+65 64600199

Customer Due Diligence Requirements Singapore Business: Ultimate Guide

by | Jul 11, 2026 | Tax, GST & Compliance | 0 comments

customer due diligence requirements singapore business

Can a checklist truly protect a financial system, or does effective control need to be a continuous habit?

Singapore is a global financial hub with firm AML expectations from the Monetary Authority of Singapore. This guide explains practical customer due diligence requirements singapore business teams must meet across onboarding, screening, monitoring and reporting.

The content is aimed at compliance officers, operations leaders, founders and front‑line staff who handle onboarding and account servicing. You will learn why due diligence is not a one‑off task but a lifecycle discipline that begins before a relationship starts and continues through monitoring and review.

Expect clear comparisons of CDD, KYC and AML, plus guidance on risk‑based controls, sanctions and PEP screening, enhanced measures for higher risk profiles, and how to report suspicious activity without tipping off the subject.

Key Takeaways

  • Understand the lifecycle approach to CDD and how it differs from KYC.
  • Know which sectors face exposure beyond banks, including payments and real estate.
  • Adopt risk‑based controls and enhanced screening for high risk profiles.
  • Build a defensible evidence trail to reduce regulator findings.
  • Learn practical reporting steps and operational artefacts referenced to MAS and local regulators.

What customer due diligence requirements singapore business must meet in Singapore today

Regulators expect firms to verify identities, understand activity purpose, and spot risk before accounts are opened.

Why this matters for AML and preventing financial crime

Customer due diligence is the frontline defence against money laundering and broader financial crime. Verifying identity and the nature of a relationship makes it harder for criminals to hide behind false names or opaque entities.

How AML, KYC and CDD fit together in practice

Think of AML as the framework. KYC is the process of knowing who you deal with. CDD are the specific steps to identify, verify and assess beneficial ownership.

Who falls in scope beyond banks

Rules extend to many sectors. Typical groups include:

  • Payment service and digital token providers
  • Insurance, securities firms and brokers
  • Casinos, real estate agents and dealers of precious metals
  • Trust companies, corporate service providers, lawyers and accountants

Obligations follow a risk-based model: higher-risk relationships need deeper checks, more approvals and tighter monitoring. Even when tasks are outsourced, the regulated entity remains accountable for outcomes and evidence.

The next sections explain how regulators test effectiveness through audits, inspections and enforcement.

Singapore’s AML/CFT framework that drives due diligence obligations

Law and policy set clear expectations for how firms must prevent, detect and report illicit finance.

A professional business environment depicting Singapore's AML/CFT framework. In the foreground, a diverse group of business professionals in smart suits are engaged in a focused discussion around a large table filled with documents, laptops, and compliance-related materials. The middle shows a large whiteboard filled with flowcharts and graphs illustrating customer due diligence processes and compliance obligations. In the background, the skyline of Singapore is visible through large glass windows, bathed in soft natural light, creating an atmosphere of diligence and professionalism. The scene captures a sense of urgency and collaboration, emphasizing the importance of compliance and due diligence in the business sector. Photorealistic style, with attention to details in expressions and attire.

Core legislation forms the legal backbone. The Corruption, Drug Trafficking and Other Serious Crimes Act 1992 (CDSA) criminalises laundering and requires reporting of suspicious transactions and behaviours.

The National Anti‑Money Laundering Strategy (October 2024) raises the bar on system resilience. It focuses on prevention, detection, enforcement and stronger international cooperation.

What recent law changes mean in practice

The Anti‑Money Laundering and Other Matters Act (November 2024) equips authorities with sharper enforcement tools. It clarifies how property linked to suspected crime is handled and aligns casino AML/CFT with FATF expectations.

  • Operational duties: identify and verify parties, assess risk, monitor transactions, keep records and escalate suspicious activities promptly.
  • Why process matters: weak onboarding, unclear beneficial ownership or poor monitoring turn compliance into a paper exercise and invite enforcement.
  • Enforcement focus: inspectors often pursue process failures — late checks, weak documentation or missed alerts — even if no proven money laundering occurred.

