MAS TRM

Singapore supervises technology risk in a financial institution with detailed expectations and a cyber hygiene notice. An AI service there must sit inside the same framework as a core banking system. This starter maps the traffic portion of that framework and supplies evidence inputs.

Proposed guidance for artificial intelligence risk raises the expectation further. A reviewer will ask who approved a model use, what data it saw, and who watched the output. Those three questions land on three stages of this chain.

Requests pass injection screening and an identity check that needs verified user and organization claims. Taxpayer identification numbers are masked. Prompts that name an account export, wire details, an access token or a private key are blocked.

Answers must clear a combined floor of 0.86, with relevance at 0.78 and accuracy at 0.80. The same gate rejects an answer shorter than 120 characters or built from one sentence. Source checking records a flag and does not block until you say so.

A named human owns every risk decision here, in the literal sense that no answer is released without one. The review stage escalates each response and returns no content, so control changes and reports are never the only cases waiting. The final stage records that an evaluation happened and blocks nothing.

Continuity testing, outsourcing assessments and hygiene measures such as strong authentication rollout stay outside the gateway. Data management duties also remain yours. Choose the Digital Operational Resilience Act starter when a European Union financial obligation drives the program.