Every registered corporate service provider in Singapore must run a written, risk-based AML/CFT programme: assess your money laundering and terrorism financing risk, control it with documented policies, keep records, report suspicion to the police, train your staff, and have the whole thing independently tested. That is the regime in one sentence.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
This is part 1 of 2. It covers the framework: where the duties come from, who inside the firm owns them, and what the seven building blocks of a compliant programme look like. Part 2 covers the doing of it, meaning customer due diligence, screening, higher-risk triggers and when to walk away from a client.
We write this as a registered CSP ourselves. None of what follows is theoretical.
Why CSPs carry these duties at all
A corporate service provider sits at the gate. You incorporate the company, you supply the registered office, you file the officer and shareholder changes, and in many firms you provide a nominee director. Someone who wants to launder money through a Singapore legal person almost certainly has to pass through a CSP to get one.
That is why Singapore regulates the sector directly rather than leaving it to the banks. ACRA’s own supervisory work and the national risk assessments published by the Ministry of Home Affairs and the Ministry of Finance keep landing on the same finding: legal persons are misused, and the gatekeepers are the control point.
The practical shift under the Corporate Service Providers Act 2024 is that AML/CFT compliance moved from a good-practice expectation to a registration condition. A CSP that cannot evidence a working programme is not merely badly run. It is exposed on its registration.
Where the obligations come from
Three separate instruments bite, and they bite differently. Firms that treat them as one blob tend to get the reporting duty wrong.
| Instrument | What it imposes on a CSP | Who enforces |
|---|---|---|
| Corporate Service Providers Act 2024 and its regulations | The preventive regime: risk assessment, customer due diligence, record keeping, internal policies and controls, training, audit | ACRA |
| Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 | The duty to report suspicion of criminal proceeds, and the offence of tipping off | Commercial Affairs Department, Singapore Police Force |
| Terrorism (Suppression of Financing) Act 2002, and the targeted financial sanctions regulations | The duty to report terrorist property and suspected terrorist financing, and to freeze rather than transact | Police, MAS, Ministry of Home Affairs |
The distinction that matters: the CSP Act regime is about preventing bad business from getting in. The CDSA and the TSOFA are about what you do the moment you suspect something, and they apply to anyone, registered or not. You cannot contract out of them, and no client instruction overrides them.
Never state a section number from memory when you write this into your own manual. Check the current text on Singapore Statutes Online first, because the CSP regime has been amended recently and stale citations in a compliance manual are the sort of thing a supervisor notices.
Who inside the firm owns this
Ownership is the single most common structural failure we see in small CSPs. The duties are firm-level, but somebody has to be accountable by name.
Senior management
The partners or directors own the risk appetite. They decide which client types the firm will and will not serve, they approve the risk assessment, and they approve the onboarding of higher-risk clients. This cannot be delegated downwards to an administrator who wants to hit a revenue target.
The compliance function
Appoint a named compliance officer with enough seniority to say no and enough independence to escalate. In a firm of five people that is realistically a partner wearing a second hat. That is acceptable, provided the hat is written down and the person is not also the one who approves their own client files.
The registered qualified individual
Each CSP must have at least one registered qualified individual on its registration. The RQI’s fitness and propriety is part of what ACRA is assessing, and in practice the RQI is expected to understand the firm’s AML/CFT posture rather than treat it as back-office admin. See our note on the registered qualified individual role for what that means day to day.
Everyone who touches a client
The corporate secretary preparing the resolutions, the accounts clerk chasing invoices and the receptionist taking the walk-in enquiry all see things the compliance officer does not. If they do not know what a red flag looks like, the programme is decorative.
The seven building blocks, in order
Build them in this sequence. Every block downstream depends on the one above it, which is why firms that buy a template manual first and think about risk later end up with a document that does not describe their own business.
- Enterprise-wide risk assessment. Write down, for your firm, where your ML/TF risk actually comes from: client types, the countries your clients and their owners connect to, the services you sell (nominee directorships and registered office addresses are higher risk than bookkeeping), and your delivery channels (non-face-to-face onboarding of an overseas client is not the same risk as a walk-in). Rate each, then state your controls. Refresh it at least annually and whenever your business changes.
- Policies, procedures and controls. Turn the assessment into rules your staff can follow: who may approve what, what evidence is required at each risk tier, what the escalation path is. If the manual does not tell a new hire what to do on a Tuesday afternoon, it is not a control.
- Customer due diligence. The largest block by volume, covered in part 2.
- Record keeping. Retain CDD records, transaction and engagement records, and the reasoning behind your decisions, for the period the regulations require, running from the end of the relationship or the completion of the one-off transaction. Retain the negative findings too. A file showing you screened and found nothing is evidence; a file showing nothing is not.
- Suspicious transaction reporting. File with the Suspicious Transaction Reporting Office, and do not tip the client off.
- Training. Role-appropriate, documented, repeated.
- Independent audit. Someone who did not write the programme has to test whether it works.
Record keeping, done properly
Keep three things for every client, not one.
Identification evidence. Documents obtained on the customer, the beneficial owners and anyone acting on the customer’s behalf, plus the verification you performed on them.
The relationship record. The engagement letter, the services provided, the filings made, the fees and how they were paid. Payment from a third party nobody mentioned is one of the more reliable red flags in this sector, and you only catch it if you record who actually paid.
