A bank’s AI vendor review should follow the exact service, not the brand

Singapore’s new guidance and dated international evidence frame an onboarding-document service passport covering model identity, data, quality, change and exit.

A bank can buy an AI service faster than it can establish whether the service is suitable for a particular customer process. The demonstration usually shows what the model can produce. Procurement must establish something more demanding: who controls the information, which version is being evaluated, what happens when it changes and who remains accountable if the output is wrong.

The evidence is becoming more specific across regions. This article draws on three primary publications checked on 15 October 2026 and proposes a fictional vendor-review packet. It does not rank countries, compare commercial prices or claim that purchasing a particular platform resolves a bank's responsibilities.

Singapore's October guidance has future effective dates

[MAS issued AI risk-management guidelines on 7 October 2026](https://www.mas.gov.sg/news/media-releases/2026/mas-sets-out-supervisory-expectations-on-responsible-ai-adoption-by-financial-institutions). Its announcement describes institutional responsibility for third-party AI and proportionate controls. It also states phased expectations from 7 October 2027 and 7 October 2028. Publication this month is not the same as every provision already taking effect.

The [FSI paper published through BIS on 26 March 2026](https://www.bis.org/publications/fsi-insight-73-data-we-trust-emerging-policy-and-supervisory-approaches-ai-data-use-financial-services) examines data-related challenges and supervisory approaches. It is analysis by its authors, not a binding worldwide bank rule. Its discussion is a reason to investigate data dependencies rather than treat model selection as a standalone decision.

The [South African FSCA/Prudential Authority release of 24 November 2025](https://www.resbank.co.za/content/dam/sarb/publications/media-releases/2025/sarbfsca-ai-report/Artificial%20Intelligence%20in%20the%20South%20African%20Financial%20Sector%20Final.pdf) describes a report informed by a 2024 survey. Its adoption figures are historical respondent evidence, not a new October 2026 census. These records show different regulatory and research stages; they should not be collapsed into a global readiness score.

The fictional case: reviewing an onboarding-document service

Consider a fictional bank team in Singapore evaluating a service that identifies missing pages in business-account applications. The proposed system helps staff assemble a complete packet. It is not authorised to accept a customer, determine suspicious activity or replace the bank's identity-verification process.

The team begins with synthetic applications representing several document formats. Some contain a missing page, some an outdated certificate and some a complete packet whose scan is difficult to read. A test that only includes clean digital PDFs would answer a different question from the one staff face at the counter.

The vendor-review packet records the service identifier, model version, extraction component, permitted document categories and proposed hosting configuration. Avoid recording only a brand name. One brand may supply several models through several routes, while a gateway may silently change its underlying model. The bank needs to know what it actually evaluated.

Request evidence that answers the bank's question

Ask the supplier to explain how a page is classified as missing, unreadable or inapplicable. An empty field can have several causes. If the system converts all three into missing, staff may repeatedly request documents a customer does not need. A usable interface should preserve the distinctions and show the relevant source page.

Request the evaluation boundary: which languages, formats and scan qualities were tested, what constitutes an error and how unusual cases are handled. A vendor's general benchmark can be informative without validating this onboarding task. Similarly, a statement that a model is accurate does not tell the bank how often a complete packet will be unnecessarily delayed.

For confidential inputs, obtain clear answers about storage, retention, administrators and subcontractors. Record which assertions are contractually documented and which remain marketing claims. A short geographical label such as local hosting cannot explain every backup, support-access or logging arrangement. Those details should be assessed for the actual service configuration.

Build a review passport for the service

| Review area | Question for the fictional bank | Evidence status to preserve | | --- | --- | --- | | Identity | What exact model and extraction version was evaluated? | Identified or unresolved | | Data | What information leaves the bank and where is it retained? | Documented configuration or gap | | Task quality | Which missing-page cases fail? | Observed test result, not broad vendor promise | | Change | How is a model replacement notified? | Contracted process or assumption | | Exit | Can accepted records be retained and the service withdrawn? | Tested recovery route or untested plan |

This passport is an original design suggestion. It is not a regulator-issued checklist, a certification or proof that a bank meets applicable requirements. Its purpose is to make unresolved assumptions visible before the service becomes difficult to replace.

Compare accepted work, not only processing speed

During the fictional trial, compare the assisted packet with a staff-reviewed reference. Count overlooked missing pages and incorrect requests for additional material separately. Include the time staff spend inspecting uncertain results and the time customers would spend responding. A low model latency can coexist with a worse end-to-end process.

Do not turn a small trial into a statement about national productivity. The outcome depends on document mix, staff practices and which tasks the assistant may perform. Report the sample design and limitations. If the test uses synthetic records, say so; if it later uses permitted operational records, that needs its own information and review boundary.

Look for unequal performance across the supported formats and languages without assuming that a single aggregate number resolves fairness. An application with more difficult document scans may require extra review. The team should understand whether that burden falls systematically on certain customers and whether a manual route remains usable.

Plan for supplier and model changes

A useful contract is not the same as a functioning recovery path. Practise turning the service off while keeping staff able to open the original packet. Preserve the accepted document index and outstanding questions. A failure should not lose the customer's application or repeatedly request the same missing page.

Record the authorised service version in each evaluation. If the supplier changes a model, a gateway or an extraction engine, identify which targeted tests must be repeated. Existing acceptance should not automatically transfer to a different system simply because the interface looks unchanged. The proposed passport can hold the changed facts and the reasons for the next review.

Regional evidence should improve questions, not imitate rules

A South African institution can learn from Singapore's emphasis on third-party responsibility without claiming that Singapore's timetable applies locally. A Singapore team can read the historical South African survey without treating it as a measure of its own adoption. The useful exchange is a better question about data, evidence and service continuity.

Legal and supervisory applicability needs separate review for the institution and activity. This article does not provide a complete cross-border compliance map. Where an institution relies on a local requirement, retain the actual instrument, effective date and scope. Research papers and announcements should remain identifiable as such.

What this means for banking work

The new work includes supplier assurance, document-quality analysis, test-case design and clear communication of uncertainty. Staff who understand applications can identify errors an engineer might not anticipate. Engineers can make those distinctions survive extraction, model processing and screen design rather than disappear into a generic confidence score.

A student can build the passport with fictional suppliers and invented applications. Show one incomplete answer from a vendor and the resulting decision to limit the trial. That exercise teaches procurement judgment without needing an actual bank contract. Managers should protect time for workers to learn these skills and examine whether automation creates additional review burdens.

Follow the story through task-specific evaluations, changed supervisory instruments and documented operational outcomes. Procurement becomes more useful when it connects technical capability to a bank's actual process. This is educational analysis of AI service evaluation, not promotion of a provider, financial advice or a claim of verified regulatory compliance.

Workflow diagram and readable guide


Original diagram of a fictional worked example; not a regulator-issued checklist, compliance certification or actual deployment.

[Open the complete workflow diagram](/assets/financial-workflow-banking-vendors-20261015.svg)

Read the diagram

**Review the service, not just the brand**

A fictional onboarding-document review passport

1. **Exact service identity.** Which model, extractor and version?

2. **Data boundary.** Where do documents go and remain?

3. **Task evaluation.** Which missing-page cases actually fail?

4. **Change notification.** Who tells the bank when the model changes?

5. **Exit and recovery.** Can staff continue without this supplier?

**Boundary to retain.** Keep each answer as documented, observed or unresolved. A marketing claim is not a test result.

*Falcon World · Fictional educational example*