October 2026 Global Regulatory Brief: AI risk management, tokenized securities and cryptoasset regulation

As technology continues to reshape financial services, regulators and policy setters are embarking on a range of digital-finance initiatives to manage risks and set appropriate standards. The following digital finance policy developments represent a sample of wider regulatory and policy coverage available to Bloomberg Terminal customers. Run REGS <GO> to find out more or contact your Bloomberg representative to learn more:

• Singapore: MAS issues final AI risk management guidelines
• Dubai: VARA sets minimum audit scope for VASP reserve assets
• US: SEC to facilitate onchain trading of tokenized NMS stocks 
• UK: FCA finalizes cryptoasset perimeter guidance

Singapore: MAS issues final AI risk management guidelines

Overview:
On October 7, 2026, the Monetary Authority of Singapore (MAS) issued its final Guidelines on Artificial Intelligence Risk Management, setting out supervisory expectations for financial institutions (FIs) adopting and using AI.

The Guidelines apply to all FIs and all forms of AI, including generative AI and AI agents, on a risk-proportionate basis. They cover governance and oversight, identification and inventories, risk materiality assessments, AI lifecycle controls, third-party AI, and organizational capabilities and infrastructure.

Implementation will be phased, with governance and core risk-management requirements taking effect from October 7, 2027, followed by lifecycle controls and capability requirements from October 7, 2028.

Context:
MAS consulted on the proposed Guidelines in November 2025 against the backdrop of increasing scale and sophistication of AI adoption in financial services. Since then, international regulatory bodies, including the Financial Stability Board, have also been developing approaches to responsible AI adoption in the financial sector.

Respondents broadly supported MAS’ proposed principles-based and risk-proportionate approach but sought greater clarity on areas including the use of existing governance structures, treatment of embedded and third-party AI, and the extent of governance required for lower-risk AI use.

The final Guidelines retain the overall approach proposed in the consultation while providing additional flexibility and clarification in these areas. They complement, rather than replace, existing MAS requirements and guidance, including the FEAT principles and technology risk-management expectations.

Key takeaways:

• Risk-proportionate approach: FIs should calibrate their governance and controls according to the nature, scale and materiality of their AI use. Basic AI governance policies and procedures may be sufficient where AI failure or unavailability is unlikely to have a material adverse impact on the FI, its customers or other stakeholders.
• Board and senior management oversight: Boards and senior management remain responsible for ensuring appropriate oversight, risk appetite, accountability and resources for AI risk management. MAS does not require a dedicated AI committee; existing governance structures may be used where they provide adequate oversight and cross-functional coordination.
• Identification and inventories: FIs should establish processes to identify AI use and maintain inventories at an appropriate level of granularity. Inventories may build on existing model, technology, data or third-party inventories rather than requiring a standalone AI inventory.
• Risk materiality: Individual AI use cases should be assessed according to factors including their potential impact, complexity and reliance, with more stringent controls applied to higher-risk applications.
• Lifecycle controls: Expectations cover data governance, transparency and explainability, fairness, human oversight, evaluation and testing, cybersecurity, independent pre-deployment review, ongoing monitoring, incident management and change management.
• Third-party and embedded AI: FIs remain accountable for AI used in the services they provide even where it is developed or operated by a third party. MAS expects appropriate assurance, testing, contractual arrangements and monitoring, with compensating controls where providers cannot provide sufficient transparency.
• Generative and agentic AI: The Guidelines explicitly address risks associated with generative AI and increasingly autonomous AI agents, including hallucinations, data leakage, cyber threats, automation bias and the potential for agents with access to tools to take unintended actions. MAS intends to consult the industry in 2027 on whether further guidance for agentic AI is required.
  

Next steps:
The Guidelines will be implemented in phases. From October 7, 2027, MAS’ expectations relating to AI oversight and core risk-management systems, policies and procedures, including AI identification, inventories and risk-materiality assessments, will apply.

From October 7, 2028, requirements relating to AI lifecycle controls, organizational capabilities and technology infrastructure will apply.

MAS has indicated that the framework may be updated or supplemented as AI technology and associated risks evolve. MAS also plans further industry engagement on agentic AI in 2027.

Dubai: VARA sets minimum audit scope for VASP Reserve Assets

Dubai’s Virtual Assets Regulatory Authority (VARA) has issued a circular setting out its minimum regulatory expectations for the independent audit of Reserve Assets held by Virtual Asset Service Providers (VASPs). The circular is dated 6 October 2026. It confirms that appointing an external auditor does not transfer responsibility for compliance from the VASP.

Context:
VARA issued the circular following a thematic review of all Proof of Reserve Assets reports submitted in 2025. According to VARA, the circular is intended to promote a consistent and sufficiently detailed approach to verifying client Virtual Asset safeguarding arrangements and should be read alongside the applicable VARA Rulebooks.

