ACRA’s guidelines for registered corporate service providers are not a summary of the law. They are the standard your firm will be measured against in a compliance review, and they describe a working compliance system, not a policy document sitting in a shared drive.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
That distinction is the single most expensive misunderstanding in the sector. Firms read the guidelines, recognise the concepts, conclude they are broadly doing the right things, and file the PDF. Then a reviewer arrives and asks to see the risk assessment that produced the risk rating on a specific client file, and there is nothing to show.
This piece is about the architecture the guidelines assume you have. It is not a substitute for reading them, and it deliberately does not reproduce them. Download the current version from ACRA’s guidelines page and read it properly. What follows is what it means for how your firm is organised.
Where the guidelines sit in the legal stack
The obligations themselves come from the Corporate Service Providers Act 2024 and the Corporate Service Providers Regulations 2025. The guidelines explain how ACRA expects those obligations to be discharged.
Guidelines are not, in themselves, the source of the duty. But treating them as optional is a mistake, because when ACRA assesses whether a firm has taken reasonable measures, the guidelines are the benchmark for what reasonable looks like. A firm that departed from them will be asked why, and “we did it differently” is only an answer if the different way was at least as good and was documented as a deliberate choice.
They cover both sides of the registration: what the registered CSP entity owes, and what each registered qualified individual owes personally. Those are separate obligations. An RQI does not discharge their duty by pointing at the firm’s manual.
The six things a compliance review looks for
Strip the guidelines back and a registered CSP is expected to be able to produce six things on demand.
1. A firm-level risk assessment
Not a client risk rating. An assessment of your own business: the client types you take on, the jurisdictions you touch, the services you provide, the delivery channels you use, and where in that mix your exposure to money laundering, terrorism financing and proliferation financing actually concentrates.
This is the document that justifies everything else. If your enhanced due diligence triggers cannot be traced back to a firm-level assessment that identified those risks, they look arbitrary, because they are.
It has to be refreshed. A risk assessment written when you had forty clients and one service line does not describe a firm with four hundred clients and a nominee director offering.
2. Customer due diligence that reaches the beneficial owner
Identifying the person who walks through the door is the easy part. The guidelines are concerned with whether you got to the natural person who ultimately owns or controls the client, and whether you verified that person rather than accepting a chart someone emailed you.
Layered structures are where firms stop early. A Singapore company owned by a BVI company owned by a trust is not “beneficial owner: BVI company”. If you cannot get to a natural person, that is itself a finding you must deal with, not a box you leave blank.
The same applies to the purpose and intended nature of the relationship. “Corporate secretarial services” is not a business rationale. Why does this client need this structure?
3. Screening that is run, dated and evidenced
Sanctions screening, politically exposed person screening, and adverse media checks, applied at onboarding and repeated on an ongoing basis. The recurring review finding is not that firms fail to screen. It is that they cannot prove when they screened, against what list, or what the result was.
Screening you cannot evidence is screening you did not do, as far as a reviewer is concerned.
4. Ongoing monitoring, not a one-off file
Client risk is not fixed at onboarding. The guidelines expect periodic review at a frequency driven by risk rating, and expect trigger events to prompt review out of cycle: a change in beneficial ownership, a change in the client’s activity, a resignation, a sudden interest in an unusual jurisdiction.
The practical test is whether anything in your file is dated after the onboarding pack. For a lot of firms, the honest answer for most clients is no.
5. Suspicious transaction reporting that actually fires
A registered CSP that forms a suspicion must report it to the Suspicious Transaction Reporting Office. The guidelines set out indicators to help staff recognise suspicion, and an annex of red flags exists precisely because most staff will not spot a pattern they have never been taught to look for.
Two failure modes here, and they are opposite. Some firms never file anything, which strains credibility across a book of several hundred entities. Others file defensively on everything, which is its own signal that nobody is exercising judgement. What you need is a documented escalation route, a named person who decides, and a record of the decision either way, including the decision not to report.
Tipping off is a separate offence. Whatever your internal process is, it cannot involve telling the client.
6. Governance: policies, a responsible person, training and independent testing
The guidelines expect written internal policies, procedures and controls proportionate to the firm’s size and risk, someone senior accountable for AML compliance, staff training that is delivered and recorded, and some form of independent check that the system works.
Independent testing is where small firms push back hardest, and fairly: a three-person firm cannot stand up an internal audit function. The answer is proportionality, not exemption. Someone who did not do the onboarding needs to test a sample of files, and the result needs to be written down.
