Which MAS anti-money laundering and countering the financing of terrorism (AML/CFT) notice applies to your licensed entity depends on your specific licence category, and this decision tree branches through capital markets, payment services and fund management licensees to the exact notice and core obligations that attach to you.
Raffles Corporate Services works with a panel of corporate and employment law firms; this article is general information, not legal advice.
Why a decision tree, not another guide
Several general guides already explain MAS AML/CFT requirements for licensed entities in narrative form. This article is deliberately structured differently: as branching yes/no logic, so a compliance officer holding, say, a payment services licence for digital payment token services can skip the sections that apply only to capital markets intermediaries, and land directly on the notice, guideline set and core obligations that actually bind their entity. Start at Question 1 and follow only the branch that matches your licence.
Decision tree: which AML/CFT notice applies to you?
Question 1: What type of MAS licence or registration does your entity hold?
Branch A: Capital markets services (CMS) licence under the Securities and Futures Act 2001.
Branch B: Payment services licence under the Payment Services Act 2019, providing specified payment services other than digital payment token dealing.
Branch C: Payment services licence providing a digital payment token (DPT) service.
Branch D: Bank, merchant bank or finance company licensed under the Banking Act 1970 or Finance Companies Act 1967.
Branch E: None of the above, but you manage or administer a VCC on behalf of a licensed manager.
If Branch A (CMS licence holder): the applicable notice is MAS Notice SFA 04-N02, “Prevention of Money Laundering and Countering the Financing of Terrorism, Capital Markets Intermediaries,” issued under section 16 of the Financial Services and Markets Act 2022. Proceed to Question 2.
If Branch B (payment services licence, non-DPT): the applicable notice is MAS Notice PSN01, “Prevention of Money Laundering and Countering the Financing of Terrorism, Specified Payment Services,” also issued under section 16 of the Financial Services and Markets Act 2022. Proceed to Question 2.
If Branch C (DPT service provider): the applicable notice is MAS Notice PSN02, “Prevention of Money Laundering and Countering the Financing of Terrorism, Digital Payment Token Service.” DPT providers are treated as higher-risk under MAS’s supervisory approach, so expect closer scrutiny of source-of-funds checks and travel-rule compliance on transfers. Proceed to Question 2.
If Branch D (bank or finance company): the applicable notice is the sector-specific AML/CFT notice for banks (commonly referenced as MAS Notice 626 for banks, with equivalent notices for finance companies and merchant banks). Proceed to Question 2.
If Branch E (VCC administrator without your own MAS licence): you are not directly subject to a MAS AML/CFT notice, but your AML/CFT programme will be tested contractually and operationally against the standards the VCC’s licensed manager owes MAS, and gatekeeper AML/CFT obligations may separately apply to you as a corporate service provider. Skip to the FAQs.
Question 2: Do your customer relationships include any higher-risk category?
This includes politically exposed persons (PEPs), customers from jurisdictions with strategic AML/CFT deficiencies, correspondent banking relationships, or complex ownership structures involving nominees or bearer-share entities.
If YES: enhanced customer due diligence (ECDD) applies, meaning senior management approval to onboard, additional source-of-wealth and source-of-funds verification, and more frequent ongoing account review.
If NO: standard customer due diligence (CDD) applies, but you still need to screen every customer and beneficial owner against sanctions and PEP lists at onboarding and on an ongoing basis.
Question 3: Have you identified and verified every beneficial owner holding 25% or more (or otherwise exercising control)?
If NO: your CDD file is incomplete and MAS will treat this as a core finding on inspection; complete beneficial ownership identification before processing further transactions for that customer.
If YES: proceed to Question 4.
Question 4: Do you have a designated compliance officer with day-to-day responsibility for AML/CFT, and is suspicious transaction reporting (STR) escalation tested?
If NO: appoint one and document the escalation chain; MAS notices under both the SFA 04-N02 and PSN01/PSN02 regimes expect a designated function, not an informal arrangement shared across other roles without clear authority.
If YES: proceed to your annual independent audit of the AML/CFT programme, which all licensed entities under these notices are expected to commission periodically.
Who this decision tree is for
This is written for compliance officers, MLROs (money laundering reporting officers), directors and COOs at Singapore capital markets services licensees, payment services licensees (including digital payment token providers), banks, and VCC managers who need to confirm which specific MAS notice governs their AML/CFT programme, and what the core, non-negotiable obligations are under that notice.
Cost and timeline specifics
- Initial AML/CFT policy and risk assessment build: typically S$10,000 to S$30,000 in advisory or legal fees for a mid-sized licensee, more for a DPT service provider given the additional travel-rule and sanctions-screening tooling required.
- Ongoing transaction monitoring and screening software licensing: commonly S$1,500 to S$8,000 per month depending on transaction volume and customer base.
- Independent AML/CFT audit: usually commissioned annually, costing S$5,000 to S$20,000 depending on entity size and complexity.
- Suspicious transaction report filing: STRs must be filed promptly upon suspicion forming, there is no fixed statutory notice period akin to a “within X days” rule for the initial suspicion, but delay in filing after suspicion crystallises is itself a compliance failure MAS will scrutinise.
- Enhanced due diligence file build for a PEP or high-risk customer: typically 1 to 3 weeks of additional review and senior management sign-off before onboarding completes.
Step-by-step process to build a compliant AML/CFT programme
- Identify which notice applies to your licence category using the decision tree above.
- Conduct and document an enterprise-wide money laundering and terrorism financing risk assessment specific to your business model.
- Build and board-approve written CDD, ECDD and ongoing monitoring policies aligned to the applicable notice and its guidelines.
- Deploy sanctions and PEP screening at onboarding and periodically thereafter, with documented escalation triggers.
