Financial services and insurance
Agent pilots in Singapore's banks and insurers work in the demo and stall in risk review. We build the gateway, the audit trail and the review pack that answer MAS's expectations and get them into production.
A bank or an insurer does not need AI that moves faster than its examiner. It needs AI its examiner can read, and then it needs it quickly.
Where you are
Claims triage, onboarding, servicing, fraud review: somewhere in your organization an assistant already does a job that used to take a person. The platform underneath is settled.
AI risk management
MAS issued its Guidelines on Artificial Intelligence Risk Management on 7 October 2026. They ask for board oversight, an inventory of AI use, a materiality assessment for each use and controls across the life cycle, with the first sections applying from 7 October 2027.
What waiting costs: an inventory assembled in a hurry next year from pilots nobody documented.
Third parties
The new guidelines, the Technology Risk Management Guidelines and the Guidelines on Outsourcing (Banks) all hold the institution responsible for services it does not run itself, including AI supplied by a vendor.
What waiting costs: a provider's model change becomes your incident, and your conversation with MAS.
Agents
MAS has said it will consult the industry on agentic AI in 2027. IMDA's Model AI Governance Framework for Agentic AI already asks for bounded autonomy, human checkpoints and technical controls across the agent's life.
What waiting costs: agents built now without checkpoints, rebuilt when the guidance lands.
| Regulator or law | What it asks | What it means for an agent |
|---|---|---|
| MAS Guidelines on Artificial Intelligence (AI) Risk Management, issued 7 October 2026, phased in from 7 October 2027 to 7 October 2028 | Oversight by the board and senior management, an inventory of AI use, a materiality assessment for each use, controls proportionate to it, and accountability for AI from third parties | Every agent sits in the inventory with an owner and a rating, its controls match the rating, and a vendor's model is governed like any vendor. |
| MAS Technology Risk Management Guidelines | Technology risk governance, access control, resilience and incident management | The agent's access is controlled and logged like a privileged user's, and its failure modes are in the incident plan. |
| MAS FEAT principles, with the Veritas assessment methodology | Fairness, ethics, accountability and transparency where AI and data analytics drive decisions | Decisions that affect customers can be explained and tested for fairness. |
| MAS Guidelines on Outsourcing (Banks) and MAS Notice 658 | Due diligence, oversight and contractual rights over services run by others | Cloud and AI providers in the agent's path sit inside your outsourcing oversight, with audit and exit rights. |
| Personal Data Protection Act, with the PDPC's advisory guidelines on personal data in AI recommendation and decision systems | A lawful basis and purpose for personal data, protection, accountability and breach notification | The agent reads only the personal data its purpose allows, and the record shows which. |
| IMDA Model AI Governance Framework for Agentic AI (January 2026) and AI Verify | Voluntary guidance: bound an agent's autonomy and access, set human checkpoints, apply technical controls, tell users | Permissions are scoped at the gateway, and actions above a set threshold wait for a person. |
What is in the way
The distance between a pilot and a system your risk, audit and operations teams will accept is made of gateways, audit trails, data access and ownership. The review asks questions a pilot was never built to answer.
If your examiner asked for one decision, its log and its owner by Friday, what would you hand them?
The examiner asks for one decision
Without
Six places to search. No single answer.
With
One record. Every field present.
How we clear it
The institutions that get one governed agent into live use learn from real work while others rewrite a pilot for review.
We put Apigee in front of your estate and design the policies, quotas and logging first.
You hold: a governed API layer with an inventory, an owner for every endpoint and policy your examiner can read.
Apigee and APIsWe build agents on Gemini Enterprise and the Agent Development Kit that work inside the controls your risk team has already set.
You hold: one agent in production, in claims, onboarding or servicing, with review gates built in and a decision log that rebuilds any action.
Gemini Enterprise and agentsWe write the pack model risk and internal audit will ask for: control descriptions, test results, ownership and a sample decision log.
You hold: a review pack you can hand over without a rewrite.
Security and responsible AIEasy to start
Choose one workflow, name one owner, and give us time with the people who sign it off.
We bring engineers and the gateway design, we work inside your environment under your security rules, and we write the review pack alongside the build.
A good first workflow for a bank is onboarding checks or a servicing assistant. For an insurer it is first notice of loss or claims triage. See the fixed-price ways to start.
What the work feels like
One workflow is chosen and one person owns it. The questions your reviewers will ask are written down before any build starts. Your second line sees the controls in the first week, not at the end.
Governance goes in before the first agent does: the gateway, the audit trail and the access rules. Your risk team sees them working.
A working demo you can show your own review board, not a status slide.
A decision log that can rebuild any action, and a go-live date that was agreed at the start.
Seen it before
Production readiness check
A short readiness check on a live or planned agent workflow. You get a score and the principles worth another look.
Take the readiness checkOur delivery is built on Google Cloud, so the design assumes Apigee, Gemini Enterprise, Vertex AI and BigQuery. If your estate runs another gateway today, we begin with an assessment of what to keep and what to move.
In your environment, under your keys and perimeter. Agents read governed data in place instead of copies of it.
Yes. We ask for them in the first week and write the review pack with them.
The ones in your market. The table above lists the main ones, and we confirm the local rulebook at the start.
One workflow, one owner, a short assessment, then a build with a working demo every week.
They were issued on 7 October 2026, take effect on 7 October 2027, and phase in some sections by 7 October 2028. They ask for board oversight, an inventory of AI use, a materiality assessment for each use and proportionate controls, including over AI supplied by third parties. We build the inventory entry and its evidence as part of the first workflow, not as a separate project.
Yes, where your policies require it. Google Cloud runs a region in Singapore, and we design the gateway, agents and logs to keep data and processing in the locations your outsourcing and data policies allow, confirming the service list at the start.
Tell us what you are working on. Our Customer Partnership Team will reply to arrange a conversation.
Get answers to your questions
AI assistant. It can make mistakes, so check anything important with our team.
