Regulation
MAS Shared Responsibility Framework and AI use cases
Singapore's framework that assigns banks and telcos duties and loss sharing for phishing scams.
Read the source text (Monetary Authority of Singapore)Limited risk (transparency) under the EU AI Act
People must be told they are dealing with AI, and generated content must be identifiable (Article 50).
- AI assistant for money transfers and bill payments by chat or voice
A customer facing assistant must make clear that people are dealing with AI, unless that is obvious from the context (Article 50). Preparing a payment the customer approves is not listed in Annex III. It becomes high risk if the same assistant evaluates creditworthiness, for example by deciding on an overdraft or credit line at the moment of payment (Annex III point 5(b)).
- AI scam intervention for instant payments
Annex III point 5(b) expressly excludes AI systems used to detect financial fraud from the high risk creditworthiness category, so the scoring is not high risk. The conversational part must disclose that it is AI under Article 50(1). If a voice component infers the customer's emotions from their voice, it becomes an emotion recognition system under Annex III point 1(c), which is high risk and needs the Article 50(3) notice, so keep coaching detection to what is said rather than to biometric signals.
Minimal risk under the EU AI Act
No specific obligations under the EU AI Act beyond AI literacy; voluntary codes apply.
- Real time fraud scoring for card and instant payments
Annex III point 5(b) lists creditworthiness assessment and credit scoring of natural persons as high risk but explicitly excludes AI systems used for the purpose of detecting financial fraud, and payment fraud scoring is not otherwise listed in Annex III or prohibited by Article 5. Behavioural biometrics used only to confirm that customers are who they claim to be fall under the biometric verification exclusion in Annex III point 1(a). The model does not interact with people, so Article 50 does not apply. GDPR Article 22 can still apply to solely automated declines with significant effects on customers.