WARRANTThe four principles in one paragraph.
The publication is short. The headline document presents fourteen numbered sub-principles, grouped under four headings, set against a one-page introduction. There is no Annex of definitions, no enforcement schedule, no penalty regime. There is the four-letter acronym. There is the addressee — financial institutions in Singapore using AI and data analytics. There is the verb the principles use throughout: should consider.
That verb is the load-bearing one. FEAT is not a Notice under section 55 of the Monetary Authority of Singapore Act. It is not a Guideline under section 27D. It is a set of generally accepted principles, addressed at the firm's internal governance framework. The MAS expectation, as set out by the PwC commentary published one month later, is that firms calibrate actions and requirements under their internal governance framework based on the materiality of the AIDA-driven decisions.
The four principle headings, in MAS order, with the count of sub-principles under each:
Fairness · sub-principles 1 to 4.
MAS organises the four Fairness sub-principles into two pairs. The first pair, Justifiability, addresses whether a decision can be defended after the fact. The second pair, Accuracy and Bias, addresses whether the system that produced the decision was sound at the time it produced it. The pairing matters. A decision that was sound when made can become unjustified six months later if the model has drifted or the population has shifted.
The drafting choice in sub-principle 1 — unless these decisions can be justified — is the operative escape valve. Differentiation between client segments is not, in itself, prohibited. What is prohibited is unjustified systematic disadvantage. The firm's burden is the justification, recorded contemporaneously.
Ethics · sub-principles 5 to 6.
The Ethics principle is two sub-principles long. It is the shortest of the four sections in the FEAT publication. The drafting takes a deliberate position: in the absence of a globally recognised ethics framework for AI, MAS pegs AI ethics to the firm's own existing ethics architecture.
Sub-principle 6 is the more enforceable of the two. It produces a concrete test the supervisor can apply: take an AIDA-driven decision the firm has made; ask whether a human, making the same decision under the same circumstances, would face disciplinary action under the firm's existing code; if yes, the AIDA-driven decision is also out of bounds. The asymmetry MAS is closing is the one where firms quietly let AI do what they would not let employees do.
Accountability · sub-principles 7 to 11.
Accountability is the longest of the four sections by sub-principle count. MAS splits it into two halves. The first half, Internal Accountability (sub-principles 7 to 9), addresses how the firm holds itself responsible inside its own governance perimeter. The second half, External Accountability (sub-principles 10 to 11), addresses how the firm holds itself responsible to data subjects affected by its AIDA-driven decisions.
One drafting note worth flagging at the top. MAS uses the heading Accountability, not Accountability and Auditability. Some downstream commentary conflates the two. Auditability is addressed in the December 2024 AIRM paper, in Section 6.1 on standards and processes for development. The 2018 FEAT publication keeps Accountability as the standalone heading.
Sub-principle 8 is where the Singapore SaaS angle starts to bite. A Singapore-licensed bank using a foundation model from a US vendor is accountable for that model's behaviour to the same standard as if the bank had trained the model in-house. The vendor contract is a private-law artefact between two parties; the supervisory accountability runs from the bank to MAS, regardless.
Transparency · sub-principles 12 to 14.
Transparency is the shortest of the four sections by word count, but the most procedurally demanding. MAS asks for three layers of disclosure: a proactive baseline disclosure to all data subjects, an on-request explanation of the data used, and an on-request explanation of the consequences. The third is the one most firms underbuild.
The PwC commentary of December 2018 noted that data subjects have similar transparency rights under EU GDPR Article 13 and Article 22. The overlap is not accidental. MAS Transparency sub-principles 13 and 14 read like a financial-sector specialisation of the GDPR right to explanation. A firm that has built its GDPR Article 13 disclosure stack already has most of FEAT 12 to 14 in place. The work is in the financial-sector specifics — the consequences disclosure under sub-principle 14, particularly.
The Veritas consortium.
