MAS and AI in financial institutions
SAFR v1.0 — Safeguards for Agentic Finance at Runtime
SAFR is an industry white paper published under a MAS initiative, and it states that it does not constitute regulatory guidance or supervisory expectations. What it supplies is an architecture: a governance envelope, four disposition outcomes and a tamper-evident audit log, sitting between an agent’s proposed action and its execution.
§ 1 — Who it binds
What it reaches, and what it obliges
Financial institution
Agentic systems that initiate actions rather than produce outputs for a person to act on — the paper’s own opening distinction. SAFR is a reference model an institution implements in its own infrastructure; it is expressly not a managed service and it is not an instrument, so it binds nobody and no supervisory consequence attaches to ignoring it. What it describes reaches any deployment where software can move money, submit a filing or change a record without a person in the path.
§ 2 — In practice
A checkpoint between the decision and the act
Getting the status right is the whole of the page. SAFR was jointly developed by the financial industry under MAS’ BuildFin.ai initiative and sits on MAS’ own publications site, which is precisely the combination that produces a misattribution. The paper forecloses it in terms: it does not constitute regulatory guidance or supervisory expectations, nor does it prescribe or anticipate future directions for such guidance or expectations, and each institution remains responsible for determining how its deployment aligns with applicable supervisory expectations and internal governance requirements. Nothing in it binds anyone. An institution that implements the model in full has satisfied no MAS requirement, because the paper states none. The requirements sit elsewhere — in the Notices and Guidelines already in force, which reach what an agent does whether or not the firm has heard of this document.
The distinction the paper draws is between filtering what a model says and authorising what an agent does. Guardrails on model output are therefore not a substitute for runtime governance of financial action: an agent may still propose a payment above its authority, a trade outside its permitted instruments, or a filing it was never delegated to make, and none of those is a content defect a filter could see. They are authorisation questions. Hence the checkpoint sits between the proposed action and its execution rather than around the model, and hence the mandate rule — an agent cannot extend the scope of a mandate through its own reasoning or inference; authority is explicit, structured and defined by the mandate. The draft MAS Guidelines reach agents too, and their agentic scope is treated separately; what this paper adds is the runtime architecture neither the draft nor any instrument in force describes.
The sharpest sentence in the document is an admission about its own artefact. The Governance Envelope carries three classes of information — the action, the action trace, and context metadata such as identity, mandate, account state and operative policy constraints — and the trace is the agent’s account of the steps it executed. SAFR warns that the action trace and action details are both agent-declared contents of the same envelope, and both can be fabricated together by a sophisticated adversarial injection that stays internally consistent while departing from the original task, so the envelope is to be treated as a document authenticated against its origin rather than a record of what the agent reported. An implementation that writes that envelope to an append-only store and verifies nothing has built a very durable copy of the agent’s version of events, which is not the same object as a trail somebody can rely on.
Two design rules are testable in an afternoon. The first is step independence: in multi-step workflows the control flow applies to each action separately, and an Auto-Execute or Observe outcome at one step carries no authority into the next, because the agent adapts to intermediate results and changing conditions as it goes. Most agentic frameworks authorise a plan once and then run it, so the honest answer is usually no. The second is the Escalate outcome, which the paper itself identifies as the weakest link: there are no consistent standards for when a human should be in the loop, the mechanism is typically a notification, an email alert or a dashboard flag with no defined deadline for response, no standard format for what must be decided and no audit record of the decision — which gives the appearance of human oversight without the substance of it. That is a designed interface rather than the capability Article 14 states.
None of this is enforceable, and the exposure is unaffected by that. A payment is a payment; a critical system is a critical system under Notice FSM-N05 whether an agent or a person triggered the failure; a model service obtained from a provider sits inside Notice 658’s register on the Notice’s own terms whoever calls it. Where the paper earns its place for a Singapore firm is the Controls Repository — the configurable rulebook of organisational policies, regulatory requirements, product rules and user-provided mandates against which a proposed action is checked. That is the point at which obligations already in force become machine-checkable at the moment of action, and calibration is set at design time through the governance parameters of the controls, so threshold-setting is subject to review before deployment rather than after an incident. A repository whose regulatory category is a heading with nothing under it has encoded nothing.
§ 3 — What a weak answer looks like
Alignment claimed to a paper that claims nothing
The paper cited as the standard the firm is aligned to. A steering pack says the agentic programme follows MAS’ agentic finance framework; the phrase survives into a board minute and then into a supervisory conversation, where it will not hold — the document says of itself that it is neither guidance nor an expectation, so alignment with it discharges nothing. The quieter version is worse: an architecture drawn accurately in slides, with the disposition engine present as a box and absent from the code path that actually releases money.
