trustBar: How to Check an ACRA Document Is Genuine, and Still Current

If a counterparty sends you a Singapore Business Profile or a certificate of incorporation, you can confirm it came from ACRA in well under a minute, free, with no login and no account. The service is called trustBar, and almost nobody uses it.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

That is the odd thing about it. Forged and doctored ACRA documents circulate constantly: an altered share capital figure to satisfy a tender requirement, a removed director to hide a disqualification, a live-looking certificate for an entity that was struck off two years ago. The check that defeats all three is public, instant and costs nothing.

What follows is what trustBar does, the three ways to run it, what each result means, and the distinction that trips people up most: a document can be perfectly genuine and still be badly out of date.

What trustBar actually is

trustBar is ACRA’s public verification service for its own information products. You give it a document, it tells you whether ACRA issued that document and whether the content has been altered since.

It is not a search engine, and it is not a substitute for buying a product. It does not let you look up a company you know nothing about. It answers one narrow question about a document already in your hands, which is exactly the question you need answered when a PDF arrives by email from someone you have never met.

Two products are covered:

• Business Profiles, purchased from 4 March 2023 onwards
• Business Certificates (incorporation or registration), purchased from 4 March 2023 onwards

That cut-off matters. A genuine Business Profile bought in 2021 will not verify on trustBar, because it was issued before the verifiable format existed. A failed check on an older document is not evidence of forgery. It is evidence that you are holding something outside the coverage window, and you should ask for a fresh copy rather than accuse anybody of anything.

For everything else ACRA sells, including People Profiles, certificates confirming filing of particulars, extracts and registers, trustBar is the wrong tool. Our sibling guide on verifying and certifying ACRA documents covers the Bizfile authentication route those products use, and the separate question of when you need a certified copy rather than a verified one.

Why there are two files, not one

ACRA issues each of these products in two formats: a PDF you read, and a machine-verifiable file built on the OpenAttestation model that Singapore’s government verification stack uses generally.

The verifiable file carries a cryptographic fingerprint of the content. Change one character and the fingerprint stops matching, which is why trustBar can tell you not merely that a document with that reference exists, but that the content in front of you has not been touched.

Most people throw the second file away without realising they had it. Keep it. It is the one that makes the strongest form of the check possible.

The three ways to verify, in order of convenience

1. Scan the QR code printed on the PDF. Point a phone camera at it. The verification result opens directly. This is the route to use when a document is put in front of you in a meeting and you want to check it without breaking the conversation.
2. Open the verification URL printed on the PDF. Every issued document carries its own unique address. Use this when you are at a desk with the PDF open and no phone handy.
3. Upload the verifiable file on the trustBar site. This is the strongest check, because you are handing the service the machine-readable original rather than following a link printed on a document whose provenance is the very thing in question.

Route 3 deserves a word of caution about the other two. A QR code and a URL are both printed on the document you are trying to verify. Someone who has gone to the trouble of forging a profile can also print a QR code that leads somewhere convincing. If the stakes are real, do not scan the code on the document. Go to trustBar yourself and upload the file, or at minimum check that the address in your browser bar is a Singapore government domain before you believe anything on the page.

You can also print the verified document with the verification result and timestamp on it, which is the format to keep on file if you are the one who has to show later that the check was done.

Reading the result properly

There are three outcomes, and the middle one is the one people misread.

The currency check became available on 8 December 2023 and applies to Business Certificates only. There is no currency check for Business Profiles, for the simple reason that a profile is a snapshot of a company’s particulars and something in it changes almost every time the company files anything.

Authentic is not the same as current

This is the distinction worth carrying away. A Business Profile can pass a trustBar check with a clean result and still be useless for your purpose, because it was bought eight months ago and two directors have resigned since.

Authenticity tells you nobody tampered with the file. Currency tells you whether the facts in it are still the facts. For a tender or a compliance file, authenticity may be all you were asked for. For due diligence before you lend money, sign a shareholders’ agreement or take on a client, you want a document dated recently, and the cheapest way to be certain is to buy your own rather than rely on theirs. Our note on buying a Business Profile through Bizfile sets out the cost and the steps, and the types of ACRA information product explains which one answers which question.

