Free guide · 8 pages
When AI starts acting, put a checkpoint in front of it.
MAS has published SAFR, a reference design written with DBS, OCBC, UOB, Visa, Mastercard and others for what should happen between an AI agent proposing an action and that action running. This guide explains it for smaller MAS-licensed firms, and what to build first.
Inside the guide
- 01How SAFR works. The checkpoint between an AI agent and the systems it acts on, and its four parts.
- 02The envelope and the four outcomes. What an agent must declare before acting, and deny, escalate, auto-execute or observe.
- 03Does it apply to your firm?. Three questions, and where advisers, trust companies, fund managers, brokers and payment firms start.
- 04What to build first. A gateway, an approval queue and an audit log: the three parts that cover most of the risk.
- 05Human review that is real. A 13-point checklist for escalation that actually decides.
- 06A starter set of controls. What you decide, with a worked example for a payout agent.
- 07Where it meets the MAS AI guidelines. How SAFR’s records help show what MAS expects from October 2027.
Does your AI act? · 1 minute
Think of the AI tools your firm uses. Does any of them…
Your answers stay in your browser.
- 1
Send, pay, file, approve or change a record without a person pressing the button?
- 2
Put its output in front of a client or regulator without someone reading it first?
- 3
Act inside another system for you, such as email, a CRM or banking?
Questions
About the guide.
Is SAFR a MAS requirement?
No. MAS published it with industry as a reference design, and the paper says it is not regulatory guidance or a supervisory expectation. MAS’s Guidelines on AI Risk Management are what it expects; SAFR is one way to build controls that help you show you meet them.
Who is the guide for?
Smaller MAS-licensed firms (financial advisers, trust companies, fund managers, insurance brokers and payment institutions) that use AI tools able to send, pay, file or change records, or are about to.
What happens to my details?
We email you the guide and use your details only to follow up on it. You can ask us to delete them at any time.
Have AI that acts?
Thirty minutes. Tell us what your AI tools can do on their own today. We will tell you where we would put the first checkpoint, or that you do not need one yet.