MAS Publishes 'SAFR' White Paper With Industry on Runtime Safeguards for AI Agents in Finance: Identity, Controls, a Disposition Engine and Tamper-Evident Audit Logs

Artificial intelligence systems that can carry out tasks on their own, often called AI agents, are starting to appear in finance. They might initiate a payment, rebalance a portfolio or answer a client and take an action on the client's behalf. Singapore's financial regulator has now published a technical blueprint for keeping them under control. According to an analysis by the law firm Rajah & Tann Asia dated July 6, 2026, the Monetary Authority of Singapore (MAS) published an industry white paper on July 3, 2026, titled "Safeguards for Agentic Finance at Runtime", abbreviated to SAFR.

It is worth being clear about what SAFR is. The Rajah & Tann article describes it as an industry white paper, developed by MAS together with leading financial institutions and financial technology companies. The sources reviewed do not say whether it is open for formal consultation or whether it sets binding requirements, so it should be read as guidance and a reference design, not as a rule.

The paper's purpose is to give financial institutions real-time safeguards, so that AI agents stay within the mandates, policies and risk boundaries the institutions set. The central idea is that checks should operate at runtime, at the moment an agent proposes an action, rather than relying only on testing before deployment. The paper's own formulation, quoted by Rajah & Tann, is that "no agentic action reaches execution without having been declared, authorised and assessed."

SAFR describes four runtime components that work through what it calls a governance envelope. The first is agent identity. Each proposed action is checked against a registered agent, so that the institution knows which agent is acting and whether it is permitted to act. The second is a controls repository, which is the institution's configurable rulebook: the limits, policies and conditions that apply to agents. The third is a disposition engine, which resolves each action into one of four outcomes: deny, escalate, auto-execute or observe. Escalation is where a human gets involved, so the engine decides which actions can run automatically, which need a person's decision and which must be blocked. The fourth is an audit log, described as a tamper-evident, append-only record of governance decisions. Because entries can only be added and any alteration is detectable, the log allows later review of what an agent did and why it was allowed.

The framework builds on MAS's Project MindForge AI Risk Management toolkit, which connects it to the regulator's wider work on AI. That includes the guidelines on AI risk management that MAS proposed in November 2025, covering governance, an inventory of AI uses, risk materiality assessment and lifecycle controls for generative AI and AI agents, with a proposed 12-month transition period after issue. SAFR can be read as a technical complement to those principles: the guidelines say what a firm should have in place, and the white paper shows one way to build it for agents that act.

The paper identifies use cases: agent-assisted payments and treasury operations, wealth management and advisory workflows, and client engagement. These are areas where an agent's mistake can have direct financial consequences or affect customers, which is why the authorisation and escalation steps matter. The sources do not mention insurance claims or underwriting specifically, though the same design could apply to any regulated firm that deploys agents.

A few things the sources do not report. The article does not describe a regulatory sandbox, specific technical standards, deadlines for firms or enforcement. It does not give details of which institutions took part. Readers should therefore avoid assuming that adopting SAFR is mandatory or that following it would satisfy any regulatory requirement; that is a question for MAS and the firms' own supervisors.

Why does the approach matter? Traditional AI models produce predictions or recommendations that a person then acts upon. Agentic systems can carry out the next step, which raises questions of accountability, control and auditability. If an agent makes a payment error, a firm needs to know which agent acted, under whose authority and according to which rule. The design separates the agent from the rulebook that governs it, so that limits can be changed centrally and applied consistently, and it records decisions in a way that is hard to alter. A tamper-evident log is especially useful for regulators and auditors, who must reconstruct events after an incident.

Singapore's approach is consistent with its stated preference for principles-based supervision combined with practical industry collaboration. By publishing a reference design with industry participants, MAS offers a common vocabulary that firms can adopt or adapt, and signals the kind of controls it expects to see as agents spread. For firms elsewhere, including insurers and banks in jurisdictions that have not yet issued specific guidance, SAFR provides a concrete example of what runtime governance can look like.

The practical next steps for firms considering agents are to inventory where agents are used or planned, decide which actions an agent may take on its own, define the escalation triggers, and make sure logs are kept in a form that supports audit. Whether MAS follows the white paper with formal guidance or supervisory expectations is something to watch.