MAS and Singapore's Banks Launch the ACT Taskforce to Counter AI-Driven Cyber Threats

Singapore's central bank and its banking association have created a joint taskforce to prepare the financial sector for cyber attacks that use advanced artificial intelligence. The Monetary Authority of Singapore and the Association of Banks in Singapore announced the AI-Driven Cyber and Technology Risk Taskforce, abbreviated as ACT, on July 28, 2026. The announcement was published in the press release carried by The Asian Banker on July 29, and discussed by other outlets including GRC Report.

Who is involved? The taskforce brings together the two convenors, MAS and ABS, with the three local banks DBS, OCBC and UOB, the Singapore Exchange, the Network for Electronic Transfers, known as NETS, and Banking Computer Services, known as BCS. That list is notable because it spans lenders, the stock exchange and the companies that run card and interbank payment infrastructure. Reports say the members combine expertise in cybersecurity, technology resilience and artificial intelligence, and that they have been working together since May 2026, so the July announcement formalised an effort that was already under way. The reports reviewed do not name a chair, give an end date or list publication deadlines.

What will it do? According to the press release, the work is organised around three focus areas. The first is industry collaboration. Members will share their use cases and experiences of applying AI to cybersecurity, and will engage outside cybersecurity and AI experts. The second is capability uplift. The group plans to build the sector's cyber defence knowledge and to run proof-of-concept trials that test advanced AI-enabled tools. The third is guidance. The taskforce intends to develop guidance on new measures, controls and solutions to detect, prevent and respond to AI-enabled threats. Detailed controls were not published at launch, so what banks will eventually be asked to do is not yet known.

Why now? Vincent Loy, MAS's assistant managing director for technology and its chief technology officer, said that frontier AI is increasing the severity, scale and sophistication of cyber threats, and that the sector needs to respond urgently and collaboratively. Ong-Ang Ai Boon, director of ABS, said AI is reshaping the cyber threat landscape and that close coordination, governance and partnership between regulators and industry will keep the sector resilient. GRC Report added context from a Bank for International Settlements bulletin published shortly before the launch. According to that coverage, the bulletin warned that frontier models can find vulnerabilities, build exploits and automate attack chains quickly and cheaply, which could favour attackers. If successful techniques spread at low cost, the article argues, defences built by each institution on its own become less effective.

To understand the concern, it helps to compare older and newer attacks. Traditionally, finding a weakness in a bank's software, writing code to exploit it and launching an attack required skilled people and a good deal of time, which limited how many attacks could be run at once. Advanced AI systems can reduce the effort for several of those steps, for example by scanning large amounts of code for errors, drafting convincing phishing messages or probing systems automatically. That does not mean every attack will succeed, but it can mean more attempts, made faster, by less experienced attackers. This is a general description of the risk that the officials cited, not a finding about any particular incident in Singapore.

The defensive side has the same potential. Banks already use machine-learning tools to spot fraud and unusual network activity, and newer systems may be able to triage alerts, review code for flaws and speed up the response to an incident. The proof-of-concept trials are intended to test which of these tools work in practice before they are relied on. Testing in a shared setting can help smaller members learn from larger ones, and it lets the regulator see what is effective before it writes expectations into supervisory guidance.

Why is a sector-wide approach sensible? Banks do not operate alone. A payment moves from a customer's bank through interbank networks and clearing systems, and securities trades pass through the exchange and its infrastructure. The inclusion of SGX, NETS and BCS in the taskforce reflects that dependence. A weakness in one link, or in a shared supplier, can affect many institutions at once. Sharing threat information early is one of the main ways a financial system can limit the damage from an attack that is spreading.

What does this mean for ordinary customers? In the short term, probably very little will change in how you use your account. The taskforce is about preparation, information sharing and guidance rather than new customer rules. The practical advice for individuals remains the same as before. Use the multi-factor authentication your bank offers, treat unexpected links and calls with suspicion, because AI can make scam messages more convincing, and report suspicious activity to your bank promptly. Banks and regulators can strengthen the system, but customers' habits still matter.

What should be watched next? The first test will be whether the taskforce publishes guidance and when. Industry guidance can influence supervisory expectations, so firms outside the taskforce, including smaller banks and fintech companies, may want to follow what it produces. It will also be worth watching whether further parties, such as insurers or other infrastructure operators, are invited to join. For now, the announcement is a statement of intent, backed by named participants and a work plan. It shows that Singapore's authorities treat AI-enabled cyber threats as a present risk to the financial sector and want banks to respond together rather than separately.