Practical Customer Due Diligence for Corporate Service Providers

Customer due diligence for a Singapore CSP means four things done before you act and kept up afterwards: identify and verify the customer, identify and verify every beneficial owner behind it, understand the purpose of the relationship, and screen the whole cast against sanctions, PEP and adverse media sources. Then monitor.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

This is part 2 of 2. Part 1 set out the AML/CFT regime: the risk assessment, the compliance programme, record keeping, reporting, training and independent audit. This part is the operational half, the work your staff do at the desk.

The gap between a compliant CDD file and a useless one is rarely effort. It is usually that the firm collected documents instead of forming a view.

What CDD actually has to establish

Strip away the paperwork and CDD answers four questions. Your file should let a stranger answer all four in five minutes.

The fourth is the one that catches things. A holding company with no operations, incorporated by an overseas individual with no connection to Singapore, wanting a registered office and a nominee director and nothing else, is not illegal. It is also a pattern worth understanding before you accept it.

Identifying and verifying the customer

Individuals

Full name, identification number, date of birth, nationality and residential address. Verify against a government-issued identity document, and take a copy that is legible. For Singapore residents, Singpass-based verification is the cleanest route. For overseas individuals, you are relying on a passport copy, so the certification and the liveness of the process matter more.

Non-face-to-face onboarding is normal in this sector and it is not prohibited. It is a risk factor, and it should push the file up a tier rather than be waved through because the client is busy.

Entities

Name, registration number, legal form, registered and operating address, constitutional documents, and the directors and authorised signatories. For a Singapore entity, pull the record from the register rather than accepting the client’s own copy. Our guide to using Bizfile’s search functions before you sign anything covers what is available and what each product will and will not tell you.

For a foreign entity, obtain the equivalent registry extract. Where the jurisdiction does not maintain a meaningful public register, that fact itself is a risk factor and should be recorded as one.

Beneficial ownership: the part that is actually hard

A beneficial owner is a natural person who ultimately owns or controls the customer, or on whose behalf the business is being conducted. Three things follow that firms routinely miss.

It always ends in a human. If your file records the beneficial owner as a BVI company, you have not finished. Keep going up the chain until you reach people.

Ownership is not the only route to control. Someone can control an entity through voting rights, through the power to appoint or remove the board, through a shareholders’ agreement, or through informal influence that everyone in the room understands and nobody has written down. Ask who makes the decisions, not only who holds the shares.

A threshold is a starting point, not a stopping point. Ownership percentage thresholds identify likely beneficial owners. They do not excuse you from identifying a person who plainly controls the entity while holding less. Check the current thresholds in the regulations rather than working from memory or from another jurisdiction’s rule.

Complex ownership chains

Layers are not automatically sinister. Multi-jurisdiction holding structures exist for tax, succession and investor reasons that are entirely ordinary. What matters is whether the complexity has a purpose you can articulate.

Ask directly: why is this structure shaped this way? A client with a genuine reason will tell you, usually in one sentence, and it will make commercial sense. A client who cannot explain their own structure, or whose explanation shifts between calls, has given you information. Record the answer and record your assessment of it.

Draw the chain out on one page and keep it on file. If you cannot draw it, you do not understand it, and you are not in a position to certify anything about it.

Nominees

If a shareholder or director is acting as a nominee, the beneficial owner is the nominator, and separate register and disclosure duties attach. This is the highest-risk corner of CSP work and it is where supervisory attention concentrates. See our note on the tougher penalties for the nominee and controller registers, and on the practical consequences when a nominee arrangement goes wrong, the trapped nominee director’s exit.

Screening

Screen the customer, every beneficial owner, every director, every authorised signatory, and anyone who pays you. Three lists, and they are not interchangeable.

Sanctions and designations. Targeted financial sanctions and terrorist designations. A true match is not a risk rating, it is a stop. Freeze, do not transact, and report. The Ministry of Home Affairs maintains the terrorist designation framework and MAS publishes the sanctions position.

Politically exposed persons. PEP status is not a prohibition and not an accusation. It is a trigger for enhanced due diligence, senior management approval and closer ongoing monitoring. It extends to family members and close associates, and it does not evaporate the day the person leaves office; you assess residual risk rather than applying an automatic cut-off.

Adverse media. Litigation, regulatory action, insolvency, fraud allegations. Searched properly, including in the relevant language and script, because searching a transliterated name in English only will miss most of what matters for a Chinese, Arabic or Cyrillic name.

Record the search you ran, the date, the tool or source, and the outcome including clear results. A screening you cannot evidence is a screening you did not do.

Simplified, standard and enhanced due diligence

Two cautions. Simplified due diligence is a permission, not a default, and it must rest on a documented risk assessment rather than on the fact that the client is a referral from someone you trust. And enhanced due diligence is not “collect more documents”. Its distinguishing feature is understanding source of wealth, which is how the person got rich in the first place, as distinct from source of funds, which is where this particular payment came from. A client can have a clean source of funds and an unexplainable source of wealth.

