DGX Station GB300 for Financial Services: Private AI Without Sending Sensitive Data to Public APIs

A DGX Station GB300 lets a bank, insurer, wealth manager or fund run large language models on confidential data inside its own network instead of sending that data to a public AI API. That removes some questions, such as whether a hosted AI service counts as outsourcing for that workload. It does not remove technology-risk, data-protection or model-risk obligations; it moves them onto your own team. The practical answer is a reference architecture: put the Station in a restricted internal zone, front it with an AI gateway that authenticates, filters and logs every request, manage each model version like any other controlled system, and plan for the Station being a single point of failure. This post sets out that architecture. For the rules themselves, see should confidential financial data go into a public AI model.

What does a private-AI reference architecture look like?

Source: MAS Technology Risk Management Guidelines (18 Jan 2021); MAS Notices FSM-N05 and FSM-N06 (issued 9 May 2024, effective 10 May 2024; listed for banks); MAS Guidelines on Business Continuity Management (6 Jun 2022); MAS media release on Guidelines on AI Risk Management (7 Oct 2026); CSA publications; PDPA. All accessed 9 Nov 2026. This is a summary for planning, not regulatory advice.

Which rules shape the design?

Briefly: customer information is protected under section 47 of the Banking Act; the PDPA requires reasonable security arrangements (s24) and limits transfers overseas (s26); and MAS's Guidelines on Outsourcing (Banks) say MAS "considers CS operated by service providers as a form of outsourcing", which brings due diligence, audit rights and registers. MAS consulted on Third-Party Risk Management Guidelines on 6 Mar 2026 that would extend those expectations to all third-party services; they were still proposals at the time of writing. Running a model in-house takes that workload out of the outsourcing question. It puts it squarely under the TRM Guidelines and, from October 2027, the AI Risk Management Guidelines. We cover the policy case in data residency vs data sovereignty and keeping company intelligence on your own server.

Where should the Station sit on the network?

Treat it as a server, not a desktop. The Station has a ConnectX-8 network card with two 400 Gb/s ports, a 10GbE port and a separate 1GbE BMC port for remote management. A common layout is three zones:

• User zone: staff reach AI tools only through the gateway, never the Station directly.
• Restricted AI zone: the Station, its storage and the gateway's back end, with firewall rules that allow only the traffic each use case needs.
• Management zone: the BMC and admin jump hosts, reachable only by named administrators with MFA.

CSA's agentic-AI addendum suggests outbound allow-lists, sandboxing and least privilege; that guidance is advisory, but it maps well onto this layout. Some firms go further and run fully offline; see air-gapped AI workstations. Host-level controls are in our DGX Station security hardening checklist.

What should the AI gateway do?

The gateway is where most of the control lives. It should authenticate each user against your directory, issue a separate key per use case so you can see and switch off each one, log prompts and outputs to your SIEM with retention that matches your records policy, redact or block data that a use case isn't approved for, and rate-limit requests. For agent-style tools, CSA lists human-in-the-loop checks and prompt-injection guardrails among its suggested controls. Keep the logs out of reach of the Station's own administrators so that one person can't both run the system and edit its audit trail. Our post on building a private AI cloud on the Station covers the serving layer behind the gateway.

Running the model in-house removes the outsourcing question for that model. It does not remove the technology-risk, data-protection or model-risk questions.

How does model risk management apply?

MAS published its final Guidelines on AI Risk Management on 7 Oct 2026. MAS says they "apply to all FIs and all forms of AI technologies" in "a risk-proportionate manner", take effect on 7 Oct 2027 (Sections 5 and 6 by 7 Oct 2028), and that "FIs remain accountable for AI used in the services they deliver". Law-firm summaries describe expectations such as board oversight, an AI inventory, materiality assessment and life-cycle controls. For a Station, that translates into everyday practice:

• Record every model, its source, licence, version and approved use cases.
• Validate a model on your own test set before it goes live, and again after any change.
• Treat new weights, a new quantisation or a new prompt template as a change, with approval and a rollback copy.
• Review outputs for the use cases where errors would matter most.

Earlier MAS material still helps: the FEAT Principles (12 Nov 2018) and the open-source Veritas Toolkit 2.0 (26 Jun 2023).

What do three typical use cases need?

• KYC document review: customer identity documents are personal data under the PDPA. Keep the model's access to the case file, keep a human decision on every case, and log every request.
• AML alert narrative drafting: the model drafts the narrative; an analyst reviews and signs off, and the model can't close alerts. Restrict access to the investigations team.
• Research summarisation: internal research may be price-sensitive. Apply role-based access and your information-barrier rules to the gateway keys, not just the file shares.

These are illustrations of how controls attach to data, not a compliance checklist.

What about resilience and patching?

One Station is a single point of failure. The TRM Guidelines expect firms to set recovery time and recovery point objectives (8.2.1) and to use redundancy where high availability is needed (8.1.2). For banks, FSM-N05 sets an RTO of no more than 4 hours for each critical system and no more than 4 hours of unscheduled downtime in 12 months. Whether an AI workstation is a critical system is your firm's classification; most pilot use cases won't be, but design the fallback either way. Our post on what to do when the Station is a single point of failure covers fallback options. FSM-N06 asks banks to patch "within a timeframe that is commensurate with the risks", so the Station needs a patch owner and a test-then-deploy routine like any server.

Buying in Singapore

SourceIT lists DGX Station GB300 systems from ASUS, Dell, HP, MSI, GIGABYTE and Supermicro, supplied through each OEM's channel. Some OEM options matter to regulated buyers: Dell adds Ubuntu Pro, HP's model is RHEL-certified, and storage options and self-encrypting drives differ by OEM. See the Dell Pro Max with GB300, HP ZGX Fury G1n, ASUS ExpertCenter Pro ET900N G3, MSI XpertStation WS300, GIGABYTE W775-V10-L01 and Supermicro ARS-511GD-NB-LCC, all price on request. We help validate the configuration, prepare the end-user information suppliers request (KYC and EUC requirements explained) and coordinate delivery. For a private knowledge assistant on the same box, see building RAG on the Station. This article is general information, not legal or regulatory advice; confirm requirements with your compliance and legal teams. To get a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

Does running AI on a DGX Station make a financial institution compliant? No. Hardware doesn't make a firm compliant. On-premises AI changes which questions apply, removing the outsourcing question for that workload, but the TRM Guidelines, PDPA and, from October 2027, the AI Risk Management Guidelines still apply.

When do MAS's AI Risk Management Guidelines take effect? MAS published them on 7 Oct 2026. They take effect on 7 Oct 2027, with Sections 5 and 6 by 7 Oct 2028.

Is a hosted AI service outsourcing for a bank? MAS's Guidelines on Outsourcing (Banks) say MAS considers cloud services operated by service providers a form of outsourcing. Proposed Third-Party Risk Management Guidelines (consulted on in March 2026) would extend expectations to all third-party services.

Does the 4-hour RTO apply to an AI workstation? FSM-N05 sets a 4-hour RTO for systems a bank classes as critical. Whether a given AI system is critical is the bank's own classification.

Should the Station have internet access? Usually not directly. Put it in a restricted zone behind a gateway, keep the BMC on a management network, and allow-list only the outbound connections needed for updates, or run it offline.