Fix AML gaps in 180 days: MAS playbook for Singapore firms
AML/CFT obligations in Singapore are binding law, not best-practice guidance, and they are enforced by the Monetary Authority of Singapore (MAS) alongside the Ministry of Home Affairs (MHA). Every obligated entity must run four controls at minimum: customer due diligence (KYC/CDD/EDD), beneficial ownership verification, transaction monitoring, and suspicious transaction reporting (STR) or cash transaction reporting (CTR). Get any one of these wrong and you are looking at supervisory action, fines, or worse.
TL;DR:
Singapore’s AML regime applies to a broad range of entities beyond banks, including payment providers, virtual asset service providers, and law firms, with direct supervision from MAS or ACRA.
Critical controls include verifying beneficial owners through a 25% ownership threshold, monitoring transactions in real time, and filing CTRs within 15 days, with enhanced due diligence required for high-risk customers.
Enforcement is active, with Singapore conducting numerous investigations tied to cyber fraud, but firms must demonstrate actual use of controls rather than just policy documentation to avoid supervisory issues.
A structured compliance plan should fix critical gaps within 30 days, retune monitoring in 90 days, and undergo independent audits by 180 days, with record-keeping and management reporting essential throughout.
AML data collection and retention must align with PDPA rules by limiting access, encrypting records, and establishing clear data disposal schedules, preventing over-retention and security breaches.
Table of Contents
Aml compliance singapore: the legal framework you cannot ignore
Singapore’s AML compliance regime rests on three statutes and a layer of binding regulatory instruments sitting on top. The Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act (CDSA) is the foundational criminal statute; it defines money laundering offences and gives authorities the power to freeze and confiscate proceeds of crime. The Terrorism (Suppression of Financing) Act does the equivalent job for terrorism financing. The Financial Services and Markets Act 2022 (FSM Act) modernised MAS’s supervisory toolkit, giving it cross-sectoral powers to issue directions, impose penalties, and pursue individuals as well as firms.
None of that is optional reading. MAS translates these statutes into operational requirements through its Notices, and Notices are legally binding, not advisory. MAS requires financial institutions to identify and verify customers and beneficial owners, run ongoing monitoring, and file suspicious transaction reports, with the specific mechanics set out sector by sector.
Two Notices matter most in practice:
MAS Notice 626 governs banks, setting out customer due diligence triggers, enhanced due diligence obligations, and record-keeping requirements that examiners test against directly.
MAS Notice PSN01 and PSN02 apply the same architecture to payment service providers, with due diligence, monitoring, and enhanced due diligence tailored to payment business models, including wire transfer screening and cross-border transaction controls.
Coordination across government runs through the AML/CFT Steering Committee. MHA describes Singapore’s approach as whole of government, with the Steering Committee setting national policy objectives and coordinating operational responses across law enforcement, financial supervision, and trade regulation. If your compliance team has never looked at the MAS or MHA policy pages directly, start there rather than relying on secondary summaries. Notices amend regularly, most recently through a 2025 consultation covering proposed changes to Notices 314, 626, 824, and PSN01/02.
Who has to comply with Singapore’s AML rules?
The obligation net is wider than most business owners assume. It is not just banks.
Banks and merchant banks, supervised directly by MAS under Notice 626 and equivalent instruments.
Payment service providers and e-money issuers, licensed under the Payment Services Act and supervised against PSN01/PSN02.
Virtual asset service providers (VASPs), brought squarely into scope given their fraud and laundering exposure.
Trust companies, corporate service providers, and law and accountancy firms acting as designated non-financial businesses and professions (DNFBPs).
Sector supervision splits across bodies. MAS supervises financial institutions and payment firms directly. ACRA oversees corporate service providers on the corporate governance side. The Suspicious Transaction Reporting Office (STRO) functions as Singapore’s financial intelligence unit, receiving reports regardless of which regulator supervises the filer. Variable Capital Companies (VCCs), unregistered foreign companies operating locally, and trustee arrangements each carry Notice-specific nuances, so check the applicable instrument before assuming a general rule covers your structure.
What controls does an AML compliance programme actually need?
Four operational pillars sit underneath every credible programme, and MAS expects to see them working, not just documented.
Customer due diligence (CDD). MAS sets out four standard triggers: onboarding a new customer, conducting an occasional transaction above a set threshold, executing a wire transfer, and any point where suspicion of money laundering arises regardless of exemptions elsewhere. Verification has to happen before, or in narrowly defined cases shortly after, the relationship begins.
Beneficial ownership. The look-through threshold is 25% ownership or control. Layered ownership structures and trusts are where most programmes fail, verification stops at the immediate registrant instead of tracing through holding companies to the natural person behind them. Proper look-through demands corporate-structure analysis and documentary corroboration of source of funds, not a signed declaration filed and forgotten.
Transaction monitoring and reporting. Alerts need regular tuning against actual typologies, not factory settings left untouched for years. Cash transaction reports (CTRs) for transactions above S$20,000 must be filed within 15 business days through STRO’s SONAR platform. Suspicious transaction reports carry no fixed deadline in the same way, but supervisory expectation is that you file as soon as practicable once suspicion crystallises, not once you have built a perfect case file.
Sanctions screening. Firms must screen against UN Security Council lists and domestic sanctions notices, with screening run at onboarding and refreshed against list updates, not annually.
Enhanced due diligence (EDD) kicks in for politically exposed persons (PEPs), customers connected to high-risk jurisdictions, and complex or unusually structured transactions. Adequate evidence means source-of-funds and source-of-wealth documentation that would satisfy an examiner asking “how do you know this money is clean,” not a client’s own assurance.
Pro Tip: Build your EDD file the way you would build a case for a sceptical auditor, corroborating documents and independent verification, not just what the customer tells you. Examiners test evidence, not intentions.
How strict is enforcement in Singapore’s AML regime?
Singapore’s law enforcement machinery has been busy. The 2026 FATF/APG mutual evaluation reports that Singapore opened a very large number of money laundering investigations in the last five years, with a significant majority initiated from cyber-enabled fraud complaints. That single figure should reorder your risk assessment: fraud-linked typologies deserve more monitoring attention than most legacy programmes give them.
The same evaluation found Singapore has strong institutional coordination but needs more demonstrable, risk-based enforcement outcomes, meaning firms are increasingly expected to show that controls are actually used in decision-making, not merely documented in a policy binder. Common supervisory findings echo this: weak beneficial ownership discovery, EDD files that stop at collecting a passport copy, and monitoring rulesets that have not been retuned since implementation.
Exposure under the FSM Act runs from financial penalties through to continuing fines for unresolved breaches, and senior management can face personal liability where oversight failures are clear. Regulators reward firms that can produce a paper trail showing judgement was exercised, escalations were reviewed, and remediation happened on a timeline.
What should your AML compliance checklist cover in the next 180 days?
Compliance programmes stall when everything feels urgent at once. Sequencing matters more than ambition.
Days 1 to 30: Fix critical CDD files with missing verification, run a full sanctions list check against your entire customer base, stress-test your STR filing process end to end, and appoint one senior owner accountable for the programme.
Days 31 to 90: Retune transaction monitoring rules against real typologies, remediate beneficial ownership gaps flagged in step one, document EDD procedures formally rather than relying on institutional memory, and run staff training that covers real case scenarios, not generic slides.
Days 91 to 180: Commission an independent audit of the whole programme, update policies to reflect what the audit finds, formalise a third-party reliance framework where you depend on introducers or group entities for CDD, and consider engaging with COSMIC, MAS’s platform for collaborative sharing of red-flagged information across financial institutions, or the AML/CFT Industry Partnership (ACIP) for sector-level intelligence.
Governance sits underneath all three phases: retain records for the statutory period, report programme health to the board on a fixed cadence, and run periodic testing and scenario exercises rather than waiting for an examination to find the gaps first.
Pro Tip: Keep a single, dated log of every remediation action taken. When MAS asks “what have you done about this,” a chronological log with names attached is worth more than any policy document.
Does AML compliance clash with PDPA data protection rules?
AML controls demand you collect and retain identity documents, transaction records, and source-of-wealth evidence, sometimes for years. Singapore’s Personal Data Protection Act (PDPA) governs how that same data must be handled, and the two regimes are not in tension when applied correctly, they run in parallel with different justifications.
PDPA permits collection and retention of personal data without fresh consent where the collection is required or authorised under law, and AML obligations under MAS Notices and the CDSA qualify. The practical risk is not that AML compliance breaches PDPA, it is that firms over-retain data beyond what AML rules require, or fail to secure it to PDPA’s protection standards once collected. A beneficial ownership file that sits on a shared drive with no access controls is a PDPA problem even though collecting it was lawful.
Practical steps worth building into your programme: limit access to CDD and EDD files on a need-to-know basis, encrypt records containing source-of-wealth documentation, and set a defined retention and disposal schedule tied to the statutory minimum rather than “keep everything forever.” Cross-border data transfers, common where beneficial ownership tracing touches overseas holding structures, need their own PDPA-compliant transfer mechanism. Treat data protection as a design constraint on your AML programme from the outset, not a bolt-on reviewed after the fact.
A practitioner’s view on where AML programmes actually fail
The recurring mistake is treating MAS Notices as guidance rather than binding instruments, and stopping beneficial ownership checks at the first name on the register instead of tracing through to the natural person. Both failures are fixable with disciplined process, not bigger budgets.
— Colin
How Headington Management supports your compliance programme
Building an AML programme that survives an MAS examination takes more than a policy template, it takes structural rigour in beneficial ownership tracing, documented EDD, and a monitoring framework that gets retuned rather than left alone. Professional corporate secretarial, legal advisory, and cross-border compliance services are available to help businesses operating in and out of Singapore design programmes that hold up under scrutiny.
The full catalogue of compliance and corporate services covers corporate secretarial support, nominee director arrangements, filing agent services, legal documentation, and dedicated compliance programme design, all of which map directly onto the gaps this guide has flagged. If your immediate need is data protection alignment alongside AML controls, the fixed-fee PDPA starter packages offer a bounded entry point rather than an open-ended engagement. For teams that need to bring staff up to speed quickly, Sparks training and advisory products provide a fixed-cost route into structured learning.
Request an initial compliance health check through Headington’s advisory team to identify your highest-risk gaps before an examiner does.
Key regulator documents to consult directly
Primary law and supervisory guidance are not the same thing, and both matter.
MAS Anti-Money Laundering pages and Notices — the primary source for binding requirements.
MHA policy on AML/CFT — national strategy and coordination.
FATF/APG mutual evaluation of Singapore, 2026 — independent assessment of effectiveness.
Businesses handling ownership disclosure or trust structures should also review guidance on private trust company structures for beneficial ownership context.
This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.
Sources
FAQ
What are AML compliance requirements in Singapore?
Businesses must run customer due diligence, verify beneficial owners at the 25% threshold, screen against sanctions lists, monitor transactions, and file suspicious transaction reports through STRO. MAS Notices such as Notice 626 set the binding detail for banks, with parallel Notices covering other sectors.
What is AML in Singapore, in simple terms?
Anti-money laundering (AML) in Singapore is the legal framework, built on the CDSA, the Terrorism (Suppression of Financing) Act, and the FSM Act, that requires businesses to detect and report financial activity linked to crime or terrorism financing. MAS enforces this through binding Notices and active supervision of financial institutions and payment providers.
What are the five pillars of AML compliance?
Most frameworks describe internal controls, an independent audit function, a designated compliance officer, ongoing employee training, and a documented risk assessment as the core pillars. In Singapore’s context, these sit alongside the specific operational requirements MAS Notices impose, including customer due diligence and suspicious transaction reporting.
What does an AML compliance officer earn in Singapore?
Published salary figures vary considerably by seniority and sector, and no single reliable figure applies across the market. Compliance teams looking to benchmark roles are better served checking current recruitment market data directly rather than relying on a fixed number.
How much does AML compliance support cost with Headington?
Pricing for bespoke compliance programme design, remediation, and retained support is available on request through Headington’s services page. Fixed-fee options exist for specific packages such as the Sparks training products, priced from $100 per engagement.
Comments