Higher-risk triggers worth writing into your manual

• Ownership chains crossing jurisdictions with weak beneficial ownership transparency
• Structures with no discernible commercial rationale, or rationale that changes on retelling
• PEPs, their family members and close associates
• Clients who resist identifying beneficial owners, or who supply them slowly and incompletely
• Bearer-style or opaque holding arrangements
• Fees paid by an unrelated third party
• Requests to backdate, to omit, or to file something the client knows to be inaccurate
• Urgency without reason, especially incorporation urgency attached to an imminent banking deadline
• A client whose only requested services are the address and the directorship

Ongoing monitoring

CDD is not an onboarding event. For as long as you act, you are expected to keep the picture current.

In practice that means three habits. Periodic review on a cycle set by risk tier, higher-risk files more often, with the review actually re-running screening rather than re-reading last year’s file. Trigger-based review whenever something changes: a share transfer, a new director, a change of registered activity, a new jurisdiction appearing in the group, a request that does not fit the pattern. And consistency checking, which is simply noticing when the filings you are asked to make stop matching the business you were told about.

The everyday CSP advantage is that you see the changes first, because you file them. Use that. A share transfer instruction is a monitoring event, not just a job.

When to decline, and how to exit

You must decline where you cannot complete CDD. If the beneficial owner will not be identified, or the verification cannot be completed, you do not act. That is not a commercial judgment and a partner cannot override it because the fee is attractive.

Beyond that hard line, declining is a risk-appetite decision that belongs to senior management and should be recorded with reasons. Firms that document their refusals build a far better defence than firms whose files show only the clients they took.

Exiting an existing client is harder than declining a new one, and it is where firms create problems for themselves:

1. Decide and record the decision, with the reasons and who approved it.
2. Consider separately whether the grounds for exit also amount to suspicion. If they do, report before or independently of the exit, not instead of it.
3. Do not tell the client that a report has been made or contemplated. Tipping off is a separate offence. Give a neutral commercial reason for the exit.
4. Deal with the resignation of any nominee directorship and the registered office address properly, filing what has to be filed. Walking away without resigning leaves your people on the register of a company you no longer control.
5. Hand over the client’s records as the engagement terms require, and retain your own CDD records for the full retention period. Exit does not end the retention obligation.

The nominee directorship point is the one that bites hardest. An exit that leaves your appointee sitting on a company you have stopped monitoring is worse than the relationship you were trying to end.

What goes wrong in practice

Documents instead of a view. The file is thick, the passport copies are all there, and nothing in it says what the firm concluded or why. Depth of paper is not depth of diligence.

The chain that stops at a company. The beneficial owner field reads “XYZ Holdings Ltd”. That is an unfinished file, and it is the single most common defect we see when reviewing another firm’s book.

Screening once. Run at onboarding, never again, while designations and adverse media move constantly.

Relying on the bank. “Their bank onboarded them, so they must be fine” is not a control. The bank did its own CDD for its own purposes and will not share it with you, and its risk appetite is not yours.

The referral exception. A long-standing introducer sends a client, and the file is thinner than the manual requires because everyone assumes someone else checked. Write down that reliance on third parties, where permitted at all, does not shift responsibility.

Frequently asked questions

Do I have to identify beneficial owners below the ownership threshold?
You have to identify anyone who ultimately owns or controls the customer. Percentage thresholds catch owners; control can also come from voting arrangements, board appointment rights or agreements. If someone plainly runs the entity while holding a small stake, they belong in the file.

Can I rely on CDD performed by another regulated firm?
Only within the limits the regulations allow, and never as a transfer of responsibility. If you rely on a third party, you must be able to obtain the underlying records promptly, and your firm remains accountable for any deficiency. Most small CSPs find it safer to do their own.

Is a PEP client prohibited?
No. PEP status triggers enhanced due diligence, senior management approval before onboarding and closer ongoing monitoring, including establishing source of wealth. Many PEP relationships are entirely legitimate. What is not acceptable is onboarding one on standard terms because nobody ran the check.

What is the difference between source of funds and source of wealth?
Source of funds is the origin of the specific money used in this transaction, such as the account it came from. Source of wealth is how the person accumulated their overall assets, such as a business sale or inheritance. Enhanced due diligence requires the second, which is harder and more revealing.

How often should I refresh CDD on an existing client?
On a risk-based cycle, more frequently for higher-risk clients, and immediately on any trigger event such as a change of ownership, directors, activity or jurisdiction. A refresh means re-running screening and re-testing the picture, not re-filing the same documents.

What do I do if a client refuses to identify the beneficial owner?
You do not proceed. Refusal to disclose beneficial ownership is both a barrier to completing CDD and a red flag in its own right. Record the refusal, decline or exit, and consider separately whether the circumstances give rise to suspicion requiring a report.

Doing this without it swallowing your week

Good CDD is not slow. It is decisive. The firms that struggle are the ones asking every client for everything, because nobody set the tiers, and then still missing the one file that mattered.

Raffles Corporate Services is a registered CSP and runs this process on its own client book daily. If you want a second pair of eyes on a structure you cannot draw, or on a CDD framework that has grown by accretion, that is a straightforward conversation.

Start with part 1 on the AML/CFT regime if you have not read it, and see how to register as a corporate service provider and what has to go on your CSP client list in Bizfile. ACRA’s own supplementary AML/CFT resource page for CSPs collects the national risk assessments and FATF guidance worth reading in full.

The Editorial Team, Raffles Corporate Services