AI rules for financial institutions: how six regulators compare in 2026

Global reference

• Scope: Banks, insurers, asset managers, payment and finance companies
• Regulators: CBUAE, MAS, European Union, FCA, HKMA and peers, CSBS (United States)
• Key dates: EU high-risk rules 2 December 2027; MAS guidelines effective 7 October 2027
• Status: Mix of binding law (EU) and supervisory guidance (all others)

How they compare

• United Arab Emirates: the CBUAE issued a guidance note on responsible AI and machine learning on 23 February 2026. It is not binding, but supervisors will use it. It covers board accountability, bias testing, customer disclosure in Arabic and English, and a customer right to human review.
• Singapore: MAS issued final Guidelines on AI Risk Management on 7 October 2026, after a November 2025 consultation. They apply to all financial institutions from 7 October 2027, with some sections due by 7 October 2028. MAS plans to consult on agentic AI in 2027.
• European Union: the AI Act is binding law. Credit scoring of individuals and life and health insurance pricing are high-risk uses. After the Digital Omnibus (Regulation (EU) 2026/1744, published 24 July 2026), these obligations apply from 2 December 2027.
• United Kingdom: the FCA relies on existing rules, such as Consumer Duty and the senior managers regime, rather than new AI rules. It runs AI Live Testing with firms, and the Mills Review is looking at how AI will change retail financial services.
• Hong Kong: the HKMA, SFC, Insurance Authority and MPFA launched the GenA.I. Sandbox++ on 5 March 2026, widening the 2024 banking sandbox to the whole financial sector.
• United States: there is no single federal AI rule for finance. On 16 September 2026 the Conference of State Bank Supervisors released an optional AI supervisory framework for state-chartered banks and licensed non-banks.

What they all expect

• The board and senior management are accountable for AI outcomes.
• A live inventory of AI use cases, each rated by risk.
• More controls and human oversight for decisions that affect customers, such as lending, pricing and claims.
• Testing for bias, accuracy and drift, before and after go-live.
• Full responsibility for AI bought from vendors: due diligence, audit rights and an exit plan.

What to do now

• Build one AI inventory for the whole group and map each use case to every regulator that applies.
• Use the strictest rule as the group baseline where you operate in several countries.
• Diary the dates: 2 December 2027 (EU) and 7 October 2027 (Singapore).
• Review vendor contracts for audit rights and model documentation.

Our take

The rules differ in form but not in substance. A group that meets the MAS guidelines and the EU high-risk requirements will be close to compliant almost everywhere else. Start with the inventory: every regulator asks for it first.