A Singapore Variable Capital Company (VCC) is directly subject to MAS’s anti-money laundering and countering the financing of terrorism (AML/CFT) rules in MAS Notice VCC-N01. Because most VCCs have no staff of their own, the Notice requires every VCC to appoint an eligible financial institution (EFI), usually the fund manager or a licensed fund administrator or trustee, to carry out the checks and measures that let the VCC comply. The appointment does not move the obligation away from the VCC. MAS expects the VCC’s board to approve the AML/CFT policies used for it, oversee the EFI, and be able to show how the VCC’s own risks are being managed.
This guide is for VCC directors, fund sponsors and family offices using a VCC structure. It explains the split of responsibilities and the practical oversight file a board should keep.
What VCC-N01 requires, in summary
MAS summarises the Notice as requiring VCCs to identify and know their customers (including beneficial owners), conduct regular account reviews, and monitor and report suspicious transactions promptly. The Notice covers internal policies and controls on:
| Area | What it means for a VCC in practice |
|---|---|
| Risk assessment and mitigation | A documented assessment of the money laundering and terrorism financing risks of the VCC’s investors, products, channels and the countries involved, and controls proportionate to those risks |
| Customer due diligence | Identifying and verifying investors and their beneficial owners before accepting subscriptions, enhanced checks for higher-risk investors, and ongoing monitoring, including a register of beneficial owners |
| Reliance on third parties by the EFI | Where the EFI relies on another regulated party’s due diligence, the conditions for that reliance must be met |
| Record keeping | Due diligence and transaction records kept so that they can be produced to MAS and law enforcement |
| Suspicious transaction reporting | Reporting suspicious transactions to the Suspicious Transaction Reporting Office and avoiding tipping off |
The Notice was amended with effect from 1 July 2025. MAS also issues Guidelines to Notice VCC-N01, which set out its supervisory expectations, including on the relationship between the VCC and its EFI. Read the current versions on the MAS website rather than older copies in data rooms.
Who can be the EFI, and what the EFI does
The EFI must be a financial institution of a type permitted under the Notice, typically the VCC’s licensed or registered fund manager, or another MAS-regulated institution such as a trust company or bank providing services to the fund. In a typical structure the EFI:
- onboards investors and performs customer due diligence on them and their beneficial owners;
- screens investors, payments and redemptions against sanctions and adverse information;
- monitors subscriptions, transfers and redemptions for unusual patterns;
- escalates suspicious activity and prepares suspicious transaction reports; and
- maintains AML/CFT records for the VCC and its sub-funds.
Requests such as paying redemption proceeds to a third party are classic red flags; see a VCC investor asks for payment to a third-party account.
What MAS expects of the VCC’s board
In its September 2022 circular following a sector survey and thematic engagements with EFIs, MAS set out observations and supervisory expectations for VCCs and their EFIs. Commentators have highlighted, in particular, MAS’s expectation that the AML/CFT policies and procedures implemented by the EFI are appropriate for the VCC and approved by the VCC’s directors. More recently, MAS Circular IID 04/2025 on the governance and management of VCCs addressed board oversight more generally; see our summary of MAS Circular IID 04/2025.
In practical terms, the board should be able to show:
- Approval. Minutes approving the AML/CFT policies and procedures that the EFI applies to the VCC, and any VCC-specific risk appetite.
- A VCC-level risk assessment. Not just the manager’s group-wide document, but one reflecting this VCC’s investors, sub-funds and jurisdictions.
- Regular reporting. Periodic EFI reports on onboarding volumes, high-risk investors, screening hits, unusual transactions and suspicious transaction reports filed.
- Challenge. Questions asked and followed up when reports show gaps, backlogs or exceptions.
- Testing. Some independent review or audit of the EFI’s work for the VCC, at a frequency suited to the risks.
- A written agreement. An appointment or service agreement setting out the EFI’s AML/CFT duties, reporting lines, access to records and what happens if the EFI is replaced.
These sit alongside directors’ general duties under the VCC Act; see VCC director duties.
A board oversight checklist
| Item | Frequency | Evidence to keep |
|---|---|---|
| EFI appointment and AML/CFT scope | On appointment and on change | Signed agreement, board resolution |
| AML/CFT policies applied to the VCC | On adoption and when amended | Board approval minutes |
| VCC risk assessment | Periodically and on new sub-funds or markets | Dated risk assessment, board noting |
| EFI AML/CFT report | At regular board meetings | Reports and minutes of discussion |
| Register of beneficial owners | Ongoing | Confirmation it is maintained and current |
| Independent review | As the risk profile requires | Review report and remediation tracker |
Common gaps
- The board adopted the manager’s policies without considering whether they fit the VCC’s investors.
- Sub-funds launched for new markets without updating the risk assessment.
- No reporting to the board on screening hits or suspicious transaction decisions.
- Redemptions processed by the administrator without the EFI’s sanctions checks.
- A family office VCC treating family members’ and their companies’ subscriptions as low risk without documenting source of wealth. See what a VCC is and who it suits.
Example
Example only, not a client case. A single family office runs an umbrella VCC with two sub-funds, managed by a licensed fund manager that is also the EFI. The family later invites two outside investors through a third sub-fund. The VCC’s board asks the EFI to update the VCC risk assessment for the new investor base, approves enhanced due diligence for one investor’s offshore holding company, and adds a quarterly AML/CFT report to the board agenda. The minutes record the discussion.
Frequently asked questions
Can the VCC appoint any service provider as its EFI?
No. The EFI must be an institution of a type permitted by the Notice. Check the definition in the current Notice before appointing.
If the EFI makes a mistake, is the VCC liable?
The obligations are the VCC’s, so a failure by the EFI can be a failure by the VCC. That is why board oversight and a clear contract matter.
Do single-investor or family VCCs need all of this?
The Notice applies to all VCCs. The controls should be proportionate to the risks, but they cannot be skipped.
Who files a suspicious transaction report?
Reports are filed with the Suspicious Transaction Reporting Office. The EFI usually prepares and files them for the VCC under the agreed procedures, and must not tip off the investor.
Need help with VCC governance and compliance?
If you are setting up a VCC or reviewing how its board oversees AML/CFT, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133. We help with VCC incorporation, board minutes and resolutions, registers and ongoing ACRA filings, and can coordinate with your fund manager and, where needed, with a firm on our panel of Singapore law firms on regulatory questions. This article is general information, not legal or regulatory advice.
Willie Tan, Raffles Corporate Services