Suspicious Transaction Report Singapore: When to File, How SONAR Works and What Happens Next

Short answer: Any person or business in Singapore that knows or has reasonable grounds to suspect, in the course of business or employment, that property is linked to crime must file a suspicious transaction report with the Suspicious Transaction Reporting Office (STRO) as soon as reasonably practicable. Filing is done online through SONAR, and failing to report is a criminal offence.

A suspicious transaction report in Singapore is not only a banking matter. The duty sits in general criminal law and covers every trade, profession, business and employment. This guide explains who must file a suspicious transaction report (STR), the penalties, how SONAR filing works, what happens afterwards, how reporters are protected, and the red flags to watch for.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

What is STRO and what does it do?

STRO is Singapore’s Financial Intelligence Unit (FIU), part of the Commercial Affairs Department of the Singapore Police Force. It receives and analyses STRs and other financial information to detect money laundering, terrorism financing and other serious crimes, and passes intelligence to enforcement and regulatory agencies.

STRO was set up in January 2000 and is a member of the Egmont Group of FIUs. Besides STRs, it receives cross-border cash movement reports (CMRs) and cash transaction reports (CTRs). The police’s Suspicious Transaction Reporting page sets out the requirements and links to red flag indicators for each reporting industry.

When must a business file a suspicious transaction report in Singapore?

You must file when you know, or have reasonable grounds to suspect, that property is connected to drug dealing or criminal conduct, and the information reached you in the course of your trade, profession, business or employment. The report must be made as soon as is reasonably practicable.

Under CDSA s 45(1), the property may represent the proceeds of such conduct (wholly or partly, directly or indirectly), have been used in connection with it, or be intended for use in connection with it. Four points matter most:

1. The test is objective. “Reasonable grounds to suspect” means you can be in breach if the facts in front of you should have raised a suspicion, even if they did not.
2. It covers all businesses. A manufacturer, consultancy or online seller is caught if the information came through its business, not only banks and regulated firms.
3. The deal need not complete. Section 45(2) requires disclosure whether or not the transaction went ahead, so a declined deal can still need a report.
4. Defences are narrow. Section 45(6) allows a reasonable excuse defence, and s 45(5) protects legally privileged material held by advocates and solicitors and in-house legal counsel, and information arbitrators obtain in arbitral proceedings.

For terrorism financing, section 8 of the Terrorism (Suppression of Financing) Act 2002 (TSOFA) requires every person in Singapore, and every Singapore citizen abroad, who holds terrorist property or has information about a transaction in it, to inform the police immediately. Section 10 adds a duty to disclose information that may help prevent a terrorism financing offence.

What are the penalties for failing to report or tipping off?

Failing to report under CDSA s 45 can lead to a fine of up to S$250,000, 3 years’ imprisonment, or both for an individual, and a fine of up to S$500,000 for a company. Tipping off carries its own penalty.

Offence	Provision	Maximum penalty
Failing to disclose knowledge or suspicion	CDSA s 45(3)	Individual: S$250,000, 3 years, or both. Non-individual: S$500,000.
Tipping off about an investigation or a disclosure	CDSA s 57(1) and (2)	S$250,000, 3 years, or both
Failing to inform the police about terrorist property (learned through business)	TSOFA s 8(3)	Individual: S$250,000, 5 years, or both. Non-individual: the higher of S$1 million or twice the property’s value.
Dealer failing to submit an accurate cash transaction report	PSPM Act s 17(4)	S$20,000, 2 years, or both

Tipping off means disclosing information likely to prejudice an investigation when you know or suspect that a report has been made or an investigation is under way. The danger point is exiting a customer after filing: telling them “we have reported you” is the classic mistake.

Which businesses have sector-specific reporting duties?

Regulated sectors add their own anti-money laundering rules on customer due diligence, internal reporting and record-keeping. The police list more than 15 reporting industries, each with indicators from its regulator.

Corporate service providers

Since 9 June 2025, businesses providing corporate services in or from Singapore must register with ACRA under the Corporate Service Providers Act 2024. The Corporate Service Providers Regulations 2025 require internal policies and controls covering due diligence, ongoing monitoring and reporting (regulation 33), enhanced checks on unusually large or complex transactions with no apparent economic purpose (regulation 26), and record retention for 5 years after the relationship ends (regulation 30). ACRA’s CSP Act page notes fines of up to S$100,000 per breach for the CSP and its senior management. For the full regime, see our CSP Act frequently asked questions and AML/CFT obligations for corporate service providers.

Precious stones and metals dealers

Under section 16(5) of the Precious Stones and Precious Metals (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Act 2019 (PSPM Act), a dealer that cannot complete customer due diligence must decline or end the transaction, decide whether to make a disclosure under CDSA s 45 or TSOFA s 8 or 10, and record the basis for that decision. Dealers also file cash transaction reports, covered below.

Real estate agents and developers

Estate agents and developers are listed reporting industries, and STRO publishes red flag indicators for developers, real estate agents and salespersons. Our guide to setting up a real estate agency company covers the licensing side.

What is a cash transaction report and who must file one?

