Singapore

A mandatory AML compliance programme for a business institution operating in Singapore is a risk-based structure that compels businesses to detect and deter illicit financial flows through their systems. The AML compliance programme, which operates on a Three Lines of Defense approach, is controlled by MAS and mandates that business organizations conduct an enterprise-wide risk assessment (EWRA) that explicitly takes into account the risks of money laundering, terrorism financing, and Proliferation Financing (PF) as of 1 July 2025. Strict Customer Due Diligence (CDD) is mandated to authenticate customer identities and their ultimate beneficial ownership; failure to do so leads to suspension of accounts by day 30 and termination of all activities by day 120. In order to enforce this, the business organization is mandated to designate an AML Compliance Officer with full legal rights and access to all information so that he can conduct internal audits and file STRs with STRO within 15 business days. Failure to do so results in hefty liabilities, which could amount to a fine of S$1 million.

Regarding the requirement to keep AML records in Singapore, the law requires regulated entities to do so under the statutory obligation under the Corruption, Drug Trafficking and Other Serious Crimes Act 1992 (CDSA) and MAS notices. According to the regulation, all regulated companies are supposed to keep complete logs of financial and other data for the statutory period of no less than five years. The record-keeping system operates within two different timeframes – CDD/KYC documents, beneficial ownership proof, and corporate registry must be kept for five years since the end of the relationship, whereas transaction logs must be kept for five years after the completion of the transaction. The retained information must be sufficiently detailed to enable the reconstruction of the transaction by relevant agencies, including the Commercial Affairs Department (CAD), and must include the transaction value, date, and the accounts of the parties. While the records can be electronic as long as they can be used in Singapore courts, the countdown stops indefinitely as soon as any suspicious activities in the account begin to be investigated.

Customer Due Diligence (CDD), or the process of 'Know Your Customer' (KYC), is a legally binding and risk-based procedure that is regulated by the Monetary Authority of Singapore (MAS) to protect the financial system against the use of money laundering, financing of terrorism, and Proliferation Financing (PF). The process operates under primary regulations such as the Financial Services and Markets Act 2022, which prohibits any form of anonymity and mandates firms to identify individuals, verify corporate registers, and conduct a probe into shell structures to reveal ultimate beneficial owners who have a 25% or more shareholding. The regulatory framework operates through a risk-calibrated matrix, whereby low-risk entities are eligible for Simplified CDD, whereas high-risk segments such as politically exposed persons (PEPs) will lead to EDD. Firms are compelled to track the absolute Source of Wealth (SoW) of their clients and obtain senior management approval. This is done on a strict timeline whereby firms have a maximum of 30 days after onboarding to complete verification, have an immediate suspension of the account by Day 30, and terminate the account completely by Day 120.

The requirement for STRs in Singapore is a stringent statutory requirement under Section 39 of the CDSA, under which every corporation, financial institution, and individual must report any information about illegal financial dealings. The requirements are governed by the Commercial Affairs Department (CAD). They should be submitted through the online SONAR portal as soon as possible once any unusual activity is identified. There is a strict timeline within which the regulated organizations must undertake an internal process of escalating the matter and finally submitting the STR, not exceeding 15 days. In order to maintain the integrity of any ongoing financial investigation, there is a strict protocol of Anti-Tipping Off under Section 57 of the CDSA, whereby disclosure of the same to the client or any other individual constitutes a crime. Failure to comply with the above requirements attracts severe penalties. The individual will be held criminally liable with a fine of S$250,000 and imprisonment for up to 3 years, while the corporation will pay a fine of up to S$1 million per offense.