This FAQ explains recent changes and what you must provide to stay compliant.
From 9 June 2025, new law requires Corporate Service Providers, including providers of business addresses and mail handling, to carry out enhanced due diligence. That means firms may ask for NRIC, signatures and an updated ACRA BizFile to verify identity and company status.
We aim to make the process simple. This page clarifies what documents are typical, who is affected, and why screening on a vetted global AML platform forms part of risk checks.
These checks apply to new sign‑ups and existing clients, even if you use limited services. Clear, consistent submissions reduce follow‑ups and speed onboarding. Submitted data is handled under PDPA‑aligned processes and shared only for legitimate compliance screening.
Key Takeaways
- Enhanced due diligence became mandatory on 9 June 2025 for CSPs.
- Typical items: identity documents, company paperwork and signatures.
- The rule affects new and existing users of address and mail services.
- Data is screened on a vetted global AML platform for risk assessment.
- Personal information is managed under PDPA‑aligned processes.
- Clear submissions speed up onboarding and avoid service disruption.
Understanding KYC and enhanced due diligence for virtual offices in Singapore
Understanding who benefits from a company is essential. KYC is the process of confirming who controls and benefits from a company and that the business using an address and related services is genuine.
What KYC means for every company using an address
KYC requires firms to check identity, review company documentation and verify directors and shareholders. CSPs cross‑check submitted details against ACRA BizFile and run global AML screening as part of verification.
Enhanced due diligence are deeper checks for higher risk profiles. This applies when ownership is complex, foreign control exists, or activity patterns look unusual.
The aim is not paperwork for its own sake. Proper checks protect clients, reduce identity theft and keep the business ecosystem clean.
When KYC is triggered
- Initial onboarding for new sign‑ups.
- Periodic refreshes for existing companies.
- Event‑based triggers such as changes to directors or shareholders, or atypical use of a service.
Complete, consistent documentation speeds approval and limits follow‑ups. Risk assessment combines ACRA cross‑checks with global screening so companies with foreign ownership may face longer review times, mirroring banking expectations.
virtual office singapore kyc requirements and the regulatory drivers behind them
Authorities increased scrutiny to protect the corporate ecosystem and deter misuse of registered entities.
Why government regulation requires verification
Regulators expect service providers to verify identity and business details to stop money‑laundering and other illicit operations using local companies.
This intent ensures that companies using an address or mail facilities are genuine and traceable.
What changed from 9 June 2025
The law made enhanced due diligence a formal obligation for all CSPs. Documentation checks grew deeper and wider, so providers now ask for more company records and identity evidence.
Why checks apply even to mail users
Even a client using only mail services creates a business presence. Providers must meet the same standards, so mail use can still trigger full verification.
Impact on onboarding and providers
Incomplete documentation will pause an application, delay approval and cause follow‑ups until compliance thresholds are met.
Non‑compliance risks heavy fines for providers, which explains the strict, time‑bound requests. Sooner or later, similar rules will affect all firms offering these services.
| Area | Effect | Action |
|---|---|---|
| Regulatory intent | Prevent misuse of companies | Verify identity and company records |
| Scope change (9 Jun 2025) | Broader and deeper checks | Enhanced due diligence applied to CSPs |
| Mail users | Still subject to checks | Submit required documentation |
| Onboarding | Delays if incomplete | Provide accurate documents early |
Documents and information typically required for verification
Providers rely on a small set of key documents to confirm who runs and benefits from a company.
Identity for directors and shareholders
Typical identity includes NRIC (where applicable) and passport copies for each director and shareholder. These items are checked for name, IC number and address consistency.
Company papers
Common company documentation includes recent ACRA BizFile extracts and a business profile. Providers match these records against submitted details to complete verification.
Proof of address and contact
Proof of residential address (utility bill or bank statement) helps confirm a director or UBO is resident where claimed. Include a clear email on filings for prompt contact.
Corporate structure and licences
For layered ownership or UBOs, supply ownership charts, registers and any documents showing complex shareholding within months of changes corporate activity.
“Provide up‑to‑date, legible scans to avoid delays and extra follow‑up.”
| Type | Examples | Typical currency |
|---|---|---|
| Identity | NRIC, passport | 1–3 months |
| Company | ACRA BizFile, business profile | 1–3 months |
| Address & contact | Utility bill, bank statement, email | 1–3 months |
| Structure & licences | Ownership chart, business licences, contracts | Depends on activity |
If you are unsure which documents need to be sent, reply to the KYC email or check our terms and conditions for more detail.
Why we request NRIC and signatures even when ACRA does not require submission
We ask for NRIC and signatures to link submitted documents to the real person who controls the company.
Cross-checking NRIC details against ACRA BizFile to reduce identity theft risk
NRIC is used to match name, registered address and ID number against ACRA BizFile records. This helps spot discrepancies early and reduces the chance that stolen identity information is used to set up a company.
Why signatures add an extra authentication layer
Signatures help confirm that the director or shareholder authorised the submission. Stolen or forged documents are harder to pair with a consistent signature, so this step deters impostors.
Consistency checks to prevent misuse
Small mismatches in details usually prompt a quick follow‑up rather than outright rejection. These checks stop illegal business operations before a service is activated and support our due diligence and compliance obligations.