The 2018 FEAT principles defined the language. The Veritas Initiative, launched by MAS in November 2019, set out to operationalise it. The structure is an MAS-led industry consortium of, at peak, thirty-one industry players. Accenture and Bank of China were named as lead developers of the open-source Toolkit. Pilot testing was carried out by BNY Mellon, DBS Bank, OCBC Bank, and United Overseas Bank.
The Toolkit ships in two versions, both under the Apache License 2.0. Version 1.0 was released in February 2022 and covered fairness assessment only. Version 2.0 was released on 26 June 2023 and added assessment methodologies for ethics, accountability, and transparency. The toolkit is hosted on GitHub at github.com/mas-veritas2/veritastool.
What the Toolkit produces, mechanically, is per-use-case assessment notebooks — credit scoring, customer marketing, insurance underwriting — each walking an FI through the FEAT methodology and surfacing the artefacts the firm would otherwise assemble by hand. Adopting Veritas does not, in itself, satisfy FEAT. The Toolkit is an aid, not a certification. But the artefacts it produces are the closest thing to a standard format MAS has put forward.
A successor effort, Project MindForge, was established under the Veritas Initiative to address Generative AI. The first phase released a GenAI risk framework in November 2023, supported by a consortium of banks. The AIRM paper of December 2024 references both Veritas and MindForge as the operative industry-consortium efforts.
The AIRM Information Paper.
The exact title is Artificial Intelligence Model Risk Management — Observations from a Thematic Review. It is dated December 2024 in the document header, and was published as an Information Paper, not a Consultation Paper. The thematic review on which it draws was conducted by MAS on selected banks in mid-2024. Section 1.2 then extends the relevance: the good practices highlighted should generally apply to other FIs, which should take reference from these when developing and deploying AI.
The structure is three thematic focus areas, each occupying its own section, with two cross-cutting Other Key Areas appended:
Section 6.1 is the section that introduces auditability as a development standard. The paper enumerates: data management, robustness and stability, explainability and fairness, reproducibility and auditability. Reproducibility and auditability are paired, deliberately. A model whose runs cannot be reproduced cannot be audited; a model that cannot be audited cannot be defended in front of an examination team. This is the section where Warrant's per-action evidence package maps cleanly onto MAS supervisory expectations.
Section 6.4 — Validation — distinguishes between independent validation and peer review, applied based on risk materiality. Section 6.5 — Deployment, Monitoring and Change Management — sets out pre-deployment checks and post-deployment monitoring; model updates must follow the same standards as initial deployment. A retraining cycle is not a free pass.
Section 7.1 on Generative AI flags the risk amplifications: hallucinations, opaque training-data provenance, evaluation difficulties for output bias. The paper asks FIs to extend the AIRM controls to GenAI rather than treating it as a separate regime. Section 7.2 on Third-Party AI carries the same logic — the FI's accountability does not transfer to the vendor, regardless of contract.
The supervisory expectation tier.
Neither FEAT nor AIRM carries a standalone penalty regime for AI-specific failures. MAS does not, as of May 2026, have an AI-specific Notice analogous to the EU AI Act's Article 99 fine ceilings. What it has is a supervisory expectation set, enforceable through the existing examination architecture.
Three transmission mechanisms are operative. First, FEAT and AIRM expectations are read into existing risk-governance examinations. A bank's AI use is a topic an examination team can ask about, against the published principles. Second, the existing MAS Notices on outsourcing risk management, technology risk management, and individual accountability and conduct continue to apply; AIRM Section 7.2 on Third-Party AI explicitly threads through the outsourcing risk management framework. Third, MAS retains the general supervisory tools — directions, examination findings, conditions on licence — that apply to any regulated activity.
The practical posture is that an MAS-regulated FI cannot point to FEAT and say it does not bind. It binds through the supervisory channel. An examination outcome letter that flags weakness in the firm's AIDA governance, calibrated against FEAT and AIRM, is a finding the firm must remediate.