Regulatory expectations reach into guidance, notices, inspections and sector rulebooks; the next section covers the regulators you will interact with.

Regulators and oversight bodies you may interact with

Knowing which regulator to engage with is the first practical step in building a defensible AML framework.

Monetary Authority of Singapore as integrated regulator

The Monetary Authority is the central bank and integrated regulator. It issues licensing, supervises financial institutions and publishes AML/CFT notices and guidance.

MAS can take enforcement action when firms fall short. Firms must keep dated forms, screening logs and escalation records that show how decisions were made.

Sector regulators that extend oversight

Oversight reaches beyond banks. Casinos, estate agents and corporate service providers are in scope because they can be misused for illicit flows.

  • Casino Regulatory Authority — casino AML/CFT controls and inspections.
  • Council for Estate Agencies (CEA) — real estate CDD rules and checks.
  • ACRA — oversight of corporate service providers, accountants and entity integrity.

Practical lens: identify your sector regulator first, map its rules to internal policy and ensure senior management owns governance and resourcing. That approach helps demonstrate compliance rather than assertions when inspectors review your audit trails.

Risk-based approach and Singapore’s National Risk Assessment

Singapore’s country-wide risk study gives practical signals for how to shape your onboarding and monitoring.

What the NRA is and how it guides your assessment

The National Risk Assessment (NRA) is MAS’s summary of country‑level threats from money laundering and terrorism financing. Use its findings to calibrate your risk assessment and set how deep identity checks and monitoring should be.

A photorealistic depiction of a corporate risk assessment meeting in a modern office setting. In the foreground, a diverse group of professionals, dressed in business attire, are gathered around a sleek conference table filled with documents and laptops. A woman with glasses points at a digital presentation displaying a colorful risk assessment chart. In the middle ground, a large window shows a vibrant city skyline, indicating Singapore's urban environment. In the background, a whiteboard filled with diagrams and notes about risk management strategies adds depth to the scene. Soft natural light floods the room, creating an atmosphere of focus and collaboration, with a lens angle that captures the dynamics of the meeting.

Key themes from recent assessments

The 2024 NRA called out digital payment rails, fast cross‑border transfers, organised fraud and misuse of legal persons. These themes increase velocity and layering risk and can hide true ownership.

Turning NRA signals into controls and resourcing

Translate national themes into product, channel and geography mappings. Document why a product scores higher and which triggers require enhanced review.

Risk theme Operational impact Example control
Digital payments High transaction speed increases layering Real‑time monitoring for rapid in/out flows
Cross‑border transfers Higher AML exposure from foreign corridors Stronger originator checks and geofencing
Misuse of legal persons Obscured beneficial ownership Deeper BO verification and corporate onboarding

Escalate profiles that match multiple NRA flags to higher tiers and require enhanced due diligence and more frequent reviews. Record inputs and outputs clearly so regulators can follow your rationale for resourcing, controls and testing cadence.

Core CDD steps: collecting and verifying customer information

Effective onboarding begins with clear identity and entity checks that can be defended under audit.

Minimum identification data

Individuals: full name, ID or passport number, residential address and nationality.

Entities: registered name, registration number, registered address, directors and authorised signatories. For companies, an up‑to‑date ACRA profile or certificate of incorporation is typical evidence.

Verification standards and evidence

Use reliable, independent sources to verify identity. Examples include NRIC/passport checks for individuals and registry extracts for entities.

Record what was validated, when and by whom. This makes the cdd process transparent and auditable.

Purpose, beneficial owners and documentation

Capture the intended nature of the relationship so future activity can be assessed against expectations.

Map ownership and verify beneficial owners and controllers to mitigate shell‑company risk. Keep copies, screenshots or references to databases, note any discrepancies and save approvals.

