Comparing APRA (Australian Prudential Regulation Authority), the FCA (Financial Conduct Authority), and MAS (Monetary Authority of Singapore) on AI governance reveals three distinct regulatory strategies for the same fundamental challenge: ensuring financial institutions use AI safely and fairly. APRA issued its first AI-specific industry letter on 30 April 2026, based on a targeted review of large banks, insurers, and superannuation trustees. The FCA applies its existing principles-based framework to AI, supplemented by sector-specific guidance under the UK's cross-regulator approach. MAS is developing the most comprehensive AI-specific regime through its AI Risk Management Guidelines consultation (November 2025), building on the established FEAT Principles. For financial institutions operating across these markets, understanding how each regulator's expectations differ, and where they converge, is essential for building governance frameworks that satisfy all three.
APRA, principles with supervisory teeth
APRA's 30 April 2026 industry letter represents its first published, AI-specific expectations. Drawing on a late-2025 targeted review, APRA found that governance, risk management, assurance, and operational resilience practices are not keeping pace with AI deployment. APRA expects: formal AI governance frameworks with clear reporting lines; ownership and accountability across the full AI lifecycle; comprehensive AI use case inventories; human involvement for high-risk decisions; structured staff training; and robust vendor management including tested exit strategies. APRA anchors these expectations in its existing prudential framework rather than in new AI-specific standards. The letter itself names no standard by number: it says only that "APRA's principle-based prudential framework is technology and vendor agnostic", and observes that "most entities recognise that existing prudential standards apply to AI risk". The message is that the existing framework already covers AI risk; APRA is making explicit what was previously implied.
FCA, the principles-based approach
The FCA does not have a standalone AI regulation. Instead, it applies existing regulatory principles to AI contexts: the Consumer Duty (fair outcomes for customers, including those affected by AI decisions), the Senior Managers and Certification Regime (individual accountability for AI-related decisions), and existing rules on algorithmic trading, credit scoring, and insurance pricing. The FCA published its AI Update in April 2024, signalling how it expects firms to approach AI governance within the existing framework, and has built out a testing and engagement programme since: the AI Lab, whose components include AI Live Testing, where a second cohort of firms began testing in April 2026, and the Supercharged Sandbox, which builds on the FCA's existing Digital Sandbox with NVIDIA accelerated computing. On 6 July 2026 the FCA published the Mills Review, commissioned by its Board and led by Sheldon Mills, on how AI could reshape retail financial services by 2030 and beyond. The UK's approach is sector-led: the FCA, PRA, Bank of England, and other regulators each address AI within their mandates, coordinated by DSIT's pro-innovation framework. The advantage is flexibility; the challenge is that firms must piece together expectations from multiple regulators.
MAS, toward comprehensive AI rules
MAS is developing the most prescriptive AI governance framework of the three. The FEAT Principles (Fairness, Ethics, Accountability, Transparency), published in 2018 and updated since, provide the foundational framework. The AI Risk Management Guidelines consultation, published November 2025, proposes detailed requirements covering AI governance structures, model risk management, data management, and customer outcomes. MAS also leads Veritas, an industry consortium whose assessment methodologies and open-source toolkit let financial firms document how they have applied the FEAT fairness, ethics, accountability and transparency principles. FEAT was published in MAS's monographs and information papers series rather than as one of MAS's eight categories of regulatory instrument, so it carries no legal force and there is no formal compliance obligation to discharge. As of mid-2026, MAS is still reviewing consultation responses and the AI Risk Management Guidelines have not yet been finalised; once finalised, they will create the most detailed AI-specific requirements of any financial regulator globally.
Where they converge
Despite different approaches, all three regulators expect the same foundational capabilities: board-level AI oversight and literacy, comprehensive AI system inventories, human oversight mechanisms for high-risk AI decisions, model risk management including validation and monitoring, third-party AI vendor governance, incident response capability for AI failures, and evidence-based assurance rather than reliance on management assertions.
Practical approach for multi-jurisdiction firms
Build your AI governance framework to satisfy MAS expectations (the most detailed of the three, though issued as Guidelines rather than legally binding Notices), which will generally exceed APRA and FCA expectations. Map your AI systems to each regulator's specific requirements. Ensure board and senior management reporting covers the specific areas each regulator expects to see. Maintain jurisdiction-specific documentation where approaches diverge (particularly around model validation standards and vendor governance expectations).
Primary sources: APRA Letter to Industry on AI, 30 April 2026 | FCA, AI and machine learning | MAS Consultations
