MFSA Dear CEO letter: AI governance, risk and prudential expectations

What it is

The MFSA’s Dear CEO letter titled Artificial Intelligence (AI) – Governance, Risk and Prudential Expectations was issued on 4 June 2026 by the Office of the Chief Officer Supervision. It sets out what the Authority expects of licence holders as they adopt AI, and attaches a self-assessment framework as Annex 1.

The letter draws on a cross-sectoral assessment of AI adoption the MFSA carried out in 2025. That exercise found that awareness of AI is growing but implementation is at an early stage. A significant proportion of firms have no formal or board-approved AI strategy, rely mainly on externally provided tools, particularly generative AI, and have limited internal expertise and governance to oversee AI. The MFSA reads this as low immediate systemic risk, with the danger that adoption accelerates faster than governance.

Who it applies to

All MFSA-supervised licence holders. The letter makes no distinction by sector or size, but expects arrangements to be commensurate with a firm’s current and anticipated use of AI.

What it requires

The letter sets out observations and expectations in five areas.

Governance and oversight. Boards and senior management keep effective oversight of AI and remain accountable for its use, including AI provided by third parties. Responsibilities for each AI system are clearly assigned, the firm has enough expertise to challenge and oversee AI, and roles across the three lines of defence are defined so that no single function has unchecked control over design, deployment and validation. The letter singles out AI that supports critical or important functions as understood under the Digital Operational Resilience Act (DORA), and AI used in processes that affect customers, financial decisions or market outcomes.

Third-party dependencies and concentration risk. AI-related outsourcing is treated under existing outsourcing and third-party risk frameworks. Firms keep enough control and understanding of externally provided AI, assess concentration risk and avoid excessive reliance on a small number of providers.

Model risk and reliability. AI is validated, tested and monitored, with controls to detect model drift and clear escalation routes. Firms must be able to understand, explain and evidence how AI systems operate where outputs influence financial or customer outcomes, keeping documentation, audit trails and model governance artefacts. Where a firm cannot explain or evidence a system’s behaviour, it should consider restricting or redesigning its use, particularly in higher-risk contexts.

Data governance. Data used by AI is accurate, relevant and validated, data flows are understood and documented, and use is consistent with regulatory requirements and internal policy.

Operational and systemic considerations. Firms take a forward-looking view, including system-wide effects of common models and shared providers, by assessing dependencies, identifying single points of failure and putting contingency measures in place.

The self-assessment. Annex 1, the AI-Enabled Process & Vendor Mapping Self-Assessment — Question Register, asks firms to identify AI use cases, map dependencies including third parties, and assess governance and controls. Its questions run from a complete inventory of business-critical processes and the tools used at each step, through vendor and fourth-party identification, AI capability classification and autonomy and materiality tagging, to data lineage, bias and drift monitoring, board management information, change control and kill switches, disclosure and human escalation for customer-facing AI, and fairness and financial exclusion. Each question lists the evidence a firm will need and what it must produce. Aicura’s guide to the MFSA AI self-assessment walks through it.

Key dates

• 4 June 2026. Dear CEO letter issued. The MFSA said AI will feature in thematic reviews and onsite inspections, with focus on governance frameworks, outsourcing, AI in customer-impacting processes and alignment with risk appetite, and that the Financial Supervisors Academy will offer AI training for firms.

How it relates to other frameworks

The letter sits alongside the EU AI Act, which the MDIA supervises in Malta, and existing EU financial rules on outsourcing and ICT risk, including DORA. Its themes of board accountability, inventory, third-party control, validation and monitoring are close to those in the MAS AI Risk Management Guidelines in Singapore, and map well onto an ISO/IEC 42001 management system.

A note on this page

This is Aicura’s reading of the MFSA’s letter. It is not legal or regulatory advice and it is not the letter itself. Read the letter and its annex on the MFSA website, and take advice on how they apply to your firm.