Timing and quality controls

Complete customer due diligence before the relationship starts, except where documented, controlled exceptions apply.

  • Periodic file reviews and second‑line checks for higher risk profiles.
  • Regular testing to ensure the cdd process works in practice.

For related privacy handling, see our privacy policy.

Screening requirements: sanctions, politically exposed persons and adverse information

Screening is a continuous control that catches sanctions hits, PEP linkages and adverse media before risk crystallises.

A diverse group of four business professionals in a modern office setting, all dressed in formal business attire, engaged in a discussion about compliance. In the foreground, a middle-aged Black woman holding a tablet with charts, a South Asian man pointing at a document, and a Hispanic woman with a laptop. In the background, large windows show a city skyline, casting soft natural light over the room. A bookshelf with law and finance books lines one wall, adding to the atmosphere of professionalism. The scene conveys a serious yet collaborative mood, emphasizing the importance of screening and compliance in their roles.

Sanctions screening is an operational must. Organisations must screen records and related parties at onboarding and on a recurring basis against global lists and national designations. Document matches, false positives and final decisions so an auditor can follow the trail.

Sanctions list coverage in practice

Coverage should include consolidated international lists, local designations and sector‑specific watchlists. Run matches for beneficial owners, directors and authorised signatories as well as primary profiles.

Politically exposed persons and connected parties

Identify whether the individual, beneficial owner or key controller is a politically exposed person. Extend checks to close associates and family where policy dictates.

For PEP relationships, firms must obtain senior management approval to onboard or continue the relationship. Reasonable measures to establish source of wealth and source of funds are required, with enhanced monitoring for unusual activity and prompt reporting of suspicious activities without tipping‑off.

When senior management approval is required

Triggers include onboarding a PEP, maintaining a relationship with an exposed person, high‑risk corporate structures, or exception requests to risk appetite. Record the approval, the rationale and any monitoring uplift applied.

Practical workflow for potential hits:

  • Triage the match and corroborate identifiers (DOB, ID, address).
  • Check adverse media and law enforcement‑relevant indicators from credible sources.
  • Escalate confirmed concerns to compliance for decision: accept with controls, reject or exit.
  • Document rationale, approvals and monitoring steps taken.
Screening element Who to screen Operational action
Sanctions lists Primary profile, BOs, signatories, counterparties Automated matches, manual review, record decisions
PEP databases Individuals and connected persons Enhanced checks, source of wealth checks, senior approval
Adverse media Applicants and related parties Corroborate with reliable sources, adjust risk score

Screening is integral to broader cdd and aml controls. It informs whether standard measures suffice or if enhanced due diligence must conduct. For regional coverage and guidance, see local monitoring resources.

Enhanced due diligence and higher-risk scenarios

When risk elevates, firms must move beyond basic checks to targeted, evidence‑based verification.

What enhanced measures mean: enhanced due diligence (EDD) requires additional checks and deeper verification beyond standard customer due processes. It helps manage elevated money laundering and terrorism financing risk and is expected for high‑risk profiles and non‑face‑to‑face channels.

Common triggers for extra scrutiny

  • Connections to higher‑risk jurisdictions or opaque ownership structures.
  • Rapid cross‑border flows, cash‑intensive activity or layered holding entities.
  • PEP links, adverse media, or an unclear purpose for the relationship.

Source of funds versus source of wealth

Source of funds explains where specific money originated; reasonable measures include bank statements, payment receipts or contract copies.

Source of wealth explains overall means of accumulation; reasonable measures include tax returns, sale agreements or audited accounts that corroborate the profile and activity.

Controls for non‑face‑to‑face and digital onboarding

Apply stronger identity verification, device and behavioural checks, and fraud‑resistant KYC flows. Add monitoring rules for synthetic IDs and account takeover indicators.

