Singapore

MAS Notice 626 is a mandatory and legally binding regulatory notice from the Monetary Authority of Singapore (MAS) which requires all licensed banks in Singapore to have a complete risk-based framework for compliance with AML/CFT requirements. Under the Financial Services and Markets Act 2022, the structure of Notice 626 came into effect on 1st April 2024, and it replaced the previous 2015 baseline completely to set clear operational limits, such as the requirement for CDD process verification within 30 days post-onboarding and account closure within 120 days in case of non-compliance. This notice 626 underwent a significant amendment on 1st July 2025 that not only introduced PF detection alongside money laundering indicators but also established secure data-sharing processes through Singapore's centralized COSMIC platform. By imposing stringent rules about risk assessment, beneficial owner verification, and independent internal governance, MAS Notice 626 becomes an important compliance regulation aimed at safeguarding Singapore's banking system from international financial crimes and malpractices.

The MAS Technology Risk Management (TRM) Guidelines form an exhaustive supervisory guideline framework established by the Monetary Authority of Singapore (MAS) for technology risk management, protection of data, and ensuring cybersecurity within the financial sector [MAS TRM Guidelines]. Having been first introduced back in 2013 and significantly updated on January 18, 2021, the guidelines obligate financial firms to establish stringent IT governance at the board level, solid perimeter security controls, third-party risk management, and software development lifecycles [MAS TRM Guidelines]. The guidelines, as such, are highly flexible principles of expectation; however, they are backed up by legal means of enforcement in the form of statutory instruments such as Notice FSM-N05 under the Financial Services and Markets Act.

The Payment Services Act 2019 (PS Act) is a detailed and risk-focused statutory scheme passed by the Parliament of Singapore and overseen by the Monetary Authority of Singapore (MAS) regarding the regulation of payment systems and digital payment service providers. Having come into force officially on 28 January 2020, the Act harmonizes Singapore's financial environment through the consolidation of existing laws into one module and controls seven types of payment operations, including both domestic and international money transfers, as well as Digital Payment Token (DPT) services. To preserve balance between market flexibility and financial stability, the Act defines three different licensing tiers for companies – Money-Changing, Standard Payment Institution, and Major Payment Institution – depending on transactional volumes and size of operations. Promoting innovation and interoperability in FinTech, the PS Act applies strict compliance requirements, focused on Anti-Money Laundering (AML), high-level cybersecurity standards, and mandatory customer protection measures aimed at the safekeeping of users' money. The scheme proves to be highly flexible, with the most recent significant amendment taking effect on 4 April 2024 to expand custody and broker regulations related to crypto, and ongoing 2026 legislative changes to legalize stablecoins.

Cybersecurity Act 2018 serves as the most important legislative framework implemented by the Parliament of Singapore under the guidance of the Cyber Security Agency of Singapore (CSA) to enhance cyber resilience and secure Critical Information Infrastructure (CII) in nine vital sectors. The Cybersecurity Act came into force on 31 August 2018 and includes provisions relating to CII management, the Commissioner of Cybersecurity investigation power, public-private partnership for sharing threat intelligence and creation of licensing scheme for cybersecurity products/services such as penetration testing offered by private organizations. However, to meet the changing dynamics of cloud-based computing and digital supply chain systems, an important legislative amendment was formally adopted on 31 October 2025, wherein the scope of the Act has been expanded to include any virtual systems, third-party cloud service providers, and overseas-hosted infrastructure affecting local operations. With follow-up implementation policies such as the Cybersecurity Code of Practice of 2026, the Act requires strict compliance and security audit measures to secure Singapore's digital economy from advanced cyber challenges.

The Personal Data Protection Act 2012 (PDPA) is the main data protection legislation enacted by the Parliament of Singapore and governed by the Personal Data Protection Commission (PDPC) to ensure that private entities collect, use, disclose, and protect the personal information of individuals appropriately. Effective from 2 July 2014 in full, the Act defines the minimum data privacy standards, based on ten core obligations, which require stringent consumer consent, notification of the purpose of data use, implementation of data protection and cybersecurity measures, and appointment of a corporate Data Protection Officer (DPO). In response to the fast-developing digital economy, the regime was improved through significant amendments to the legislation, which made data breach notifications mandatory, while maximum fines were increased to 10% of the organization's annual turnover in the local market. After the improvements, the environment kept changing due to the March 2026 Regulations, which allowed authorized cross-border data transfers by implementing global frameworks, such as APEC CBPR, and set strict deadlines to implement an absolute ban on the use of NRIC numbers for digital authentication by 1 January 2027.

The Securities and Futures Act 2001 (SFA) serves as the primary, foundational legislation of capital markets in Singapore, which was passed by the Parliament of Singapore and enforced by the Monetary Authority of Singapore (MAS). The Act came into effect in a phased manner in 2002, serving as a consolidated rulebook for regulating four key areas in relation to the country's capital markets: market infrastructure (for example, Singapore Exchange), capital market intermediaries licensing through the Capital Markets Services License (CMSL), public offerings of investments, and strict market conduct to deter insider trading or market manipulation. For the sake of high liquidity levels as well as protection of retail customers, the SFA calls for prospectus disclosure requirements along with safe harbor provisions in case of transactions of Accredited Investors (AIs) and institutional clients. The legislative regime remains highly flexible and adaptive to current needs of market trading, and its last major update took place on 29 June 2026 in the form of the Securities and Futures (Amendment) Act 2026, to establish the dual-listing Global Listing Board regime and expand the retail preliminary prospectus distribution system.

The Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 (CDSA) serves as Singapore's key money laundering and asset recovery legislation. Run by the Ministry of Home Affairs and the Commercial Affairs Department (CAD), this legislation helps to prevent any syndicate from holding on to their ill-gotten gains. This legislation gives authority to the High Court to grant restraint, charge, and confiscation orders to prevent any suspect from realizing their property during legal proceedings. It requires a strong obligation to report any suspicious activity to the Suspicious Transaction Reporting Office (STRO) and reports about physical cash movement across borders beyond the sum of S$20,000. Any individual is subject to a fine up to S$500,000 and ten years' jail time whereas organizations face a penalty of S$1 million or double the amount of criminal benefit gained. This legislation is updated periodically in order to tackle the changing nature of financial crimes; the most recent update of the legislation was done through an amendment order dated 17 August 2026.

The Banking Act 1970 is the key legislation of the financial industry in Singapore, enacted by the Parliament of Singapore and enforced by the Monetary Authority of Singapore (MAS) as a licensing and regulation law for all commercial banks in the jurisdiction. Officially becoming effective on 1 January 1971, this Act ensures that depositors are protected and that there is systemic stability due to stringent prudential provisions, such as a S$1.5 billion minimum paid-up capital requirement for domestic banks and liquidity coverage ratios. It establishes a statutory obligation of confidentiality to customers in Section 47 (Banking Secrecy), with exceptions that are closely controlled to allow for financial crime automation and regulatory inquiries. In order to protect the domestic bank management structure, the statute requires any group to get ministerial approval in advance when trying to reach significant milestones of share ownership of 5%, 12% or 20%. The statute proves to be very flexible with regard to adapting to the modern economic challenges, and the latest amendments to it were made through the operational changes introduced on 4 September 2026.