Singapore

A mandatory AML compliance programme for a business institution operating in Singapore is a risk-based structure that compels businesses to detect and deter illicit financial flows through their systems. The AML compliance programme, which operates on a Three Lines of Defense approach, is controlled by MAS and mandates that business organizations conduct an enterprise-wide risk assessment (EWRA) that explicitly takes into account the risks of money laundering, terrorism financing, and Proliferation Financing (PF) as of 1 July 2025. Strict Customer Due Diligence (CDD) is mandated to authenticate customer identities and their ultimate beneficial ownership; failure to do so leads to suspension of accounts by day 30 and termination of all activities by day 120. In order to enforce this, the business organization is mandated to designate an AML Compliance Officer with full legal rights and access to all information so that he can conduct internal audits and file STRs with STRO within 15 business days. Failure to do so results in hefty liabilities, which could amount to a fine of S$1 million.

Regarding the requirement to keep AML records in Singapore, the law requires regulated entities to do so under the statutory obligation under the Corruption, Drug Trafficking and Other Serious Crimes Act 1992 (CDSA) and MAS notices. According to the regulation, all regulated companies are supposed to keep complete logs of financial and other data for the statutory period of no less than five years. The record-keeping system operates within two different timeframes – CDD/KYC documents, beneficial ownership proof, and corporate registry must be kept for five years since the end of the relationship, whereas transaction logs must be kept for five years after the completion of the transaction. The retained information must be sufficiently detailed to enable the reconstruction of the transaction by relevant agencies, including the Commercial Affairs Department (CAD), and must include the transaction value, date, and the accounts of the parties. While the records can be electronic as long as they can be used in Singapore courts, the countdown stops indefinitely as soon as any suspicious activities in the account begin to be investigated.

Customer Due Diligence (CDD), or the process of 'Know Your Customer' (KYC), is a legally binding and risk-based procedure that is regulated by the Monetary Authority of Singapore (MAS) to protect the financial system against the use of money laundering, financing of terrorism, and Proliferation Financing (PF). The process operates under primary regulations such as the Financial Services and Markets Act 2022, which prohibits any form of anonymity and mandates firms to identify individuals, verify corporate registers, and conduct a probe into shell structures to reveal ultimate beneficial owners who have a 25% or more shareholding. The regulatory framework operates through a risk-calibrated matrix, whereby low-risk entities are eligible for Simplified CDD, whereas high-risk segments such as politically exposed persons (PEPs) will lead to EDD. Firms are compelled to track the absolute Source of Wealth (SoW) of their clients and obtain senior management approval. This is done on a strict timeline whereby firms have a maximum of 30 days after onboarding to complete verification, have an immediate suspension of the account by Day 30, and terminate the account completely by Day 120.

The requirement for STRs in Singapore is a stringent statutory requirement under Section 39 of the CDSA, under which every corporation, financial institution, and individual must report any information about illegal financial dealings. The requirements are governed by the Commercial Affairs Department (CAD). They should be submitted through the online SONAR portal as soon as possible once any unusual activity is identified. There is a strict timeline within which the regulated organizations must undertake an internal process of escalating the matter and finally submitting the STR, not exceeding 15 days. In order to maintain the integrity of any ongoing financial investigation, there is a strict protocol of Anti-Tipping Off under Section 57 of the CDSA, whereby disclosure of the same to the client or any other individual constitutes a crime. Failure to comply with the above requirements attracts severe penalties. The individual will be held criminally liable with a fine of S$250,000 and imprisonment for up to 3 years, while the corporation will pay a fine of up to S$1 million per offense.

The statutory obligations for legal grounds, notices, and data subject rights in Singapore are necessary to ensure the effective protection of consumer privacy and, at the same time, the usefulness of data for companies under the Personal Data Protection Act 2012 (PDPA), regulated by the PDPC. Under the PDPA, the consent of an individual or implied is the legal basis for processing of data; however, companies may process data without consent using the specific exceptions like Legitimate Interests Exception provided the company conducts a risk assessment first. The Notification Obligation helps companies to give consumers notices that will provide an explanation of the specific reason for which data is collected before processing it. On the other hand, the Act gives consumers powerful data subject rights that will allow them legally to access their personal data records within the previous year, to correct errors urgently, to withdraw consent after giving adequate notice, and to use the Data Portability Right that allows them to move their data from one platform to another. Violation of the data subject rights and notice provisions will lead to heavy penalties for companies, up to 10% of their local annual turnover.

The mandatory data breach notification obligation in Singapore is a strict legislative requirement outlined in Part 6A of the PDPA and entails the systematic review of security breaches by private companies [PDPC]. Imposed by the PDPC, this legislation states that if an organisation becomes aware of a security incident, it must conduct a review within 30 days [PDPC]. Data breach notification is required if there is an effect on 500 or more individuals and the breach poses significant harm to those who have been affected (in terms of leaked credit card details, passwords, or NRIC numbers) [PDPC]. The data breach then becomes a notifiable one, and the company will have a very strict regulatory deadline in that it must notify PDPC as soon as possible but no later than 3 days after such conclusion [PDPC]. Individuals whose information has been compromised must also receive such a notice at the same time unless their information is encrypted [PDPC]. Non-compliance with the above results in strict penalties up to 10% of turnover in Singapore.