The reasoning. Why you rated the client the risk you did, why you accepted an unusual explanation, who approved it and on what date. This is the part firms skip, and it is the part that decides whether a supervisory review goes well. A decision you cannot reconstruct is, in evidential terms, a decision you did not make.
Records must be retrievable. “It is in an email somewhere” fails. So does a shared drive that only the departed compliance officer could navigate.
Suspicious transaction reporting, and the tipping-off trap
If you know or have reasonable grounds to suspect that property represents the proceeds of criminal conduct, or that funds or property are linked to terrorism, you must report it. The route is the Suspicious Transaction Reporting Office, through the Singapore Police Force’s STR channel.
Four things firms get wrong:
Waiting for proof. The threshold is suspicion, not certainty. You are not conducting the investigation; you are handing the authorities a data point.
Telling the client. Disclosing that a report has been made, or is being contemplated, is a separate offence. That includes hinting, and it includes explaining an exit by saying “compliance flagged you”. If you are exiting a client after filing, give a neutral commercial reason.
Filing and then carrying on regardless. A report does not cleanse the relationship. You still have to decide whether to continue acting, and continuing to file for a client you have reported needs a deliberate, recorded decision.
Forgetting sanctions are different. Targeted financial sanctions are not a reporting judgment call, they are a prohibition. If a name matches a designated person or entity, you freeze and report, you do not weigh it commercially. MAS publishes the targeted financial sanctions position and the designations are maintained centrally.
Training and independent audit
Training has to be proportionate to the role. A partner approving higher-risk onboarding needs more than an annual slide deck; a junior filing clerk needs to recognise a red flag and know who to tell. Keep attendance records, keep the materials, and refresh whenever the law or your own risk profile moves.
Independent audit is the block small firms most often quietly omit. Independence means the reviewer did not design or run the programme. It does not require a Big Four engagement. A competent external reviewer, or in a larger firm an internal function reporting to the partners rather than to compliance, is enough. What matters is that the review tests files and finds things. An audit report with no findings across a whole client book is not reassuring, it is a sign the audit was not real.
What goes wrong in practice
The template manual nobody reads. A firm buys a policy document, changes the name on the cover and files it. Two years later a supervisor asks how the firm risk-rates clients and nobody can answer, because the manual describes a bank.
Compliance as an onboarding gate only. CDD is done at day one, then the file sleeps for six years while the client’s ownership changes twice. Ongoing monitoring is an obligation, not a courtesy.
No exit route. The firm has a procedure for saying yes and none for saying no. When a bad client finally has to go, it improvises, and it improvises straight into a tipping-off problem.
Nominee arrangements treated as ordinary business. Nominee directorships and nominee shareholdings sit at the highest-risk end of CSP work and carry their own register and disclosure duties, now with sharper consequences. Read our note on the tougher penalties for the nominee and controller registers.
Directors signing declarations they have not tested. The amended Form 45 money-laundering disqualification declaration puts a personal statement on the record. If your firm arranges directorships, you should know what your appointees are signing.
Frequently asked questions
Does a small CSP with three staff really need all seven blocks?
Yes, but scaled. A three-person firm can run a risk assessment in six pages, combine the compliance officer role with a partner role, and buy in an independent review annually. What it cannot do is skip a block entirely. The obligations are risk-based in depth, not optional in existence.
Is AML/CFT compliance checked when I register as a CSP?
It forms part of what ACRA assesses and what it can inspect afterwards. Registration is not a one-off hurdle; the conditions continue for as long as you are registered. Our guide to CSP registration requirements sets out the wider picture.
Who do I file a suspicious transaction report with?
The Suspicious Transaction Reporting Office, which sits within the Commercial Affairs Department of the Singapore Police Force. Filing is done through the police channel, not through ACRA. Report on suspicion, keep a copy of what you filed, and do not tell the client.
Can I outsource my AML/CFT programme?
You can outsource the work, including screening tools and file reviews. You cannot outsource the responsibility. If an outsourced provider does your CDD badly, the regulatory consequence lands on your firm and on the people named on your registration.
How often should the risk assessment be updated?
At least annually, and immediately on any material change: a new service line, a new client segment, a new jurisdiction, a new delivery channel, or a published national risk assessment that changes the picture. Date every version and keep the superseded ones.
What is the difference between the CSP Act duties and the CDSA duties?
The CSP Act regime is preventive and supervised by ACRA: know your client, control your risk, keep your records. The CDSA duty is reactive and enforced by the police: once you suspect criminal proceeds, report. A firm can be fully compliant with one and in breach of the other.
Getting the framework right before it is tested
Most CSPs do not fail on effort. They fail on evidence: the work was done, the thinking happened, and none of it was written down in a form anyone else can follow.
Raffles Corporate Services is a registered corporate service provider and runs this regime on its own book every day. If you are standing up a programme, rewriting a manual that no longer describes your business, or preparing for a review, that is a short and useful conversation.
Read on in part 2, on practical customer due diligence for CSPs, and see the wider obligations in our Corporate Service Providers Act 2024 compliance FAQ. More on Singapore corporate secretarial practice at Singapore Secretary Services.
The Editorial Team, Raffles Corporate Services
Need help with corporate secretarial or compliance matters?
If you would like help with your company's corporate secretarial, governance or compliance requirements, email [email protected] or WhatsApp +65 8501 7133.
Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist.