Singapore might be famous for its love of acronyms, but ASEAN’s financial regulators are giving it a run for its money. Between FEAT, RMiT, STARS, PADK, the region's AI regulatory landscape is vast and complex.
We looked at every AI and tech-risk framework we could get my hands on from Singapore, Malaysia, Indonesia, Thailand, and the Philippines, along with the global equivalents out of the US, China, and the EU (and the voluntary NIST standards everyone else is quietly copying).
The Regulatory Timeline at a Glance
Hide-and-seek
When analysing this landscape, the most critical detail isn't the publication date—it’s which documents actually carry legal weight. Often, frameworks explicitly labeled "AI" are merely advisory.
For instance, Malaysia’s BNM AI discussion paper is a non-binding feeler. The real regulatory teeth come from RMiT (Risk Management in Technology)—a pre-existing tech-risk framework that recently added a binding NCII appendix dictating how banks handle AI as an "emerging technology."
Indonesia mirrors this approach. The OJK’s April 2025 Banking AI Guide serves as a soft "minimum reference." The enforceable mandates arrived eleven months later in PADK No. 1/2026, which forces the renegotiation of IT-vendor contracts.
Familial Resemblance?
If you line these frameworks up, you can clearly see their shared ancestry and that none of them exist in a vacuum.
NIST’s foundational Risk Management Framework (Govern, Map, Measure, Manage) echoes throughout the region:
Indonesia (OJK) walks through responsibility, inventory, risk, and monitoring.
Singapore (MAS) centers on inventory, materiality, validation, and ongoing monitoring.
The Philippines (BSP) utilises the STARS principles: Sustainability, Transparency, Accountability, Responsibility, Security. Its five-stage lifecycle (planning, development, validation, deployment, monitoring) is essentially NIST with a better acronym. Notably, STARS is the first regional framework to elevate Sustainability and Security to standalone pillars, while sharing its "Accountability" DNA with Singapore’s original 2018 FEAT principles.
The distinct outlier in formatting is Malaysia's RMiT, which splits its provisions into mandatory ("S") and encouraged ("G") clauses within a single document.
The Global Divide
Zoom out from Southeast Asia, and the family resemblance stops. The US, China, and the EU are operating on entirely different instincts:
United States: Surprisingly cautious in banking. The Fed/FDIC/OCC April 2026 model-risk guidance explicitly excludes generative and agentic AI via a footnote, leaving a regulatory gap exactly where the market is innovating today.
China: Highly prescriptive. The NFRA's guidelines mandate risk-committee sign-offs for high-risk applications and require a human final decision if a system "cannot be sufficiently explained." No model gets the final word.
European Union: Extraterritorial. The AI Act assigns duties based on your role (provider vs. deployer) and where the output lands. A Southeast Asian bank with EU-linked customers can easily fall under its jurisdiction without ever opening a European branch.
The Eight Core Questions
Underneath the varying acronyms, every regulator is ultimately asking the exact same eight questions:
Ownership: Who is responsible for this system?
Inventory: What AI is actually in use?
Materiality: How risky is this specific task?
Data/Output: Are the data and outputs accurate and high-quality?
Validation: Has the model been properly checked by someone independent of its builders?
Intervention: Can a human successfully intervene if something goes wrong?
Security: Are third-party suppliers and access controls secure?
Lifecycle: What happens post-launch (ongoing monitoring)?
Lightweight vs Over- engineering?
Navigating the region’s fragmented regulatory landscape presents a few dilemmas, whether you are a regional institution with operations spanning multiple markets or a local bank planning for the future.
Legally, a bank must comply with local texts—MAS's materiality tests and the BSP's STARS lifecycle aren't interchangeable paperwork, but from an engineering perspective, you shouldn't build separate AI governance systems.
If you are a local technology leader (for example, at an Indonesian bank where the current OJK AI Guide is merely a "minimum reference"), you might be tempted to build lightweight, localised compliance to check the current box and save money. However, across ASEAN, soft guidance on AI is rapidly hardening into mandatory tech-risk audits, much like how Indonesia's PADK No. 1/2026 turned general IT concepts into binding mandates overnight.
Rather than risking the immense cost of compliance debt and having to retroactively unpick and rebuild live AI systems when local regulators inevitably mandate strict validation, it makes financial and operational sense to "future-proof" your tech stack against whatever binding rules drop next.
If you're an IT leader in a bank, how do you make the call between something lightweight vs over-engineering? If you're a B2B vendor helping ASEAN banks on their AI governance journey, how do you navigate the regulatory requirements?
About ASEAN Innovation Business Platform (AIBP)
The ASEAN Innovation Business Platform (AIBP) is an initiative focused on enabling innovation and strategic partnerships across public and private organisations in Southeast Asia. Through curated engagement activities, AIBP supports the growth of regional government agencies, enterprises and solution providers in navigating key themes such as innovation, digital transformation, and sustainability.
Learn more at www.aibp.sg
