A CSP compliance review is a file-level inspection of your anti-money laundering controls, carried out by a private compliance firm that ACRA appoints to do it. You will be asked to produce your policies, your risk assessments and a sample of client files, and the reviewer will test whether the files match the policies.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
That last sentence is the whole exercise in miniature. Almost every adverse finding comes down to the same gap: the firm has a written policy that says one thing, and a client file that shows something else happened.
This is not an audit of your accounts and it is not a criminal investigation. It is a supervisory review under the Corporate Service Providers Act 2024, and the realistic outcome for a competent firm is a report with a handful of findings and a request to fix them. The firms that get hurt are the ones that treated registration as a form-filling exercise and never built the file discipline underneath it.
Who conducts the review, and why that matters
ACRA does not send its own officers to do the first pass. It appoints private sector compliance firms, referred to as Reviewers, to conduct the reviews on its behalf.
Two practical consequences follow from that.
First, the reviewer is a professional compliance practitioner, not a generalist civil servant. They know what a decent enhanced due diligence file looks like because they have seen hundreds. A thin file will not pass as “we know the client well”.
Second, the reviewer reports to ACRA, not to you. The report goes to your firm, but ACRA sees the findings and decides what to do next. A review is therefore the front end of a process that can, in a bad case, lead to enforcement action against the CSP and its registered qualified individuals. It is worth taking seriously on the first pass rather than treating the first report as a free draft.
The eight areas a reviewer examines
The review is structured around eight areas. If you want a self-assessment checklist, this is it.
| # | Area under review | What the reviewer is really testing |
|---|---|---|
| 1 | Your risk assessment methodology for money laundering, terrorism financing and proliferation financing | Whether you have a documented method for rating clients, and whether the ratings on real files were produced by that method |
| 2 | Internal policies, procedures and controls | Whether the manual exists, is current, and reflects what the firm actually does |
| 3 | Customer identification and enhanced due diligence | Whether identity was verified to a standard, and whether higher-risk clients got more work, not the same work |
| 4 | Collection of beneficial ownership information | Whether you looked through the structure to a natural person, and recorded how you got there |
| 5 | Provision of beneficial ownership information to ACRA | Whether controller information was lodged accurately and on time |
| 6 | Suspicious transaction reporting | Whether escalations happen, whether they are documented, and whether anything was quietly dropped |
| 7 | Communication of policies to staff | Whether the people doing the work have read the manual and can find it |
| 8 | Staff training programme, including scope and frequency | Whether training happened, who attended, and what it covered |
Notice how many of those are about evidence rather than intention. Areas 1, 3, 4 and 6 are all tested against sampled client files. Areas 7 and 8 are tested against attendance records and acknowledgements. If you cannot produce the paper, the control did not exist as far as the review is concerned.
The three areas firms most often fail
In our experience of the market, the recurring weak points are the ones that require ongoing effort rather than a one-off document.
Risk rating that is not applied. Plenty of firms have an excellent risk assessment methodology sitting in a folder. Far fewer can show that every client onboarded in the last two years was rated using it, with the rating recorded and periodically refreshed. A methodology with no output is a finding.
Enhanced due diligence that is identical to standard due diligence. If a client is rated high risk and the file contains the same three documents as a low-risk client, the rating did nothing. Enhanced means additional: source of wealth, source of funds, senior approval, closer ongoing monitoring. All of it recorded.
Beneficial ownership that stops at the first corporate layer. Recording an offshore holding company as the shareholder is not beneficial ownership information. The reviewer wants to see the chain of reasoning down to natural persons, and the documents that support each link. This is also where the CSP obligation meets the company’s own obligations under the register of registrable controllers regime, and where ACRA’s tougher penalties for the registers of nominee directors, nominee shareholders and controllers bite on both sides of the relationship.
What the reviewer will ask you to produce
There is no published universal document request list, and reviewers differ. But the eight areas dictate the shape of it, and a request will generally cover these categories.
- The firm-level documents. Your AML/CFT policy manual, your enterprise-wide risk assessment, your customer risk assessment methodology, your record retention policy and your organisation chart showing who is responsible for compliance.
- Governance evidence. Minutes or notes showing that management reviewed compliance matters, and the appointment of whoever performs the compliance oversight function.
- Your client list. Reviewers will sample from it, so it needs to be complete and current. If you have not been keeping your CSP client list in Bizfile up to date, that is a finding before the sampling even begins.
- A file sample. Typically a mix: new clients, long-standing clients, high-risk clients, clients you exited, and clients where a nominee director was provided.
- Training records. Dates, attendee lists, materials and, ideally, an assessment.
- Escalation and reporting records. Internal escalation logs and evidence that suspicious transaction reporting obligations were considered and discharged.
