![\"MEDIANAMA\"](\"https://www.medianama.com/wp-content/uploads/2024/05/cropped-logo-1.png\"){kind=logo}
![\"\"](\"https://www.medianama.com/wp-content/uploads/2022/07/CRN-Finance-FinTech-Digital-Payments-696.jpeg\")
\t\t\tSingapore’s central bank has already published the framework for AI agents in finance that India’s payments body said, at the same conference this week, it is still examining.
\n\n\n\nChia Der Jiun, Managing Director of the Monetary Authority of Singapore (MAS), told the Global Fintech Fest in Mumbai on September 11, 2026, that MAS and the financial industry had published SAFR — Safeguards for Agentic Finance at Runtime as a white paper in July. It sets out runtime safeguards including, in his words, “establishing an agent’s identity and authority, evaluating agent actions against controls before execution, and maintaining a clear audit record.” He spoke by video, saying he had fallen unwell before travelling.
\n\n\n\nWhy it matters: Those three things are almost exactly what the National Payments Corporation of India (NPCI) described as necessary a day earlier at the same event, when its non-executive chairman said the corporation was examining protocols to identify and authorise digital agents on the Unified Payments Interface (UPI). India has the position. Singapore has the document.
\n\n\n\nThat gap matters more than it normally would because the two countries are wiring their payment systems together.
\n\n\n\nWhat SAFR actually does, and what it does not
\n\n\n\nSAFR was published on July 3, 2026. Its central idea is a governance checkpoint sitting between an agent’s decision and the execution of that decision, so that no agentic action is carried out without first being declared, authorised and assessed.
\n\n\n\nIt is not binding. The paper states that the framework does not constitute regulatory guidance or supervisory expectations, and does not prescribe or anticipate future directions for either. It is a voluntary reference developed with industry.
\n\n\n\nSo this is not a case of Singapore having regulated where India has not. Neither jurisdiction has a rule. What Singapore has is a published, citable artefact that firms can build against, and that a regulator can later harden into guidance if it chooses.
\n\n\n\nWhat India has instead
\n\n\n\nIndia’s position on agents in payments is currently spread across statements and drafts rather than a single document.
\n\n\n\nNPCI’s chairman set out the architectural principle — that an agent may interpret intent, but authorisation and settlement must remain deterministic and auditable — without publishing a specification. Business Standard reported in July that NPCI was developing a Unified Agent Protocol, citing four people aware of the work. NPCI did not respond to that publication at the time.
\n\n\n\nSeparately, CERT-In has proposed human-in-the-loop controls for agentic AI actions above defined financial thresholds in its Digital Threat Report 2025-26. The Reserve Bank of India’s (RBI) model risk management document is out as draft guidance, which RBI Governor Sanjay Malhotra took care to point out this week is guidance and not regulation.
\n\n\n\nChia was complimentary about one Indian document. He said RBI’s Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) places accountability, fairness, resilience and trust at the centre, and called it an important contribution to safe and responsible adoption of AI in the global financial system.
\n\n\n\nThe question nobody has asked yet
India and Singapore are not two unconnected markets. Their Prime Ministers launched the UPI-PayNow linkage in 2023 — India’s first cross-border real-time payments link and Singapore’s second — and Chia said transaction volumes have more than doubled every year since.
\n\n\n\nBoth countries are also founding members of Nexus, the multilateral initiative that lets a payment system connect once to a common framework and reach several jurisdictions rather than building bilateral links each time. The two central banks signed a memorandum of understanding on digital asset cooperation in 2025.
\n\n\n\nThis raises a question neither regulator has publicly answered: if an AI agent can be authorised to transact on UPI under one set of conditions and on PayNow under another, what governs an agent-initiated payment that crosses between them? Whose authorisation rules apply, whose audit record counts, and who is accountable when an agent acting within its mandate in one jurisdiction causes a loss in the other?
\n\n\n\nFor a corridor whose volumes are doubling annually, and that both sides intend to multiply through Nexus, that is not a distant problem.
\n\n\n\nThe cyber numbers he put on the record
\n\n\n\nChia called this a watershed year for cybersecurity. He said high-severity Common Vulnerabilities and Exposures rose sixfold this year to 2,200, against the average of the preceding three years, and cited CrowdStrike reporting an 89% increase in what he described as AI-enabled cyberattacks.
\n\n\n\nCrowdStrike’s own framing of that figure, in its 2026 Global Threat Report, is an 89% increase in attacks by AI-enabled adversaries, a narrower claim about who is attacking rather than what the attacks are.
\n\n\n\nSuccessful breaches have not risen at the same rate, he said, which he attributed partly to model guardrails and partly to multilayered cyber defences still working. He described that as time bought rather than a problem solved.
\n\n\n\nQuestions MediaNama has sent
\n\n\n\n- \n
- Does NPCI intend to publish its agent protocol specification, and will it be open for public comment before it goes live? \n\n\n\n
- Has NPCI or the RBI examined SAFR, and is India’s approach expected to align with it? \n\n\n\n
- What governs an agent-initiated payment routed across the UPI-PayNow linkage, and has the question been taken up bilaterally? \n\n\n\n
- Does either central bank consider an agent’s identity credential issued in one jurisdiction valid in the other? \n\n\n\n
- Will Nexus participants be required to adopt a common position on agent-initiated payments? \n
MediaNama has written to NPCI, the RBI and MAS, and will update this story if they respond.
\n\n\n\nAlso read:
\n\n\n\n- \n
- GFF 2026: Scindia calls for a “Trust Grid” joining telecom, Aadhaar, UPI and bank systems \n\n\n\n
- RBI recognises Unified Fintech Forum as second fintech self-regulator at GFF 2026 \n\n\n\n
- AI agents can read intent, not approve payments: NPCI chairman at GFF 2026 \n
\n\n\nFor You\n
- \n
- Read Reasoned by Nikhil Pahwa: How AI is changing our world \n
- Sign up for MediaNama's Daily Newsletter to receive regular updates \n
- Sponsor a MediaNama Event \n