§ 4 — What discharges it
What an implemented envelope must show
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
The action-type catalogue with a disposition assigned to each
Every action the agent can take, resolved to Deny, Escalate, Auto-Execute or Observe, with reversibility, financial materiality, customer impact severity, regulatory sensitivity and novelty shown as inputs. A catalogue with no reversibility column is the fastest tell that thresholds were set by convenience.
02
Envelope authentication evidence, not envelope storage
What signs the envelope at its origin, what verifies that signature before the disposition runs, and what the system does when verification fails. Keeping records is easy and settles nothing; the question is whether anything would reject a well-formed envelope from the wrong source.
03
The mandate register, with the point that enforces it
Scope, limits, conditions and validity period per agent, plus the component that refuses anything outside them. Authority here is explicit and structured, so a mandate held only in a system prompt is a suggestion the model may reason its way past.
04
A step-independence test run against the deployed system
A multi-step workflow in which an early permitted action is shown not to authorise a later one. It takes an afternoon and returns a binary answer, which is why it is the first thing to ask for and the last thing most programmes have.
05
Escalation service levels with the decision recorded
The deadline for a human response, the format of what is put in front of that person, and the record of what they determined. These are the three things named as missing wherever escalation is a notification and a hope.
06
The derivation of each Deny control to a named source
Each hard constraint traced to the policy, product rule, client mandate or in-force obligation it comes from. Where the rulebook holds a category heading and no populated list beneath it, the constraint exists in the diagram only.
§ 5 — Worked example
Worked example — a treasury agent and a shared inbox
A bank deploys an agent in corporate treasury operations. It reads client instructions from a mailbox, drafts a payment, checks the beneficiary against the sanctions screening service, and releases payments below a set value without a person in the path. A weekly report shows every action the agent took, assembled from the agent’s own execution logs, and the team cites it as the audit trail. Anything above the limit goes to a shared inbox monitored during office hours.
Which parts of this meet SAFR’s runtime model, and which only look as though they do?
The value limit is a real calibration and the sanctions check is a real control. Almost everything else is the agent reporting on itself. The weekly report is assembled from logs the agent produced, so it evidences the agent’s account rather than an authenticated record: nothing signs the envelope, nothing verifies it, and there is no stated behaviour on verification failure, because verification does not occur. The shared inbox is the escalation gap the paper names — no response deadline, no defined decision format, no record of who decided what — so an escalated payment nobody opens for two days has been neither approved nor refused, and the queue has quietly become an approval mechanism. Finally, the description says nothing about whether releasing one payment carries authority into the next step of the same instruction: amending a beneficiary, or acting on a second mailbox item. That is the step-independence question, it has a binary answer, and it can be put to the deployed system this week.
§ 6 — Elsewhere
Where the same problem is addressed
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
That page carries the agentic scope of the draft MAS Guidelines. This one addresses a runtime architecture proposed by an industry paper, which the draft does not describe.
Agentic AI guidance
Identity is the precondition placed before every other check here: an action is bound to a registered agent and verified against that agent’s registry entry before any other evaluation proceeds.
Action reversibility is the first of the five calibration factors, and it is one of the properties that moves an action out of autonomous execution and into the escalation path.
Article 14 addresses an oversight capability designed into a high-risk system. The Escalate outcome is one designed interface for it: a held action, a named reviewer, a recorded decision.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7 — When it applies
Publication dates, not commencement dates
13 November 2025
Publication date of the Project MindForge Phase 2 materials, which broadened that consortium’s scope from generative AI to traditional, generative and agentic AI. A publication date for voluntary industry material, not a deadline, and nothing was required of any institution on it.
3 July 2026
Publication date of SAFR version 1.0. Again a publication date rather than a commencement date: the paper is an industry product, imposes nothing, and no compliance obligation attached to any institution on this date or since.
§ 8 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
- Safeguards for Agentic Finance at Runtime (SAFR), white paper, version 1.0, July 2026, 25 pages. Jointly developed by the financial industry under MAS’ BuildFin.ai initiative.
- Version 1.0 published 3 July 2026. No commencement date exists, because the paper imposes nothing.
- Project MindForge page, published 13 November 2025, recording Phase 2 and its broadening from generative AI to traditional, generative and agentic AI.
- MAS’ own statement of its instrument classes, which is what places an industry white paper outside the taxonomy entirely.
§ 9 — Also read
Also read
Agent audit trails — what the record has to reconstruct
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.