What Singapore Told Us About AI, Risk and the Role of People

Some industry gatherings are useful. A few shape how you think for months afterwards, and Singapore is consistently one of those for me. Last week, the Risk & Market Show and the 1LoD Leaders Networks brought together practitioners from all three lines of defence who are thinking hard about controls, risk management and compliance in financial services. The standard of discussion was high, the mix of familiar and new voices was strong, and every session shared a seriousness about where the industry is heading.

I moderated, facilitated and spoke across sessions on non-financial risk, financial crime and surveillance. What follows is my reading of the themes that emerged. I share them as themes rather than attributable comments, in keeping with the spirit in which these conversations take place.

AI as the organising question

AI on the agenda is no longer remarkable. What stood out in Singapore was how far it had become the organising question of every discussion, whatever the session was nominally about. Whether the topic was risk frameworks, financial crime or market conduct, the conversation returned to the same issue: AI is changing the risks firms face and the tools they use to manage them, at the same time.

Next-generation non-financial risk management

The non-financial risk sessions asked what next-generation NFR management looks like when AI-driven decisioning is reshaping organisations and also creating new non-financial risk. Risks are increasingly interconnected, and a failure in one area travels more quickly into others. That is changing how banks view the importance of their risk and control functions.

The tension running through the discussion was between cost reduction and effective governance. Advanced analytics, better-structured data and real-time intelligence promise higher productivity. The more interesting question is whether they can also help firms identify and manage risk earlier, rather than simply doing the same work at lower cost.

AML transaction monitoring: a contest on both sides

The discussion on the future of AML transaction monitoring had a sharper edge. AI is a tool for banks, and it is equally a tool for those seeking to compromise the financial system. Instant payments are pushing monitoring towards real-time or near real-time coverage, and crypto and digital assets are widening what must be monitored. The challenge is growing faster than many programmes were built to absorb, and AI is increasingly expected to solve all of it. That expectation deserves as much scrutiny as the investment behind it.

Surveillance: operating models, judgement and privacy

Surveillance followed a similar arc. The sessions covered new risks from round-the-clock trading and prediction markets, evolving regulation and persistent data challenges. The deeper question was about the operating model: where human expertise sits, what firms ask people to do, and how automation can support judgement rather than replace it.

Several panels also explored a second balance, between the surveillance needed to mitigate risk and the preservation of privacy. Proportionate surveillance means generating data only on activity that genuinely warrants review. As detection capability grows, that principle matters more, not less.

Regulatory expectations and the maturity curve

On regulation, the mood was telling. Regulatory engagement on AI was described as curious, positive and engaged, with modest expectations and little direction yet on enforcement or limits on use, the EU AI Act aside.

Firms, meanwhile, are following a recognisable maturity path. Teams usually start with efficiency and, as those gains bed in, begin to look for effectiveness. Communications surveillance is where this shift is most visible, with AI detection strategies surfacing genuine potential risks that lexicon-based approaches had missed.

The human question

Beneath all of these discussions sits a question about people. If AI is reshaping both the risks and the controls, what role are we asking our people to play, and are we being honest about whether they can play it? I will explore this in a forthcoming piece, including the growing debate about using humans as controls when AI is deployed.

For leaders across the three lines of defence, it is a question worth sitting with: how confident are you that the people in your control framework have the time, information and authority to exercise the judgement you are relying on?