What changes in practice when you take this seriously
| Area | Firm treating guidelines as reading material | Firm treating them as a system |
|---|---|---|
| Risk assessment | Generic template, undated | Firm-specific, dated, reviewed annually |
| Client risk rating | Assigned by feel, unexplained | Driven by documented factors, reasoning on file |
| Beneficial ownership | Stops at the first corporate layer | Traced to a natural person, or the gap is escalated |
| Screening | Done, but unevidenced | Timestamped, list named, result retained |
| Periodic review | Nothing on file after onboarding | Scheduled by risk band, with trigger events |
| STR process | Informal, nobody owns it | Named decision-maker, decisions recorded either way |
| Training | Occasional, unrecorded | Delivered, attended, evidenced |
| Onboarding declined | Client walks, no record | Refusal recorded, and STR considered |
The right-hand column is not more expensive to run than the left. It is more expensive to build once and cheaper to operate thereafter, because the work stops being re-done from memory every time.
What goes wrong in practice
The most common finding is not a firm that refuses to comply. It is a firm whose compliance exists in the head of one experienced person.
That person knows which clients are awkward, remembers why a structure looked odd in 2023, and applies genuinely good judgement. None of it is written down. When they are on leave, the standard drops. When they resign, the institutional memory leaves with them and the firm cannot reconstruct why any given client was rated low risk.
The second most common finding is the file that was built to satisfy a checklist rather than a question. Every field populated, every document collected, and no evidence that anyone looked at the result and thought about it. A passport scan and a utility bill do not answer why a client based three time zones away needs a Singapore holding company with a nominee director and no operations.
The third is scope creep without a corresponding update to the firm’s declared services and risk assessment. A firm that started doing something new and heavier, and never revisited either its ACRA record or its own risk profile, is running a 2024 control environment over a 2026 business.
The consequences run from directions and conditions on your registration through to suspension and cancellation, plus personal exposure for RQIs. The reputational consequence tends to arrive first: clients’ bankers ask questions, and a CSP under supervisory scrutiny is a problem for every client on its list.
Frequently asked questions
Are ACRA’s CSP guidelines legally binding?
The binding obligations sit in the Corporate Service Providers Act 2024 and the Corporate Service Providers Regulations 2025. The guidelines explain how ACRA expects those obligations to be met, and they are the benchmark used in compliance reviews. Departing from them is possible but must be deliberate, defensible and documented.
Do the guidelines apply to individual RQIs or only to the firm?
Both. The registered CSP has obligations as an entity, and each registered qualified individual has obligations personally. An RQI cannot discharge their duty by relying on the firm’s manual; the guidelines address RQI responsibilities separately for exactly this reason.
How often should we refresh our firm-level risk assessment?
At least annually, and immediately on any material change: a new service line, a new client segment, a new jurisdiction, a significant growth in volume, or a change in your own ownership. A risk assessment that no longer describes the business it assesses is worse than none, because it creates false comfort.
We are a three-person firm. Do we really need independent testing?
Yes, but proportionate to your size. You do not need an audit department. You need someone who did not perform the onboarding to test a sample of files against your own procedures, and you need the result written down with the follow-up actions. Small does not mean exempt.
What if we cannot identify the beneficial owner?
That is a finding, not a formality. You should not proceed on the basis of an incomplete ownership picture. Escalate internally, consider whether the inability to identify is itself suspicious, and decide whether to decline or exit the relationship. Record the decision and the reasoning either way.
How current is the version of the guidelines we downloaded?
Check before you rely on it. ACRA revises the guidelines, and a firm running its programme off a superseded version will be measured against the current one. Re-download at each annual review rather than working from a copy saved when someone last looked.
Getting the architecture right
Most firms we speak to are not badly intentioned and are not doing nothing. They are doing a reasonable amount of the right work in a way that cannot be demonstrated, which in a supervised sector is close to the same thing as not doing it.
The fix is unglamorous: write down what you already do, test whether it matches what the guidelines expect, close the gaps, and make the whole thing survive the departure of your most experienced person. For context on the surrounding regime, see our Corporate Service Providers Act 2024 compliance FAQ, our guide to the requirements for CSP registration, and our note on whether your firm needs to register as a CSP at all. If your work touches licensed entities as well, the MAS AML/CFT FAQ sets out the parallel regime, and our piece on the NRIC authentication phase-out covers a change that has already forced identity-verification rewrites.
Raffles Corporate Services is a registered CSP and runs this system for its own book. If you want an outside read on whether yours would survive a review, that is a short and useful conversation. More on Singapore corporate secretarial practice at Singapore Secretary Services.
The Editorial Team, Raffles Corporate Services
Need help with corporate secretarial or compliance matters?
If you would like help with your company's corporate secretarial, governance or compliance requirements, email [email protected] or WhatsApp +65 8501 7133.
Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist.