ACRA can censure you, impose a financial penalty for each breach, restrict your access to its filing system, or suspend or cancel your registration outright. Before it does any of that, it runs a show cause process giving you the chance to explain yourself. That step is the one that decides the outcome.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
The Corporate Service Providers Act 2024 changed the character of this industry. Corporate service provision in Singapore used to be a business you could start with a laptop and a Corppass account. It is now a registered, supervised activity with a sanctions ladder attached, and the sanctions apply to the firm and to named individuals separately.
This article sets out what each rung of that ladder is, who it hits, and what the practical consequences are once a sanction lands. We are a registered CSP ourselves, so we have read this in the way a firm reads it: as a list of things that can happen to us.
The two tracks: criminal conviction and regulatory sanction
It helps to separate two things that get muddled together.
The criminal track applies where a specific statutory duty carries an offence. Under the CSP Act 2024, a CSP convicted of failing to check that a person is fit and proper before appointing them as a nominee director, or of failing to perform the required customer due diligence and keep the required records, faces a maximum fine of $100,000. That is a court outcome following a prosecution, with a criminal record attached.
The regulatory track is ACRA acting as the supervisor. No court, no conviction, but real consequences: financial penalties, restrictions, and the loss of registration. This is the track most firms will encounter, and it is the one that starts with show cause.
The two are not alternatives in any comfortable sense. Conduct serious enough to be prosecuted is also conduct that will cost you your registration.
The show cause process
If ACRA considers that you have breached your duties, it will start a show cause process before deciding on enforcement. In substance, you are given notice of what ACRA thinks you did wrong and an opportunity to respond before any decision is made.
Treat the show cause letter as the most important document your firm will handle that year.
Three things about it are routinely underestimated.
It is the record. Whatever you write becomes the factual basis on which the decision is taken. A defensive, vague or partially accurate response does more damage than the underlying breach in a surprising number of cases, because it converts a control failure into a candour problem.
It is your only structured chance to give context. Once a sanction is decided, the framing is fixed. If there is an explanation, a mitigating circumstance, or a remediation already completed, it needs to be in the show cause response with evidence attached.
It is a legal document, not a compliance memo. Where the conduct in question could also attract prosecution, the response needs to be drafted with that in mind. There is a real handoff point between what a corporate secretary should draft and what needs a lawyer, and we have set out where that line falls in our note on the CSP to counsel handoff in a court application.
The sanctions available after show cause
After the show cause process, ACRA may impose any of the following. The maximum financial penalty differs depending on whether the subject is the firm or the individual.
| Sanction | Applies to a CSP | Applies to an RQI | What it means day to day |
|---|---|---|---|
| Censure (formal warning) | Yes | Yes | On the record. Relevant to renewal, to future enforcement, and to client due diligence on you |
| Financial penalty per breach | Up to $25,000 for each breach, within a specified period | Up to $10,000 for each breach, within a specified period | Penalties are per breach, so a systemic failure across many files multiplies |
| Restriction of access to ACRA’s online filing system | Yes | Yes | You remain registered but cannot practise normally. Commercially close to a suspension |
| Suspension of registration | Yes | Yes | You cannot carry on the regulated activity for the suspension period |
| Cancellation of registration | Yes | Yes | You are out of the business, and your clients need a new provider |
Why “per breach” is the figure that should worry you
The number that firms fixate on is the headline maximum. The number that actually determines exposure is the word each.
A financial penalty of up to $25,000 for each breach means the arithmetic is driven by how many files are affected, not by how bad any single file is. A single policy defect that flowed through two hundred onboardings is two hundred opportunities to be penalised, not one. This is the mechanism that turns a tidy, unglamorous control failure into an existential number.
It is also why the remediation evidence in a show cause response is so valuable. Demonstrating that the affected population has been identified, reviewed and corrected changes the shape of the exposure in a way that arguing about the original defect never will.
What RQIs need to understand about their own exposure
Registered qualified individuals are not simply employees of the CSP. They carry duties in their own name, and they can be sanctioned in their own name.
The RQI duties centre on oversight. An RQI is responsible for overseeing transactions filed with ACRA, supervising the authorised staff who carry out those transactions, and reporting and correcting errors or issues that arise during them. The full picture of what the role involves is in our guide to becoming and acting as a registered qualified individual.
The practical risk for an RQI is the supervision limb. If a junior files something wrong, “I did not know” is not a defence to a supervision duty, because knowing is the duty. And the correction limb has teeth: an error that is noticed and quietly fixed without being reported is a different and worse fact pattern than an error that is escalated.
There is also a firm-level consequence. A CSP that loses an RQI to a suspension or cancellation may find itself unable to meet its own registration conditions, which is why the mechanics of appointing and withdrawing RQIs are worth having under control before you need them.
What goes wrong in practice
Firms respond to show cause with a policy document. The natural instinct is to send the regulator the manual that shows the firm has the right rules. But ACRA already suspects the rules were not followed. The response needs to address the conduct, the population affected, the cause, and the fix, with dates.
Nobody owns the nominee director fit and proper check. Where a firm provides nominee directors, the fit and proper assessment of the nominee is a specific duty with a criminal penalty behind it. It is easy for this to sit in a gap between the client-facing team and compliance, with everyone assuming someone else did it. The hardening judicial attitude to nominee directors generally, set out in our piece on the Singapore sentencing framework for nominee directors, makes this the least attractive place in the business to have a gap.
Record keeping is treated as an afterthought rather than a duty. Customer due diligence obligations include keeping the required records in specified situations. A firm that did the work but cannot evidence it is, for enforcement purposes, in much the same position as a firm that did not do the work.
Filing access restriction is not planned for. Firms plan for penalties and think about cancellation, but rarely consider what happens if they simply cannot file for a period. Deadlines do not pause. Annual returns, controller updates and officer changes for every client company continue to fall due. A firm without a contingency arrangement hands its clients a compliance problem of its own making.
Individuals assume the firm will shield them. It does not work that way. An RQI facing a sanction in their own name needs their own view of the facts, and sometimes their own advice.
Frequently asked questions
Does a show cause letter mean ACRA has already decided?
No. The whole point of the process is that it precedes the decision. ACRA sets out what it believes happened and gives you the opportunity to explain before it chooses a sanction, or none. Firms that treat it as a formality tend to be the ones surprised by the outcome.
Can ACRA fine the firm and the individual for the same incident?
The CSP and the RQI have separate duties and are separate subjects of enforcement, so one set of facts can produce consequences at both levels. A filing failure can be a supervision breach by the RQI and a controls breach by the firm at the same time.
Is a censure really a sanction if there is no money attached?
Yes. A censure is a formal finding on your regulatory record. It is relevant when your registration comes up for renewal, it is relevant if there is a further matter later, and it is the kind of thing sophisticated clients and banks ask about during their own due diligence on you.
What is the difference between suspension and restricting filing access?
A suspension removes your registration for a period, so you cannot carry on the regulated activity at all. Restricted filing access leaves the registration intact but takes away the practical ability to transact with ACRA. Commercially the second is often almost as disruptive as the first.
Can we just deregister to avoid enforcement?
No. Voluntary cancellation is available in principle, but where ACRA suspects a breach of duties it can pause your application while it investigates, or reject it. We explain how that works in our guide to cancelling a CSP or RQI registration.
The version of this that does not happen to you
Most enforcement against CSPs will not be about dramatic wrongdoing. It will be about firms that grew faster than their file discipline, and then could not evidence what they had done. The underlying obligations are set out in the Corporate Service Providers Act 2024 and the Corporate Service Providers Regulations 2025, with our own plain-English treatment in the CSP Act 2024 compliance FAQ.
Raffles Corporate Services is a registered CSP, and we run our client files to the standard we would want to produce in a show cause response, because that is the only standard worth running them to. If you are a CSP that has received correspondence from ACRA, or a company that wants comfort that its provider is on the right side of all this, talk to Raffles Corporate Services. Further reading on Singapore corporate secretarial practice is at Singapore Secretary Services.
The Editorial Team, Raffles Corporate Services
Need help with corporate secretarial or compliance matters?
If you would like help with your company's corporate secretarial, governance or compliance requirements, email [email protected] or WhatsApp +65 8501 7133.
Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist.