Handing someone else control of your company’s bank account, or giving them your Singpass login so they can act for the company, can now be a criminal offence in Singapore if the access is used for crime and you did not take reasonable steps to find out what it was for. Since 8 February 2024, the law has targeted people who let others operate their payment accounts, including corporate accounts, and people who disclose their Singpass credentials. MHA has said owners and operators of corporate bank accounts “will be held accountable” for transactions through their accounts. For directors, nominee directors and founders who leave banking to an overseas partner or agent, this changes how access must be set up.
If someone else holds your company’s banking token, passwords or your Singpass, take them back now. Change the credentials, tell the bank, and set up proper authorisations in the company’s own name. If the access has already been misused, report it and take legal advice immediately. Waiting to see what happens is the worst option.
The offences
MHA’s announcement of the 8 February 2024 amendments describes them as follows:
| Conduct | Maximum penalty |
|---|---|
| Assisting another to retain benefits from criminal conduct, including where you allowed others to access, operate or control your payment account and failed to take reasonable steps to find out the purpose | Fine of S$50,000, 3 years’ imprisonment, or both |
| Disclosing your own Singpass credentials, knowing or having reasonable grounds to believe it is to commit or facilitate an offence | Fine of S$10,000, 3 years’ imprisonment, or both |
| Obtaining, retaining, supplying or making available someone else’s Singpass credentials | Fine of S$10,000, 3 years’ imprisonment, or both; for a repeat offence, S$20,000, 5 years, or both |
The account offence also covers moving money without reasonable steps to find out its source or destination, or the identity and location of the other party. A person is not liable if he can prove he did not know and had no reason to believe the property was criminal proceeds. For the Singpass offence, the purpose is presumed where the person received a gain for disclosing the credentials, knew it was likely to cause wrongful loss, or did not take reasonable steps to find out the identity and location of the person given them. MHA said these offences are not meant to catch lawful sharing, such as family helping an elderly person, or people genuinely tricked into giving up their credentials.
What the police have charged
In September 2024, police announced that 40 people would be charged under the new offences. In one case, an account holder allegedly let a stranger control a bank account that was then used to launder more than S$300,000. In another, a Singpass user allegedly gave a stranger access in exchange for fast cash, and his identity was used to open four bank accounts through which more than S$500,000 was laundered (SPF, 8 September 2024). Those were individuals, but a company account is just as attractive to criminals, because business accounts move larger sums with fewer questions.
Company situations that carry this risk
- A nominee director handing over banking access to the foreign owner, so the owner can “run the account”.
- A director overseas who leaves the hardware token, card and passwords with a manager or friend in Singapore.
- “Renting” the company or its account to an introducer in return for a monthly fee.
- Giving a Singpass login to an agent so they can submit filings or applications as you.
- Keeping a former director’s credentials active after they leave.
Setting up access properly
- Use the bank mandate. Anyone who needs to operate the account should be appointed as an authorised user or signatory through the bank’s own process, with their own identity verified and their own credentials. See updating the company’s bank mandate.
- Use Corppass for government transactions. Corppass lets the company give named users their own access to government digital services for the company. No one should log in as someone else. See Corppass administrator handovers.
- Keep approval with the right people. Use dual authorisation and payment limits so no single outsider can move funds.
- Know every transaction. Directors remain responsible for what passes through the company’s account. Review statements monthly.
- Revoke access the day someone leaves, and record it in the board minutes.
If you have already handed over access
- Change passwords and PINs, and ask the bank to replace tokens and cards.
- Review the account history for transactions you do not recognise.
- Tell the bank in writing, and make a police report if the access has been misused.
- Take legal advice before giving any statement, and answer truthfully.
- Put the proper mandate and Corppass arrangements in place.
Frequently asked questions
I am a nominee director. The owner says he needs to control the account. What should I do?
He can be given access in his own name through the bank’s mandate process, after the bank’s checks. You should not hand over your own credentials, and you should still understand what goes through the account. See our guide to nominee director risks.
My accountant uses my Singpass to file for the company. Is that an offence?
The offences target disclosure to facilitate crime, but sharing a Singpass login is still unsafe and unnecessary when proper authorisation is available. Give your service provider access through Corppass instead.
Can the company be liable as well as the director?
Companies can commit offences, and money passing through a company account can be frozen and seized. See rash and negligent money laundering.
More on the company law hub.
Someone else controls your company’s account or your Singpass?
If your company, or you as a director or shareholder, has given others access to the company’s bank account or your Singpass, or that access has been misused, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines, update the bank mandate and Corppass users, and record the changes properly. Where your matter needs a lawyer, we will refer you to a firm on our panel of Singapore law firms that regularly handles money laundering and police investigations. Raffles Corporate Services is a corporate services provider, not a law firm, and this article is general information, not legal advice.
Willie Tan, Raffles Corporate Services