“Provide clear scans, sign where requested and reply promptly to queries to avoid delays.”
| What we check | Why it matters | Action |
|---|---|---|
| Name, address, ID number | Confirms identity against ACRA BizFile | Supply NRIC and a recent ACRA BizFile |
| Signature | Authenticates who submitted documents | Sign consistently and submit readable copies |
| Document consistency | Prevents identity theft and illegal business operations | Clarify small mismatches quickly |
For help with corporate bank account matters linked to verification, see our guide on corporate bank account opening.
Timelines, validity windows, and what happens if you need more time
Clear timelines and validity windows help companies plan submissions and avoid service disruption.
How current your ACRA BizFile should be
Providers generally expect an ACRA BizFile issued within six months of the months date on the request. This helps confirm there have been no material changes to the company or its ownership.
If your subscription has lasted over a year, expect a fresh BizFile to be requested again.
Turnaround times and follow-ups
Straightforward cases with complete documents can reach approval within days once received.
Missing or outdated documentation usually triggers follow‑up queries and extends timelines. Banking‑related processes often run 4–8 weeks in total, so plan accordingly.
Requesting an extension without disrupting service
If you need more time, reply to the KYC email to request an extension and ask which documents are required for your company and business profile.
Confirming the exact list by email reduces back‑and‑forth and helps keep the service active while you gather papers.
When re‑verification is needed
Changes in corporate structure — new shareholders, updated UBOs or director replacements — can trigger re‑verification within months to keep records current and compliant.
“Prepare fresh, legible scans and reply promptly to email requests to avoid delays.”
| Item | Expectation | Typical outcome |
|---|---|---|
| ACRA BizFile | Within six months of request | Faster approval if current |
| Missing documents | N/A | Follow‑up queries; delayed approval |
| Extension request | Reply to KYC email | Temporary hold; service continuation if approved |
| Corporate changes | Notify provider within months | Re‑verification required |
How your data is handled, screened, and protected under PDPA-aligned processes
Read how we protect and screen your data while verifying company details against official records.
Step-by-step use of submitted materials
First, we perform verification by matching submitted identity and company papers with the ACRA BizFile record supplied.
Next, the same details go to a vetted anti-money laundering platform for automated checks and a human review.
What global screening reviews
Screening checks names of directors, shareholders and UBOs against sanctions, watchlists and adverse media.
The platform then issues a risk assessment used by compliance officers to decide on approval or further review.
PDPA-aligned handling and clear sharing boundaries
The screening provider complies with PDPA and international data protection rules and stores sensitive documentation securely.
We do not share client documents beyond the vetted screening platform used for analysis.
Controls, client expectations and trust
Access is limited to authorised reviewers and systems are purpose-bound to verification and screening only.
Prompt, complete submissions via email cut follow-ups and speed approval.
“Limited access, secure systems and purpose-bound use protect your company data throughout review.”
| Stage | Action | Outcome |
|---|---|---|
| Initial verification | Match docs to ACRA BizFile | Confirm company identity |
| AML screening | Check directors, shareholders, UBOs vs lists | Risk assessment for compliance |
| Data handling | Store on PDPA-compliant platform | Secure, purpose-bound access |
| Data sharing | Only to vetted screening partner | No third-party disclosure |
Conclusion
Enhanced checks are now routine for companies that rely on registered address and mail services.
Key takeaway: from 9 June 2025, new regulations make enhanced due diligence a normal part of running a singapore company that uses an address and mail service.
Practical next steps: prepare identity, current company records, proof of address and ownership details so your application moves to approval without delay.
Plan ahead. Keep records updated, expect re‑verification after changes and respond promptly to requests to maintain uninterrupted service.
If you expect bank account or payment scrutiny, demonstrate substance — for foreign‑owned firms, appointing a resident director or showing a physical office can reduce friction.
Need more time? Reply to the KYC email to confirm what to send or to request an extension.
FAQ
What does KYC mean for every company using a registered address and related services?
How does enhanced due diligence support anti‑money laundering compliance?
When is verification triggered for new sign‑ups and existing companies?
Why do regulators require corporate service providers to verify identity and business details?
What changed under the legislation that took effect on 9 June 2025?
Can verification rules apply if I only subscribe to mail handling services?
What happens to providers and clients if compliance is not met?
Which identity documents are typically required for directors and shareholders?
What company documents should be submitted to support verification?
Is proof of residential address required and what counts as acceptable evidence?
When must firms provide corporate structure evidence for complex ownership?
Under what circumstances are business licences and supporting materials requested?
Why do some providers request NRIC copies and signatures even when ACRA does not require submission?
How do signatures help in the due diligence process?
What consistency checks prevent illegal operations using stolen identities?
How current should an ACRA BizFile extract be for verification purposes?
What are typical turnaround times and follow‑ups when documents are missing?
How can I request an extension to obtain documents without disrupting services?
What corporate changes require re‑verification and within what timeframe?
How is submitted data used to verify against the national registry and assess risk?
What global screening platforms are used and what does “risk assessment” involve?
How is sensitive documentation shared and stored securely?
Dean Cheong is a Singapore-based B2B growth strategist and the CEO of VOffice. He helps companies scale revenue through sharper sales execution, CRM implementation, and go-to-market strategy, backed by a strong foundation in business banking and finance from Nanyang Technological University and a track record of driving sustainable, performance-led growth.