MAS puts agentic AI testing under scrutiny

Singapore’s financial regulator has confirmed that its forthcoming artificial intelligence risk-management guidelines will cover agentic AI, raising the assurance burden for banks deploying autonomous systems across payments, treasury, wealth management and other critical workflows.

The clarification from the Monetary Authority of Singapore means financial institutions will be expected to apply board oversight, lifecycle controls and risk-management processes to AI agents as well as more conventional models.

For QA, software testing and quality engineering teams, the significance lies less in AI adoption itself than in what banks will have to demonstrate before autonomous systems can be trusted in production.

Agentic AI can pursue multi-stage objectives, interact with applications and initiate actions without human approval at every step. Testing such systems therefore cannot stop at evaluating model accuracy or checking individual responses.

Evidence

Banks will need evidence that agents respect their assigned mandates, that transactions are validated before execution, that unexpected behaviour triggers escalation and that every decision remains auditable.

In a written parliamentary reply on August 5, MAS chairman Gan Kim Yong said the regulator would maintain a principles-based approach because AI technology and its associated risks are evolving rapidly.

Crucially, he confirmed that MAS’ proposed Guidelines on Artificial Intelligence Risk Management will apply to all AI uses by financial institutions, including agentic AI.

The guidelines, first issued for consultation in November 2025, will establish supervisory expectations covering oversight, risk-management systems and controls throughout the AI lifecycle. MAS said it is reviewing feedback and expects to finalise them soon.

That puts AI testing and operational assurance firmly within the regulatory conversation. Financial institutions will be responsible for deciding how to satisfy the principles, but they will also need to produce credible evidence that their chosen controls work.

Production assurance

The parliamentary response is the latest stage in MAS’ shift from high-level AI governance towards testing, validation and operational control.

In April, the regulator released its MindForge AI Risk Management Toolkit, developed with 24 financial institutions and industry participants, including HSBC, Citi, UBS, BlackRock, DBS, Standard Chartered, UOB and Prudential.

The toolkit is structured around scope and oversight, AI risk management, lifecycle management and the organisational capabilities needed to support responsible deployment.

MAS described the initiative as supporting the “responsible adoption of AI in finance”, while Alan Lim, director in its Financial Infrastructure and AI Office, said it was intended to help institutions move “from theory to practice”.

That distinction is important for software assurance teams. An AI policy can describe who should be accountable and what risks should be avoided.

Marko Milek

Operational assurance must demonstrate that inventories are complete, risk classifications are applied consistently, validation gates cannot be bypassed and monitoring identifies changes in system behaviour after deployment.

BlackRock’s Marko Milek said MindForge helps translate “responsible AI principles into actionable risk management”.

DBS chief analytics officer Sameer Gupta made a similar point, arguing that “to fully realise AI’s value, governance must be treated as a strategic imperative”.

For banks, operationalising those principles will require controls that can be tested repeatedly across the AI lifecycle. That includes pre-deployment validation, data-quality testing, model and prompt change management, post-deployment monitoring, incident handling and controls governing the retirement or replacement of AI systems.

It also makes traceability increasingly important. Institutions will need to know where AI is operating, which data and third-party components it depends on, what decisions it can influence and which tests or approvals were completed before deployment.

Runtime testing

The demands become more complex when an AI system is permitted to take action rather than merely produce a recommendation.

MAS addressed that problem directly in July through its Safeguards for Agentic Finance at Runtime framework, known as SAFR.

Developed under the regulator’s BuildFin.ai initiative with Ant International, Circle, HSBC, J.P. Morgan Chase, Manulife, Mastercard, OCBC and Visa, SAFR concentrates on governance at the moment an agent proposes an action.

MAS warned: “As AI agents in financial services increasingly carry out tasks autonomously and at speed beyond practical human intervention, financial institutions need real-time safeguards to ensure that the behaviour of AI agents remain within predefined mandates, policies and risk boundaries set by financial institutions.”

The framework provides “a set of governance checkpoints that verifies and records an AI agent’s proposed actions before the execution of its tasks”.

MAS HQ in Singapore

That represents an important change in the location and timing of assurance. Conventional model validation is typically concentrated before deployment, while audit reviews activity after it has occurred.

An autonomous agent may initiate a payment, interact with a customer account or move through several connected applications before either process can intervene.

SAFR moves part of the control environment into runtime. MAS said it is intended to embed “policy bound execution, real time validation, auditability and interoperability” into agentic operations.

For QA teams, these properties create a substantial new testing perimeter.

Policy-bound execution will require negative testing to prove that an agent cannot move beyond its authorised purpose, access prohibited systems or exceed transactional limits.

Real-time validation will need to be tested for accuracy, latency and availability, including what happens when a validating service is unavailable or returns an ambiguous result.

Auditability requires assurance that the full decision trail is captured accurately and cannot be altered. Interoperability testing must examine what happens when agents exchange information, delegate work or interact with legacy applications and external services.

Testing individual agents in isolation will not be enough. A compliant component can still produce an unsafe outcome when combined with another agent, application or workflow. Banks will therefore need end-to-end scenarios that test interactions, dependencies and cumulative behaviour across complete business processes.