A cash transaction report is a mandatory report a regulated precious stones and metals dealer must file for every “designated transaction”, whether or not anything is suspicious. In broad terms, that is a deal in which the dealer receives cash above S$20,000.

Under PSPM Act s 15, designated transactions include a single sale paid in cash (or a cash equivalent) above S$20,000; two or more sales to the same customer in one day totalling more than S$20,000 in cash; and a cash purchase above S$20,000 by a dealer that is a secondhand goods dealer from a customer who is not a dealer. The report goes to STRO on Form NP 784 via SONAR, a copy goes to the Registrar of Regulated Dealers, and the dealer keeps a copy (s 17). A CTR does not replace an STR: if the cash deal is also suspicious, file both.

How do you file a suspicious transaction report through SONAR?

The police state that STRs must be filed electronically on SONAR, the STRO Online Notices And Reporting platform. Businesses log in with Corppass and need a SONAR user account.

1. Set up Corppass. A first-time business creates a Corppass administrator, who creates user accounts for SONAR users and selects “SPF E-Services (G2B)”.
2. Register on SONAR. The first user logs in with Corppass and creates a SONAR administrator account under “Account Registration”, then adds users under “User Account Management”.
3. Prepare the facts. Gather identity details, account and transaction references, dates, amounts and a clear narrative of why the activity is suspicious. The form and a filling guide (dated 20 August 2026) are on the police SONAR page.
4. Submit and keep a record. File online and keep the internal decision trail secure and separate from the customer file.
5. Manage the relationship. Decide with your compliance officer whether to continue, restrict or end the relationship, without tipping off.

The police also publish a generic STR form (dated 13 January 2022) stated to be for corporations not covered by AML/CFT regulations and for individuals. If you are unsure which route applies, check with STRO before filing.

What happens after an STR is filed, and how are reporters protected?

STRO analyses the report with other intelligence and, where it detects possible offences, disseminates it to enforcement or regulatory agencies. It may also share what you report with your sector regulator if you are a prescribed regulated person (CDSA s 45(10), in force since 14 November 2024), and with a foreign FIU under confidentiality conditions (CDSA s 48).

The law protects reporters in four ways:

• A good faith disclosure to a Suspicious Transaction Reporting Officer is not a breach of any restriction under law, contract or professional conduct rules, and the reporter is not liable for any resulting loss (CDSA s 45(7)).
• An employee who reports internally under the employer’s procedure has a defence to the s 45 offence (s 45(8) and (9)).
• A person who reports as soon as practicable is treated as not having possessed the information for the CDSA’s money laundering offences in sections 50, 51, 53, 54 and 55A (s 46).
• No criminal or civil proceedings lie for a good faith terrorism financing disclosure (TSOFA s 8(5) and s 10(4)).

Be alert to impersonation. In August 2025 the police warned of scams in which callers posing as STRO officers accuse victims of money laundering and send fake “STRO reports” over WhatsApp, with at least 20 cases and losses of at least S$408,000 since April 2025. STRO will never make unsolicited calls accusing you of laundering money or ask you to transfer money.

What red flags should prompt a business to consider an STR?

One red flag rarely proves anything, but a pattern, or a customer who cannot explain it, should be escalated internally. These are examples, not a complete list.

Area	Warning sign	Why it matters
Identity	Reluctance to provide ID, or documents that look altered	Possible false identity or hidden owner
Ownership	Layered structures across jurisdictions with no clear reason	Can obscure the beneficial owner
Payments	Payments from unrelated third parties, or refunds to a different account	Moves funds without an obvious link
Cash	Large cash payments, or several just below a threshold	Possible structuring to avoid reporting
Profile	Volumes far out of line with the stated business	Funds may not come from the declared activity
Corporate services	Requests for shelf companies or nominee directors with no stated purpose	Shell companies are a known laundering tool
Jurisdiction	Links to countries subject to FATF calls for countermeasures or enhanced due diligence	Higher money laundering and terrorism financing risk

For the wider controls a company needs, see our AML compliance guide for Singapore companies, and try our free compliance tools.

Frequently asked questions

Does my company need to file an STR if it is not a bank or regulated firm?

Yes, if the conditions are met. CDSA s 45 applies to any person who forms the knowledge or suspicion through their trade, profession, business or employment.

Is there a fixed deadline for filing an STR?

The CDSA does not set a number of days. It requires a report as soon as is reasonably practicable, so escalate internally early rather than waiting for certainty.

Will the customer find out that we filed a report?

Not from STRO. Telling the customer, or anyone else, in a way likely to prejudice an investigation can be tipping off under CDSA s 57, so keep the report strictly need-to-know.

Can a client sue us for breach of confidentiality after we report?

CDSA s 45(7) says a good faith disclosure is not a breach of any legal, contractual or professional restriction, and the reporter is not liable for loss arising from it. If you need advice on your own position, speak to a lawyer.

Should I file a police report instead of an STR?

They serve different purposes. An STR gives STRO intelligence; a police report asks the police to investigate a crime, such as one against your business. Sometimes both are appropriate.

Last reviewed: 3 November 2026. The Editorial Team, Raffles Corporate Services.