Before the licence: What Singapore’s regulated institutions ask a fintech partner first

In Singapore, regulated institutions now ask fintech partners what they need before granting them a license. This process began with the release of the Monetary Authority of Singapore's Guidelines on Artificial Intelligence Risk Management on 7 October 2022. The guidelines state that institutions must assess third-party risks, including AI models purchased from vendors, before signing any contracts.

The questions asked by institutions are not arbitrary but are derived from four sets of rules: outsourcing and third-party risk, technology risk management, cyber hygiene, and AI risk management. These rulebooks bind the institutions and are reflected in the second person on the questionnaire sent to the fintech partner.

The institution will assess if the service provided by the fintech partner is material, determine where the data is stored, identify the sub-contractors involved, and evaluate the ability to audit the provider. Additionally, institutions will review the security measures in place, such as secure development practices, access control, penetration testing, and incident reporting.

AI risk management is a new addition to the regulatory framework, requiring institutions to maintain an inventory of the AI models used, including those purchased from vendors. The Future of Finance Institute is working on providing more details on third-party AI risk management.

The first due diligence process typically takes several months, as the institution sends out questionnaires to new vendors seeking partnerships. The founder must gather policies, cloud regions, and model provider test results to respond to the questionnaire, which can lead to delays on both sides. To expedite this process, institutions and fintech partners are encouraged to assess themselves against the four rulebooks before receiving any regulatory questions.