MAS said the Future of Finance Institute will support SAFR through “industry pilots and sandbox experimentation”, helping institutions “to test and deploy SAFR-aligned solutions”.

Although SAFR is an industry-developed reference framework rather than a regulatory rule, the parliamentary response now confirms that the wider AI risk-management expectations will encompass the systems it was designed to address.

Payments and wealth management raise the stakes

The use cases identified by MAS show why agentic assurance is becoming a digital-resilience issue.

The regulator envisages “agent-assisted payments and treasury operations, where autonomous agents can execute routine transactions within predefined mandates, improving efficiency and reducing operational frictions.”

It also points to “wealth management and advisory workflows, where AI agents review documents and generate structured assessments within narrowly scoped task boundaries, supporting faster and more consistent compliance review.”

In these environments, an output error can quickly become an operational event. An agent could initiate an incorrect transaction, apply the wrong mandate, use stale information or trigger a sequence of actions across interconnected systems.

Singapore’s CBD, Asia’s biggest financial hub

Quality engineering teams will consequently need to test more than whether the agent completes its intended task. They will need to examine whether transaction limits are enforced, duplicate actions are prevented, permissions expire correctly and high-risk cases are routed to human reviewers.

Testing will also have to cover failure and recovery behaviour. If an agent stops partway through a multi-stage process, banks must know which actions have already been completed, whether they can be reversed and how processing can resume safely without duplication or loss.

That places agentic AI squarely within banks’ wider operational-resilience programmes.

MAS links testing failures to disruption

The agentic AI clarification comes as MAS is also proposing stronger technology risk-management requirements covering the broader banking technology estate.

Its consultation on amendments to the Technology Risk Management Notices explicitly connects major IT incidents with weaknesses in change management and software testing.

“MAS has noted that a significant number of IT incidents in [financial institutions] were attributed to poor change management,” the regulator said.

It added that “the lapses observed include insufficient risk and impact assessment of changes, poor understanding of system dependencies, inadequate testing of changes, and the absence of effective change recovery plans.”

“Financial institutions must carry out testing for all changes to critical systems.”

– MAS

The parallel with agentic AI is clear. In both areas, the regulator is focusing on how technology behaves once integrated into complex, interconnected operating environments.

For AI agents, a change may involve a model update, an altered prompt, a revised mandate, a new API or a different orchestration component. Each could affect the way the agent behaves across an entire workflow.

Banks will need to treat those changes with the same discipline applied to critical conventional systems: dependency analysis, impact assessment, regression testing, controlled deployment and effective recovery measures.

MAS has also stressed the importance of continuous monitoring after observing that major incidents were associated with “lack of monitoring, delayed detection and/or slow response to rectify the causes of the incidents.”

Agentic systems make that requirement more urgent. Their behaviour may vary according to context, input data and interaction history, making pre-release testing necessary but insufficient.

Continuous evaluation, production telemetry and tested intervention mechanisms will be required to detect when behaviour begins moving outside expected boundaries.

Live test case

MAS’ multi-bank scam-detection project offers another example of its emphasis on evidence-based AI assurance.

The proof-of-value brings together data from five banks to explore whether AI and machine learning can identify higher-risk transactions and accounts earlier.

“Prompt identification could enable timely assessment, intervention and reduction of customer losses to scams,” MAS said.

For testing teams, the project demonstrates how the assurance perimeter expands when AI depends on shared data and cross-institutional infrastructure.

Validation must cover data consistency, feature alignment, model performance across different customer populations and the stability of detection thresholds. It must also examine false positives and false negatives, privacy controls, access restrictions and the operational workflows through which alerts are assessed.

The central question is no longer simply whether a model achieves an acceptable accuracy score. It is whether the complete data, model and control environment performs safely and consistently under realistic conditions.

That same principle applies to agentic AI. A bank cannot validate an agent by testing its model alone when its real behaviour depends on external tools, permissions, APIs, databases and other agents.

Growing role for QA

MAS’ direction of travel gives QA and software testing functions a much larger role in AI governance.

Risk and compliance teams may define policies, materiality frameworks and accountability structures, but testing teams will increasingly generate the operational evidence showing whether those structures work.

That evidence will include boundary-test results, traceable approval records, monitoring metrics, audit logs, recovery exercises and proof that escalation mechanisms function under pressure.

It will also require closer integration between model validation, traditional software testing, cybersecurity, data governance and operational-resilience teams. Agentic systems cross those disciplines too easily to be assured through isolated reviews.

The regulatory message emerging from MindForge, SAFR, the scam-detection project and the proposed Technology Risk Management amendments is consistent.

Financial institutions must understand their technology dependencies, validate changes before production, monitor critical systems continuously and demonstrate that controls continue to work under actual operating conditions.

By confirming that agentic AI falls within its forthcoming supervisory guidelines, MAS has extended that approach to autonomous systems.

For banks, the challenge is no longer merely to prove that an AI agent can complete a task. It is to prove that the agent remains within its mandate, interacts safely with the wider technology estate, fails predictably and leaves sufficient evidence for every material action to be reconstructed.

Finally, the real significance of the announcement is that agentic AI is turning AI governance into an engineering and digital-resilience requirement, with testing moving from the edge of the regulatory framework to its operational core.