risk, but a dedicated AI committee is not required. Firms must keep an inventory of AI use, assess how material each use is, and stay accountable for third-party AI, with compensating controls where gaps exist [4]. The guidelines take effect on 7 October 2027, and the later sections must be met by 7 October 2028 [4][5]. MAS plans to consult on extra guidance for agentic AI in 2027 [4].
India: still a draft
The RBI released its draft Guidance on Regulatory Principles for Model Risk Management, 2026 for comment in late June, with feedback due by 24 July [6][7]. It would require a board-approved framework covering all models, independent validation of third-party models and human oversight of automated decisions [6]. MediaNama adds kill-switch arrangements for every AI system, and disclosure that customers are dealing with AI, with an option to reach a human [7].
The reports give no implementation date, and we found no final version as of 22 October [7].
UAE and Japan: guidance, not rules
The Central Bank of the UAE (CBUAE) issued a guidance note in February 2026 for licensed financial institutions. Its principles are governance and accountability, fair treatment, transparency, meaningful human oversight, and data protection [8]. A consultancy summary says outsourced AI should meet the same standards as internal models [9]. We found no compliance deadline in the sources we read, and sources differ on the exact February date.
Japan's Financial Services Agency published version 1.1 of its AI Discussion Paper on 3 March 2026, updating a March 2025 edition with findings from a public-private forum held from June to December 2025. The agency calls it a preliminary overview of current use and challenges, meant to guide future policy [10].
Where each regime stands
| Jurisdiction | Instrument | Status on 22 Oct 2026 | Date |
|---|---|---|---|
| International (FSB) | 12 sound practices | Final, non-binding toolkit | 15 Oct 2026 |
| Singapore (MAS) | AI Risk Management Guidelines | Final; effective 7 Oct 2027, full by 7 Oct 2028 | 7 Oct 2026 |
| India (RBI) | Model risk management guidance | Draft; comments closed 24 July | 24 Jun 2026 |
| UAE (CBUAE) | Guidance note on responsible AI and machine learning | Guidance; no deadline found | Feb 2026 |
| Japan (FSA) | AI Discussion Paper v1.1 | Discussion paper, not rules | 3 Mar 2026 |
Why it matters
Older bank models mostly ran on fixed inputs that could be validated once. Generative and agentic systems can change behaviour with a new prompt, new data or a vendor update, so regulators lean on inventories, risk tiers and the ability to switch a system off. This is our explanation of why the same controls keep appearing.
Dependence on outside providers is the other shared theme: the FSB, MAS and RBI all address it [1][4][7]. If many banks rely on the same few model or cloud suppliers, one outage can hit several firms at once, and a contract does not move the accountability.
The BIS adds a system-wide view. Tao Zhang, its Chief Representative for Asia and the Pacific, told the Financial Street Forum in Beijing that firms using similar models, data or decision rules may act together, which can amplify price moves, and that authorities should test a sharp repricing of AI assets or a disruption at a key provider [11]. He cited BIS analysis of growing debt, including private credit, and circular financing within the AI ecosystem, and said the views were his own [11]. For market context see our 19 October article.
Strengths and limits
Strengths: the regimes agree on a common core, which helps banks that operate in several countries. Most also scale controls to risk, so a low-stakes tool need not carry heavy paperwork [1][4].
Limits: most instruments are guidance or drafts, so supervisors will test them case by case. Agentic AI is the acknowledged gap, and timelines range from none to 2028 [3][4][7].
The global picture
International (Basel): the FSB and BIS. Southeast Asia: Singapore. India: RBI draft. Gulf: UAE guidance note. Japan: FSA discussion paper. China: the BIS speech was delivered in Beijing; we found no new Chinese regulator rule today. United States, Australia, Russia: not covered here. For another regulator-led sector story, see our healthcare pulse.
What to watch next
- India: whether the RBI finalises its draft; no date has been announced [7].
- Singapore: the 2027 MAS consultation on agentic AI, and the 7 October 2027 start date [4].
- FSB: updates to the practices as agentic systems mature [1].
- UAE: whether the CBUAE attaches a deadline to its guidance [8].
Our take
Our analysis: the useful signal is the overlap. A bank that keeps an AI inventory, ranks uses by materiality, names a human owner, and knows which outside providers it depends on will meet most of what these regulators ask. The open question is enforcement, since only Singapore has a dated deadline among the five regimes we reviewed.
FAQ
Are the FSB's AI practices law? No. The FSB describes them as a practical toolkit that firms can tailor [1].
Does Singapore require a board AI committee? No. Existing governance structures can be used [4].
Has India finalised its AI rules for banks? Not that we found. The RBI text of June 2026 is a draft [6][7].
Sources
- FSB finalises sound practices for the responsible adoption of AI, Financial Stability Board, 15 October 2026. Tier 1.
- FSB puts boards on the hook for AI risk in finance, FinTech Global, 16 October 2026.
- Trust, but verify: how regulators want banks to use AI, Forbes, 15 October 2026. Single source for the agentic AI remark.
- MAS sets out supervisory expectations on responsible AI adoption by financial institutions, The Asian Banker (MAS media release), 7 October 2026. The MAS page itself could not be opened in our run.
- Singapore sets AI risk rules for financial sector from 2027, Malay Mail, 8 October 2026.
- RBI proposes guidelines for banks to manage AI risks, Reuters via The Star, 24 June 2026.
- RBI draft rules push kill switches, human oversight for bank AI models, MediaNama, 25 June 2026.
- CBUAE issues guidance note to protect consumers and ensure responsible use of AI in the financial sector, Central Bank of the UAE, February 2026. Tier 1.
- CBUAE issues new AI and ML guidance for financial institutions, Plenitude Consulting, June 2026. Consultancy commentary.
- Publication of AI Discussion Paper (Version 1.1), Japan Financial Services Agency, 3 March 2026. Tier 1.
- Artificial intelligence, monetary policy and financial stability, Tao Zhang, BIS, speech at the Financial Street Forum 2026, Beijing, 21 October 2026 (BIS date field; text says prepared for 20 October). Tier 1; the speaker's own views.
AI Worldwire is independent and has no commercial relationship with the companies covered, unless stated. Research and drafting are assisted by AI; every article is reviewed and approved by a human editor before publication. Subscribe to the AI Worldwire newsletter. Last updated: 22 October 2026.