Where Warrant maps FEAT and AIRM.
Cross-reference · HKMA, BNM, BoT.
The MAS AIRM paper itself, in footnote 21 to Section 4.4, names two peer-jurisdiction publications operating in adjacent space. The Hong Kong Monetary Authority issued guiding principles for the use of big data analytics and AI in 2019, covering governance and accountability, fairness, transparency and disclosure, and data privacy and protection. De Nederlandsche Bank — outside APAC, but cited by MAS in the same footnote — issued the SAFEST principles in 2019: Soundness, Accountability, Fairness, Ethics, Skills, Transparency. The acronym overlap with FEAT is deliberate.
Closer to home, the picture is patchier. Bank Negara Malaysia has not, as of May 2026, published a counterpart to FEAT, though its Risk Management in Technology policy and its 2024 discussion paper on AI in financial services touch the same themes. The Bank of Thailand issued AI-related guidance in 2024 framed as ethics and risk management expectations for FIs, but without the Singapore-style consortium-toolkit pairing. Reserve Bank of India sits in a different lineage — the FREE-AI committee report of 2025 addresses India's regulatory architecture rather than borrowing the FEAT acronym. The practical observation is that a Singapore-headquartered FI working backwards from FEAT and AIRM will generally be over-compliant with the rest of APAC; Singapore is the regional reference floor.
The Singapore-headquartered SaaS angle.
A practical observation, addressed to the AI-vendor side of the trade. A meaningful share of AI infrastructure SaaS — model-routing, observability, evaluation, agent platforms — is incorporated in or operationally routed through Singapore. The reasons are well known: tax, talent, capital-control regime, regional headquarters logic. The consequence is less well known. FEAT and AIRM increasingly function as procurement-gate requirements for these vendors.
The mechanism is AIRM Section 7.2 on Third-Party AI, read together with FEAT sub-principle 8 on accountability for externally sourced AIDA models. An MAS-regulated FI evaluating an AI vendor must satisfy itself that the vendor's product can be operated within the FI's FEAT and AIRM controls. The vendor that cannot show how its product enables the FI's reproducibility, auditability, and per-decision explainability obligations is the vendor that loses the procurement.
The shift over the last eighteen months is from does the vendor have a SOC 2 report to does the vendor's product produce evidence the FI's MAS examination team can read. A SOC 2 report covers the vendor's own controls. A per-action evidence package, addressable by deployment and model version and independently verifiable without contacting Warrant, covers the FI's controls — which is what AIRM Section 6.5 actually asks for. The EU AI Act's Article 12 logging obligation and the AIRM Section 6.1 reproducibility-and-auditability standard are not in conflict; an evidence architecture that satisfies one largely satisfies the other. The vendor that ships one product with one evidence layer covers both markets.
Questions a compliance officer asks first.
Read the source directly.
- MAS · Principles to Promote FEAT in the Use of AI and Data Analytics in Singapore's Financial Sector · 12 November 2018
- MAS · Artificial Intelligence Model Risk Management — Observations from a Thematic Review · December 2024
- MAS · Veritas Initiative · launched November 2019
- Veritas Toolkit · GitHub · Apache 2.0 · v2.0 26 June 2023
- MAS · Project MindForge · GenAI risk framework first phase November 2023
- Per-section Warrant evidence field mapping · MAS
Authored by Warrant Compliance, the regulatory-analysis function at Warrant. [email protected]. Editorial commentary on regulatory text. Not legal advice. The verbatim quotation of FEAT sub-principles 1 to 14 reflects the published text as recorded in the PwC commentary of December 2018, which footnoted the original MAS press release of 12 November 2018. The verbatim quotation of AIRM Section 1.1 reflects the December 2024 MAS Information Paper PDF read directly. Where the mas.gov.sg primary URLs were intermittently in maintenance during drafting, the PwC December 2018 commentary and the AIRM PDF mirror at the Rajah & Tann AI Toolkit served as cross-checked sources.