Key takeaways:

• Underlying requirements restated:
  • Company Rulebook, Rule VI.E: VASPs must at all times maintain Reserve Assets equal to 100% of liabilities owed to clients. These must be held one-to-one in the same Virtual Asset as the liability, reconciled daily and audited by an independent third-party auditor.
  • Compliance and Risk Management Rulebook, Rules V.B.3 and 4: Client Virtual Assets must be held in wallets separate from the VASP’s own assets and identified in its books and records. They must not be rehypothecated, except where client consent and VARA licensing requirements are satisfied.
  • Compliance and Risk Management Rulebook, Rule V.D.1: VASPs must maintain systems for accurate daily reconciliation, including complete individual client credit and debit ledger balances.
• Minimum audit scope: at a minimum, the auditor should:
  • Confirm Reserve Assets were maintained at not less than 100% of aggregate client liabilities throughout the review period.
  • Confirm Reserve Assets were held one-to-one in the same type of Virtual Asset as the client liability, without substitution by another Virtual Asset or equivalent value.
  • Cover all wallets used to hold Client Virtual Assets, including hot, warm and cold wallets, assets held through wallet infrastructure providers, and assets held with third-party custodians.
  • Assess whether Client Virtual Assets were segregated from the VASP’s proprietary or operational assets, and identify any commingling.
  • Confirm whether the VASP maintains control over all wallets holding Client Virtual Assets, and describe the custody arrangement for each (licensed third-party custodian or self-custody solution, including wallets operated via third-party wallet technology providers).
  • Confirm daily reconciliation against client liabilities took place, and that evidence of its effectiveness was obtained and reviewed.
  • Confirm whether any rehypothecation, lending, pledging or other use of Client Virtual Assets occurred, and if so provide details of the arrangements and assets affected.
• Audit report content:
  • For each minimum scope item, the report should describe procedures performed, evidence obtained, sampling methodology (including selection of samples across the review period), any reliance on third parties, and any scope limitations.
  • It should set out findings and explain how exceptions will be addressed, including whether follow-up was performed by the audit firm or is to be handled through the VASP’s internal compliance and remediation framework.
  • It should give a clear conclusion against each scope element, distinguishing compliant outcomes, identified exceptions, scope limitations, and matters that could not be independently verified, with the basis documented.
  • Where independent evidence is reasonably available, management representations alone should not be relied upon as sufficient audit evidence.
• Responsibility:
  • Appointing an external auditor does not transfer or reduce the responsibility of the VASP, its Board, Senior Executive Officer or control functions for ongoing compliance and effective safeguarding of Client Virtual Assets.

Next steps:
The circular does not state an effective date, consultation or response deadline. The circular is to be read alongside the applicable VARA Rulebooks and any reporting requirements or instructions issued by VARA.

US: SEC to facilitate onchain trading of tokenized NMS stocks

The U.S. Securities and Exchange Commission has issued an order granting temporary, conditional exemptive relief, referred to as the “Innovation Exemption,” to Tokenized Securities Venues (TSVs). 

Overview:
The exemption permits TSVs to facilitate trading in tokenized National Market System (NMS) stocks using permissioned automated market makers and liquidity pools without registering as national securities exchanges under the Exchange Act. 

How TSVs operate:
A TSV brings together buyers and sellers of tokenized NMS stock by providing one or more automated market maker liquidity pools for permissioned participants to agree to trade terms, and by setting access standards for those wishing to trade on those pools.

Conditions of the exemption:
The exemption is subject to a series of conditions: 

• Tokenized NMS stocks traded on a TSV are subject to limits on the number of symbols and volume traded.
• A TSV must verify that tokenized NMS stock provides holders the same rights and privileges as equivalent traditional NMS stock.
• Before listing a tokenized NMS stock tokenized by an unaffiliated third party, a TSV must give the underlying issuer written notice and an opportunity to object.
• Smart contracts used by a TSV must be auditable, public, and deployed on a public, permissionless distributed ledger.
• A TSV must halt trading in a tokenized NMS stock concurrently with any halt in the underlying stock on its primary listing exchange.
• A TSV must provide public disclosure of its operations, trading activities, and affiliate trading on the TSV.

Dealer exemption:
The order also grants a conditional, temporary exemption from the definition of “dealer” under the Exchange Act to liquidity providers supplying tokenized NMS stock using proprietary capital in AMM liquidity pools, including those engaged in activities indicative of dealing such as quoting pricing to customers or providing committed capital.

Next steps:
The exemptions expire five years after publication in the Federal Register. The Commission has requested public comment on potential modifications to the relief and further steps toward a permanent framework for onchain trading.

UK: FCA finalizes cryptoasset perimeter guidance

Overview:

The FCA has finalized guidance on how the UK cryptoasset regime will apply from October 25, 2027, clarifying which cryptoasset activities require authorisation.

Context:
The guidance follows consultation feedback and supports implementation of the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026.

Key takeaways:

• Covers stablecoin issuance, safeguarding, trading platforms, dealing, arranging and staking activities.
• Clarifies treatment of technical service providers, custody models and overseas firms serving UK consumers.
• Existing permissions and MLR registrations will not automatically convert to the new regime.

Next steps:
The FCA authorization window opens on September 30, 2026. The regime comes into force on October 25, 2027. The FCA will continue to develop the wider cryptoasset regulatory framework as needed.