If you verify documents in volume

One-at-a-time checking stops working somewhere around the tenth document a week. Corporate service providers, banks, insurers and procurement teams onboarding dozens of entities a month need the check running inside their own systems.

ACRA publishes a trustBar verification API for that, reached through the ACRA API Marketplace. It does authenticity for Business Profiles and both authenticity and currency for Business Certificates, in bulk. The API itself is free, although getting onto the Marketplace is integration work rather than an afternoon’s task. Our sibling piece on which ACRA tool you actually need maps it against the rest of ACRA’s tooling, and the Bizfile portal map shows where the manual equivalents live.

For verifiable documents that did not come from ACRA at all, Singapore runs Verify.gov.sg as the general-purpose checker.

What goes wrong in practice

Nobody runs the check. By far the most common failure. The document looks official, it has a Singapore government crest on it, and the check takes fifty seconds that nobody spends. Every forged profile we have ever seen would have failed a trustBar check instantly.

An old document fails and somebody panics. Products bought before 4 March 2023 are outside the coverage window. That is a scope issue, not fraud. Ask for a current copy.

The QR code is trusted blindly. Scanning a code printed on the document you doubt is a circular check. On anything that matters, upload the verifiable file from the trustBar site instead.

A clean result is treated as diligence completed. It is not. Verification proves the file is genuine. It says nothing about whether the company is solvent, whether its officers are disqualified, or whether the shareholding you are relying on still exists. Read the content after you verify it, and compare it line by line against what you were told.

The document is genuine and the sender is not. Verification confirms the document. It does not confirm that the person emailing it is who they say they are, which is a separate exercise. Our notes on ACRA-related scam patterns and on identity verification as the NRIC changes both matter here, and corporate service providers carry their own statutory duties on this under the Corporate Service Providers Act 2024.

Frequently asked questions

Is trustBar free, and do I need to log in?
It is free and requires no login, no Singpass and no account. Anyone anywhere can use it, including counterparties overseas who have been sent a Singapore document and want to know whether to believe it. There is no limit on the number of checks you can run.

Which ACRA documents can I verify on trustBar?
Business Profiles and Business Certificates of incorporation or registration, in both cases purchased from 4 March 2023 onwards. Other ACRA products, including People Profiles and various extracts and certificates, are checked through the separate product authentication route on Bizfile instead.

My document says it is genuine but not up to date. Is that a problem?
It means ACRA issued it and nobody altered it, but something has since been filed that affects the information in it. The certificate is real and stale. If you are relying on it for a decision, ask for a fresh copy or buy one yourself. The currency check applies to Business Certificates only, not to Business Profiles.

Why did my genuine ACRA certificate fail verification?
The most likely reason is age. Coverage begins with products purchased from 4 March 2023, so anything issued before the verifiable format existed will not verify. The other common cause is uploading a scan or a photograph rather than the original file, which changes the content and therefore breaks the fingerprint.

Can I verify a document for a company I have nothing to do with?
Yes. trustBar checks the document, not your relationship to the company, so you can verify anything anybody sends you. What you cannot do is use it to look up a company you hold no document for. For that you buy a Business Profile from Bizfile.

Does a clean trustBar result mean the company is in good standing?
No. It means the file is authentic. Good standing is a separate question answered by reading the document: entity status, officers, share capital, registered address and any charges. Verify first, then actually read what you have verified.

The fifty seconds worth spending

Document fraud in Singapore corporate dealings is not sophisticated. It is usually a PDF editor and an optimistic counterparty. The defence is a free public service that most people have never heard of, which is why we mention it to clients more often than almost anything else in this series.

Raffles Corporate Services runs verification as a standing step in client onboarding and in every transaction file we open, and we are happy to check a document you have been sent if you are unsure what you are looking at. If you are building an onboarding process and want the verification step designed in rather than bolted on, that is a short conversation.

You can reach us through Raffles Corporate Services, or read more on Singapore corporate secretarial practice at Singapore Secretary Services.

— The Editorial Team, Raffles Corporate Services