- Appoint a designated compliance officer or MLRO with clear authority to file suspicious transaction reports without requiring business-line sign-off.
- Train all customer-facing and compliance staff at least annually, with records of attendance and content covered.
- Commission an independent audit of the AML/CFT programme on a periodic cycle and remediate findings with a tracked action plan.
What each notice requires in practice (core obligations comparison)
While the specific notice differs by licence category, the core obligations across Notice SFA 04-N02, Notice PSN01, Notice PSN02 and the banking-sector AML/CFT notices follow a common structure, with the intensity of expectation scaled to risk. Every licensed entity under these notices must: perform customer due diligence before establishing a business relationship, including identity verification of the customer and any beneficial owners; assess and document the money laundering and terrorism financing risk posed by each customer relationship; apply enhanced measures where risk is assessed as higher; conduct ongoing monitoring of transactions against the customer’s expected profile; keep records of identification data and transaction records for at least five years after the relationship ends or the transaction is completed; and file a suspicious transaction report with the Suspicious Transaction Reporting Office promptly once suspicion arises, regardless of transaction value. Digital payment token service providers under Notice PSN02 carry an additional layer: the “travel rule” requirement to transmit originator and beneficiary information alongside DPT transfers above the prescribed threshold, reflecting the higher inherent risk profile MAS has assigned to that sector following successive rounds of supervisory review.
Governance and the three lines of defence
MAS’s supervisory expectation, reflected across all these notices, is that AML/CFT is not solely a compliance-function responsibility. The first line (customer-facing business units) is expected to apply CDD and escalate red flags at the point of contact. The second line (the compliance function, including the designated compliance officer or MLRO) sets policy, screens escalations, and owns the STR filing decision independently of business-line pressure. The third line (internal audit, or an equivalent independent review function for smaller entities) periodically tests whether the first two lines are actually functioning as designed, not merely documented on paper. Entities that collapse these three lines into a single person wearing multiple hats, common in smaller licensed fund managers and payment institutions in their first two years of operation, are a recurring finding in MAS thematic inspections, and building genuine separation, even if thin, before an inspection notice arrives is far cheaper than remediating after one.
Common mistakes and gotchas
The single most common mistake is applying the wrong notice: firms sometimes assume a generic “MAS AML notice” exists and copy a template built for a bank onto a capital markets intermediary, missing the specific customer due diligence thresholds and reporting lines set out in Notice SFA 04-N02. A second mistake is treating beneficial ownership verification as complete once a corporate structure chart is on file, without independently verifying the natural persons at the top of that chart. A third mistake is under-resourcing the compliance officer role so that STR filing decisions get delayed while awaiting business-line approval, which itself becomes a red flag on inspection. A fourth mistake, specific to digital payment token providers, is treating travel-rule data-sharing for DPT transfers as optional rather than a core requirement of Notice PSN02. Finally, entities sometimes assume a licence variation or upgrade (for example moving from a standard payment institution to a major payment institution) automatically carries over the prior AML/CFT risk assessment without a refresh; MAS expects the risk assessment to be revisited whenever the licensed activities or scale materially change.
FAQs
Is there one single “MAS AML/CFT Act” that applies to every licensed entity?
No. AML/CFT obligations are set out in separate MAS notices tied to each licensing Act, such as Notice SFA 04-N02 for capital markets intermediaries and Notices PSN01/PSN02 for payment services licensees, all issued under section 16 of the Financial Services and Markets Act 2022.
What happens if my entity fails to comply with its applicable AML/CFT notice?
For a CMS licence holder, non-compliance can feed into MAS’s power to impose or vary licence conditions under section 88 of the Securities and Futures Act 2001, and in serious cases the lapsing, revocation or suspension provisions under section 95 of the same Act. For a payment services licensee, the equivalent consequence sits in section 11 of the Payment Services Act 2019, covering lapsing, surrender, revocation or suspension of licence.
Does the existing “complete guide” style AML/CFT article on this site cover the same ground as this decision tree?
It covers the same regulatory landscape from a narrative, explain-everything angle. This article is built as sequential branching logic instead, so you can jump straight to the notice and obligations relevant to your specific licence category rather than reading a full guide end to end.
Do VCC managers face a separate AML/CFT notice from their CMS or fund management licence?
No separate VCC-specific AML/CFT notice exists; the manager’s AML/CFT obligations flow from whichever licence it holds (typically a CMS licence or registration as a registered fund management company), with the VCC’s own governance framework expected to reflect those standards operationally.
How often should the AML/CFT risk assessment be refreshed?
At minimum annually, and additionally whenever there is a material change in business model, customer base, product offering, or licensed activities.
Can a smaller licensed entity combine the compliance officer and MLRO roles?
Yes, this is common for smaller licensees, and MAS does not mandate separate headcount for each function. What matters is that the person holding both roles has clear, board-recognised authority to file a suspicious transaction report without needing sign-off from a business-line head, and that the arrangement is documented rather than informal.
Related guides
For governance context on the VCC side, see our related article on VCC Act 2018 auditor appointment and approval requirements. For how MAS’s thematic findings on AML/CFT governance have played out across Singapore’s VCC population, see VCC AML/CFT compliance after MAS Circular IID 04/2025. And if your entity is deciding between an External Asset Manager route and a full CMS licence, our decision tree on MAS External Asset Manager licensing covers the licensing threshold question that determines which AML/CFT notice you will ultimately fall under.
For the primary sources referenced above, see the MAS Notice SFA 04-N02 and the Financial Services and Markets Act 2022 on the Singapore Statutes Online portal.
Need help with this? Call, SMS or WhatsApp +65 8501 7133, or email [email protected]. Raffles Corporate Services works with a panel of corporate and employment law firms; this article is general information, not legal advice.