EDD raises approval thresholds, mandates more frequent reviews and tighter alerting. If residual risk cannot be mitigated, clear exit criteria should apply. For practical references on enhanced due processes see enhanced due diligence guidance and review your terms and conditions to align approval workflows.

Ongoing monitoring, suspicious activities and reporting obligations

Sustained oversight of relationships helps detect evolving risk and prevents escalation.

A professional office setting dedicated to "ongoing monitoring" of financial activities, featuring a diverse team of three business professionals in smart business attire. In the foreground, one person monitors data on a large screen displaying graphs and suspicious activity alerts, their focused expression highlighting the urgency of the task. The middle ground features another professional working on a laptop, surrounded by documents and compliance checklists, while the third member engages in discussion over a conference table cluttered with reports. The background shows floor-to-ceiling windows with a city skyline, indicating a modern corporate atmosphere. Soft, natural lighting illuminates the scene, creating a serious yet collaborative mood, while the lens captures the action at a slight angle for dynamic perspective.

Keeping CDD current and operational monitoring

Ongoing monitoring is a continuous control. Keep profiles up to date, refresh documents by risk tier and rerate when triggers occur — for example new owners, products or unusual transactions.

Operationalise monitoring with scenario alerts, periodic reviews and a clear investigation playbook. That turns noise into decisions supported by evidence rather than unchecked alerts.

Red flags for suspicious transactions and behaviours

Watch for activity that conflicts with the stated purpose, rapid in‑and‑out movements, unexplained third‑party flows or sudden counterparty changes.

  • Layering via multiple entities or complex routing.
  • Repeated large value transactions inconsistent with profile.
  • Unusual payment patterns or frequent cash‑like transfers.

When and how to report suspicious activity to the STRO

If an alert uncovers credible concern, file an STR promptly to the Suspicious Transaction Reporting Office with clear context: identifiers, transactions, rationale and supporting evidence.

Ensure internal escalation timelines are defined so compliance teams can decide and act without delay.

Avoiding tipping-off and managing retain vs exit choices

Do not inform the subject that an STR is under consideration or filed. Control communications to prevent tipping‑off and preserve investigative integrity.

If the relationship is retained, require enhanced scrutiny: transaction limits, more frequent reviews and senior approval. Record the rationale and mitigation so auditors can trace the decision.

Sector-specific expectations for Singapore businesses

Sector rules shape how controls are applied day to day and change the detail behind a standard policy.

Financial institutions and payment providers

Monetary Authority Singapore issues sector notices that firms must follow. Examples include MAS Notice 626, 1014 and 824 for banks and finance firms, plus PSN01 and PSN02 for payment and digital token services.

Expect robust onboarding controls, continuous monitoring, screening and clear governance for higher‑risk profiles. Align product rules to formal notices and record decisions.

Insurance, securities and other regulated firms

For insurance companies and securities firms, identity checks and BO verification must suit policy types and distribution channels.

Tailor monitoring to portfolio behaviour rather than treating every account the same.

Real estate, casinos and trust services

Real estate salespersons must complete cdd before any property agreement is signed. Date the Customer’s Particulars Form and obtain written acknowledgement.

Common lapses include late screening and missing beneficial owner identification for company clients.

Casinos and designated dealers now face a S$4,000 CDD threshold. That lower trigger increases the number of transactions needing fast, consistent checks.

Trust companies and corporate service providers must verify company existence (for example, an ACRA profile) and map ownership to prevent misuse of legal persons.

Building a defensible compliance programme: policies, training, recordkeeping and technology

A defensible compliance programme starts with policies that map to how work actually gets done across teams.

Policy, governance and the compliance lead

Clear policies must reflect sector rules and everyday workflows. Procedures should be testable and produce traceable outcomes for audits.

The compliance officer owns the AML framework, approves exceptions, oversees investigations and handles regulator interactions.

Training and culture

Train staff at onboarding and run annual refreshers. Focus on KYC steps, red flags, escalation routes and tipping‑off risks.

Records and retention

Keep identification files, account records, screening logs and analysis outputs. Retain records for at least five years after the relationship ends or the last transaction.

Automation, monitoring and outsourcing

Automate screening and transaction monitoring where volumes justify it. Tune rules to lower false positives and document testing results.

Operational tasks may be delegated, but institutions retain final accountability for adequacy, decisions and regulator‑facing evidence.

“Policies, people and tech must create a coherent know customer view that supports ongoing risk decisions.”

Conclusion

Clear identity checks and ongoing monitoring form the backbone of any resilient anti‑money laundering programme.

Customer due diligence must be risk‑based and practical. Effective cdd combines identity verification, beneficial ownership clarity, screening and continuous review. Strong controls help institutions spot money laundering early and protect reputation and revenue.

Good practice means onboarding completed at the right time, evidence retained, and monitoring aligned to expected activity. Investigate suspicious patterns quickly, escalate consistently and report to STRO without tipping‑off.

Operationalise this guide: review workflows, map obligations to sector regulators, update policies and training, validate vendors, and schedule periodic testing so safeguards remain effective as risks evolve.

FAQ

What are the key legal instruments that shape anti‑money laundering obligations in Singapore?

The principal laws are the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act and the Terrorism (Suppression of Financing) Act, supported by MAS Notices and Advisories. These set out identification, screening, reporting and record‑keeping duties that financial institutions and other regulated sectors must follow.

Why does robust identification and verification matter for preventing financial crime?

Accurate identification and verification help stop illicit funds entering legitimate channels. They enable firms to assess risk, detect suspicious transactions and make timely reports to the Suspicious Transaction Reporting Office (STRO), reducing exposure to money‑laundering, terrorist financing and sanctions breaches.

How do KYC, AML and CDD relate in practice?

KYC (know your client) is the practical process of gathering identity and purpose information. AML (anti‑money laundering) is the broader legal and policy framework. CDD (customer due diligence) is the formal set of steps—identification, verification, risk assessment and ongoing monitoring—that implements KYC within AML obligations.

Which sectors beyond banks must apply these controls?

Designated businesses and professions include payment service providers, insurers, securities firms, trust companies, corporate service providers, real estate agencies, casinos and certain high‑value dealers. MAS and sector regulators extend expectations across these industries.

What role does the Monetary Authority of Singapore play in oversight?

MAS is the integrated financial regulator. It issues Notices, conduct expectations and enforcement actions. It also supervises banks, insurers, payment firms and other licensed entities to ensure compliance with AML/CFT rules and sound risk management.

How does the National Risk Assessment (NRA) affect internal risk frameworks?

The NRA identifies vulnerable sectors and typologies. Firms must align their risk assessments and controls with those national findings, using them to prioritise resources, tailor monitoring and strengthen controls where the NRA highlights higher threats.

What minimum identification data should be collected for individuals and legal entities?

For individuals, firms should capture full name, date of birth, national identity or passport details, address and verification evidence. For entities, collect legal name, registration number, business address, ownership structure and supporting corporate documents to confirm status and controllers.

What counts as reliable verification evidence?

Reliable sources include government‑issued IDs, corporate registries, audited financial statements, certified incorporation documents and independent electronic verification from trusted providers. Records should be sufficient to withstand audit and regulatory review.

How should beneficial owners and controllers be identified?

Identify natural persons with ultimate ownership or control, typically those holding a defined percentage of shares or voting rights, or exercising control by other means. Verify identity and documentary proof, and escalate when ownership is obscured by complex structures.

When must sanctions and adverse media screening be performed?

Screening should occur at onboarding and at regular intervals thereafter, proportionate to risk. Coverage must include UN, EU, US and relevant national lists, plus adverse media checks to detect reputational and sanction‑related risks.

Who is considered a politically exposed person (PEP) and what extra measures apply?

