The apps staff build with AI, at a financial institution in Singapore
MAS issued its Guidelines on Artificial Intelligence Risk Management on 7 October 2026, and they take effect on 7 October 2027 for every financial institution it regulates. Forculus keeps the apps your staff build with AI private behind your sign-in and gives you a record of each one: who owns it, who can open it, where it sends data and every request it served. That record is yours to use in your own assessment. Using Forculus doesn't by itself meet any MAS guideline.
Updated
What MAS has published
- MAS published the Guidelines on Artificial Intelligence Risk Management for Financial Institutions on 7 October 2026. MAS says they apply "to all financial institutions (FIs) and all forms of AI technologies", and that they take effect on 7 October 2027.
- Clyde & Co's summary says MAS expects institutions to identify their use of AI consistently and, where practicable, keep an accurate inventory of their AI use cases. It says the expectations on governance, oversight and core risk management apply from 7 October 2027, and those on AI lifecycle controls, capability and technology infrastructure by 7 October 2028.
- MAS revised its Technology Risk Management Guidelines on 18 January 2021. Its announcement stresses security controls in the way technology is developed and delivered, close oversight of outsourced arrangements, and senior management accountable for technology and cyber risk.
A record of every app
On Forculus, a workspace's owners and admins get a row for every app: whether it's live and which version, who made it, who can open it, the hosts it sent requests to in the last 30 days, and when someone last opened it. It downloads as CSV on any plan. See For IT.
Every request, kept
The audit log has every request let in or refused and every change, with who made it. Business and Enterprise keep it 12 months, and it can be streamed to your SIEM. Usage insights show which apps nobody opens any more and which have lost their owners.
Controls you set
- Every app starts private. A publish policy says who may share an app outside the company or open it to the whole workspace.
- Your identity provider can sign everyone in, and SCIM removes leavers. Access ends within 60 seconds of being removed.
- Keys stay out of app code, each app can be held to a list of hosts it may call, and every deploy is scanned for leaked keys and vulnerable packages.
- Agents get names and credentials of their own, and every request they make is logged under that name.
Where data is kept
Our own database, with accounts, sharing, settings and the last 30 days of the audit log, is in Singapore, in AWS ap-southeast-1. Each app's database and files are kept by Cloudflare, in the region nearest whoever created the app. Enterprise customers can negotiate a DPA with us. See Where data is kept.
Questions
Does Forculus make us compliant with MAS's guidelines?
No product does that alone, and we don't claim it. Forculus gives you records and controls for the apps your staff build. How they fit your institution's risk management is your assessment.
Is Forculus an outsourced service provider?
Your institution decides how it classifies us. Our security page, DPA and list of subprocessors say what we do and who we rely on.
Can we try it before a contract?
Yes. Free needs no card. For Enterprise, write to sales@forculuslabs.tech.
Sources
- Guidelines on Artificial Intelligence Risk Management for Financial Institutions, Monetary Authority of Singapore, published 7 October 2026. Checked 22 October 2026.
- Making AI Work Responsibly: What the New MAS Guidelines Mean for the Insurance Industry, Clyde & Co, 14 October 2026. Checked 22 October 2026.
- MAS Enhances Guidelines to Combat Heightened Cyber Risks, Monetary Authority of Singapore, 18 January 2021. Checked 22 October 2026.