- The RQI layer. Evidence of how your registered qualified individuals supervise filings and authorised staff, because supervision is a duty in its own right.
What happens after the review
Your firm receives a detailed report of the findings. From there, three things can follow, and they are not mutually exclusive.
The reviewer may conduct follow-up reviews to check that findings were closed. This is the normal path for a firm with remediable weaknesses.
ACRA may write to you about the findings. Correspondence from the regulator about specific findings should be treated as the beginning of a formal record, not as feedback.
ACRA may conduct its own on-site inspection at your premises, and may interview you or the staff who took part in the review. That is a step up in seriousness. It usually means either the findings were significant or the responses did not hold together.
None of those steps is itself a penalty. But the findings are the evidentiary foundation for anything ACRA later decides to do, which is why the quality of your response to the first report matters more than the quality of your first impression.
What goes wrong in practice
The single most damaging mistake is remediating on paper. A firm receives a report, writes a new policy addressing each finding, sends it back, and changes nothing about how files are built. The follow-up review samples fresh files, finds the same gaps, and now the firm has a repeat finding plus a credibility problem. Repeat findings are what turn a supervisory matter into an enforcement matter.
The second is document panic. Firms that cannot locate identity documents, board approvals or training records during the review window sometimes reconstruct them. Do not. Backdating or recreating records is far worse than the gap it was meant to hide, and reviewers are experienced at spotting documents that postdate the events they describe. A missing document is a finding. A manufactured one is something else entirely.
The third is treating the review as a compliance department problem. The reviewer will interview the people who actually onboard clients and make filings. If your client-facing staff cannot describe the escalation route in their own words, area 7 fails however good the manual is.
The fourth is scope drift on nominee directors. If your firm provides nominee directors, the fit and proper assessment of each nominee is a specific statutory duty with a criminal penalty attached, and reviewers look for it directly. The sentencing landscape for nominee directors has hardened considerably, as our note on Singapore’s sentencing framework for nominee directors sets out.
How to be ready: a fortnight of honest work
You cannot build two years of file discipline in two weeks. You can, however, know exactly what the reviewer will find, which is worth a great deal.
- Pull ten files yourself. Pick the same mix a reviewer would: newest, oldest, highest risk, a nominee director engagement, an exited client. Score each against your own policy.
- Reconcile your client list. Every entity you act for should appear. Every entity that appears should still be a client.
- Rebuild the training record. Dates, attendees, content. If the last session was eighteen months ago, run one now and record it properly rather than pretending otherwise.
- Check the controller filings. Sample a dozen client companies and confirm what was lodged matches what your file says you verified.
- Write your own findings list. A firm that hands the reviewer a candid self-assessment and a dated remediation plan is in a materially better position than one that is discovered.
Our fuller treatment of the underlying obligations sits in the Corporate Service Providers Act 2024 compliance FAQ, and the parallel financial-sector expectations are covered in MAS AML/CFT for licensed entities. ACRA’s own guidelines for registered CSPs and the Corporate Service Providers Regulations 2025 are the primary sources.
Frequently asked questions
Does ACRA tell you in advance that a review is coming?
You will be contacted by the appointed Reviewer and given a document request before the fieldwork starts, so a review is not a surprise raid. What you cannot control is the timing or the sample selection. Assume you will have days rather than months to assemble files.
Is a compliance review the same as an enforcement action?
No. A review is supervisory: its output is a report of findings. Enforcement is a separate process that begins with ACRA giving you a chance to show cause. Poor review findings, and especially repeat findings, are one of the routes into that process.
Who at the firm should handle the review?
A single named owner, senior enough to commit the firm, working with whoever actually builds the client files. Reviewers will speak to operational staff regardless, so the compliance lead cannot run it alone.
What if we find a serious gap while preparing?
Fix it, document when and how you found it, and disclose it. Self-identified and remediated issues are treated very differently from the same issue discovered by a reviewer and previously unrecognised by the firm.
How long should we keep the review report?
Indefinitely, with the remediation evidence attached to it. A follow-up review or a future ACRA query will start from the previous report, and being able to show the closure trail is the fastest way to end the conversation.
If you would rather not find out the hard way
Raffles Corporate Services is itself a registered CSP, so we run the same eight areas across our own files. The firms that come through a review well are not the ones with the longest manual. They are the ones whose files were built correctly the first time, by people who understood why.
If you are a CSP preparing for a review, or a company that wants to know whether its corporate secretary is keeping records to the standard ACRA now expects, speak to Raffles Corporate Services. There is more on Singapore corporate secretarial practice at Singapore Secretary Services.
The Editorial Team, Raffles Corporate Services
Need help with corporate secretarial or compliance matters?
If you would like help with your company's corporate secretarial, governance or compliance requirements, email [email protected] or WhatsApp +65 8501 7133.
Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist.