On 7 October the Monetary Authority of Singapore issued its Guidelines on Artificial Intelligence Risk Management, phased in over 2027 and 2028. On 3 November it announced that the Future of Finance Institute has started work, with a pillar called SafeFin.ai that will extend the MindForge toolkit to AI use-case risk assessments, testing and assurance, and third-party AI. Two announcements in four weeks, and both name the same thing: the AI an institution buys, not only the AI it builds.
That phrase decides how many fintechs will meet Singapore’s regulator for the first time. Not across a licensing desk, but through the compliance team of their first customer.
The first regulator you meet may be a bank
Foreign founders arrive in Singapore with a question prepared: which licence do we need. The answer depends on what the company does and what it plans to do. A firm that holds customer money, moves payments, advises on investments, lends, or deals in digital tokens will usually need a licence or an exemption from the Monetary Authority of Singapore, and should plan for it from the first day.
A firm that sells software, data, identity checks or AI models to banks, insurers, payment firms and fund managers usually does not, at least until its product starts touching customer money or customer decisions directly, at which point the question returns. Many companies cross that line as they grow, so the plan matters as much as today’s product.
For the second group, and for the first group in the months before its licence is granted, the earliest regulatory test is not run by the regulator. It is run by the customer. The institution holds the licence, and it has to prove to the Monetary Authority of Singapore that it controls the risk a new partner brings into its business.
That proof is assembled before the contract is signed. I spent several years assembling it, leading third-party risk for a global bank across Singapore, Australia and New Zealand, and I now run a company, SAMR Technologies, that helps vendors prepare for it. The regulator never saw the vendor. It saw my file on the vendor. If the file was thin, the answer was no, however good the product was.
Four rulebooks behind every questionnaire
The questions a Singapore institution sends a new partner look arbitrary from the outside. They are not. Almost all of them trace back to four sets of rules from the Monetary Authority of Singapore that bind the institution, rewritten in the second person.
Outsourcing and third-party risk. The guidelines on outsourcing make the institution assess whether a service is material, where the data sits, who the sub-contractors are, whether it can audit the provider, and how it would exit. Every one of those becomes a question to you, and your answer informs the institution’s assessment and, where the service counts as outsourcing, its outsourcing register. A consultation on third-party risk ran this year, and it reaches services whether or not they count as outsourcing; expect the questions to get more specific, not fewer.
Also Read: Why Indonesian fintech’s ASEAN expansion cost more than anyone priced in
Technology risk. The Technology Risk Management guidelines and the notice that sits under them cover secure development, access control, penetration testing, change management, incident reporting on a defined clock, and recovery objectives for anything the institution depends on. If your product sits in a customer-facing flow, you are inside that scope.
Cyber hygiene. The cyber hygiene notices set a short list of baseline controls: administrative accounts, patching, security standards, network perimeter, malware protection, multi-factor authentication. They bind the institution; they reach you through the contract.
AI risk management. New this year. Institutions will keep an inventory of the AI they use, including AI bought from vendors, with accountability that stays with the institution. Once the institution uses your model, it is in that inventory, and the Future of Finance Institute’s work on third-party AI will add detail, not remove it.
Why the first due diligence takes months
From the bank’s chair the picture is consistent. A first-time vendor arrives with a demo and no evidence. The questionnaire goes out in the bank’s own format. Weeks pass while the founder finds policies that exist in someone’s head, discovers which cloud region actually holds the data, and asks the model provider for test results it never requested. Each answer opens two clarifications. The risk rating waits on the answers, the contract waits on the rating, and the institution’s committee that approves material outsourcing waits on the contract.
The delay is made on both sides. Vendors arrive without knowing what will be asked and without one person who owns the answers. Institutions ask for the same things in different ways: each has its own template, built from the same four rulebooks, similar on the merits, different in format and in the detail it demands, and nobody on the receiving side coordinates with the institution next door. The second bank starts again from the first question, and the vendor rewrites the same evidence into a new shape. The delay is rarely the individual reviewer. It is duplication without a shared source of truth.
Readiness before the questionnaire
The remedy is unglamorous. Assess yourself against the four rulebooks before anyone asks, and bring the result to the first meeting as a short readiness report: how far your third-party risk and procurement evidence already meets what a Singapore institution will require, and where the gaps are. The report rests on a small set of facts. A data map: which customer data you touch, where it is stored and processed, by country and provider.
A sub-contractor list with the country and contract date for each. Security evidence: the date and scope of the last penetration test, the access-control policy, an incident process with a named contact. If you have a model: which ones, whose, what they decide, how a human overrides them, and what testing you can show. Continuity and exit: recovery objectives in hours and how the customer gets its data back. One accountable name and a date at the top.
Also Read: Fintech, DeFi and applied AI define Southeast Asia’s new venture discipline
Prepared once and mapped to the rules rather than to one institution’s template, that report answers the reviewer’s first questions before they are asked and survives the move to the next institution with its different format. It is readiness before certification, and it shortens vendor onboarding from the vendor’s side, which is the only side the vendor controls. Whether a firm produces it with a spreadsheet or a platform matters less than producing it before the first meeting.
Why Singapore works like this
My doctoral research on how regulation and the fintech sector shape each other in Singapore, published with Springer Nature this year, describes a corridor. Above it sits a ceiling of scale: the size at which a firm would reshape the market itself rather than operate inside it, a size very few firms of any kind reach. Below it sits a regulatory floor: the minimum level of control and evidence at which a firm can be taken on by a licensed customer at all.
Between them the state actively coordinates innovation, through licences, sandboxes, grants that pay the buyer to adopt, and the Singapore Fintech Festival that fills this city every November. The founders I interviewed assumed the floor was the regulator. For most vendors it is not. It is the set of controls a licensed customer must evidence before it can sign. Clear that floor and the rest of the system starts working for you.
This month
On 16 November I open the Polish Fintech Mission’s programme with a workshop on exactly this for 11 founders, and on 19 November the Demo Day brings them in front of Singapore’s investors and institutions.
If you are one of the many foreign fintechs meeting a Singapore bank for the first time during the Singapore Fintech Festival, arrive with a professional third-party risk assessment already done. Bring a readiness report that answers what sits inside the bank’s procurement and third-party risk process, instead of questions about it. That is what shortens procurement.
—
Editor’s note: e27 aims to foster thought leadership by publishing views from the community. You can also share your perspective by submitting an article, video, podcast, or infographic.
The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of e27.
Join us on WhatsApp, Instagram, Facebook, X, and LinkedIn to stay connected.
The post Before the licence: What Singapore’s regulated institutions ask a fintech partner first appeared first on e27.