PEPs are individuals entrusted with prominent public functions, plus their close associates and family members. Firms must apply enhanced measures, verify source of wealth, obtain senior management approval for relationships, and perform more frequent monitoring.

What triggers enhanced measures for higher‑risk relationships?

Triggers include PEP status, business with high‑risk jurisdictions, complex ownership chains, large or unusual transactions, and non‑face‑to‑face onboarding. Enhanced measures involve deeper verification, more evidence on funds provenance and stricter transaction scrutiny.

What are practical expectations for confirming source of wealth and source of funds?

Reasonable measures include reviewing salary records, sale or investment proceeds documentation, tax returns, corporate financials or trust deeds. The depth of evidence should match the assessed risk and be sufficient to explain how funds were legitimately acquired.

How should firms manage non‑face‑to‑face onboarding and digital channels?

Implement stronger identity verification (biometrics, secure video calls), enhanced authentication, transaction limits, and real‑time monitoring. Ensure technology providers meet reliability and audit standards and maintain clear audit trails for decisions taken.

What does ongoing monitoring involve?

Ongoing monitoring includes periodic reviews of identity and risk profiles, transaction monitoring for unusual patterns, refreshing documentation when circumstances change, and escalating suspicious activity for investigation and reporting.

What are common red flags for suspicious transactions?

Red flags include complex or circular funds movements, transactions inconsistent with declared business activity, use of shell entities, rapid movements through multiple jurisdictions, and frequent large cash‑like transactions without economic rationale.

How and when should suspicious activity be reported to STRO?

Report promptly when a firm forms a reasonable suspicion of money‑laundering or terrorist financing. Reports must be filed in the prescribed format to STRO. Do not delay reporting while seeking further confirmation if suspicion is reasonable.

What is tipping‑off and how should it be avoided?

Tipping‑off occurs when a firm alerts a subject that they are under investigation or that a report has been made. Prevent this by restricting internal disclosures, training staff, and ensuring external communications do not reveal investigative actions.

What sector‑specific rules should payment service providers and banks follow?

They must comply with MAS Notices on AML/CFT, maintain robust transaction monitoring, screen against sanctions, carry out CDD and enhanced checks for higher‑risk customers, and retain records for the statutory period.

What particular expectations apply to real estate agencies and salespersons?

Real estate agents must verify parties to transactions, assess source of funds for substantial payments, retain transaction records and report suspicious transactions promptly. Timing of checks is critical at offer, exchange and completion stages.

How should trust companies and corporate service providers guard against misuse of legal persons?

They should map ownership structures, identify ultimate beneficial owners, carry out enhanced checks on complex structures, and refuse or exit relationships where opacity or high risk prevents adequate assurance.

What elements make a defensible compliance programme?

A defensible programme includes clear written policies, an empowered compliance officer, proportionate risk assessments, regular staff training, documented procedures, reliable record‑keeping and fit‑for‑purpose technology for screening and monitoring.

What are best practices for staff training and culture of compliance?

Provide role‑specific training, scenario‑based exercises, and regular refreshers. Encourage prompt reporting, protect whistleblowers and demonstrate senior management commitment through clear governance and oversight.

How long should records be retained and what must be preserved?

Retain identification, transaction and screening records for the regulatory retention period—typically five to seven years—plus any records relevant to ongoing investigations. Ensure documents remain retrievable and tamper‑proof.

Can firms outsource parts of the verification process and what remains their responsibility?

Firms may outsource verification, screening and monitoring to competent providers, but they retain ultimate responsibility for compliance. They must conduct due diligence on vendors, maintain oversight, and ensure service levels meet regulatory standards.

How can automation reduce false positives without missing genuine risks?

Use risk‑based tuning, layered rules, machine learning models where appropriate, and periodic validation of algorithms. Combine automated alerts with human review to filter false positives while ensuring high‑risk cases receive prompt attention.

Submit a Comment

Your email address will not be published. Required fields are marked *