What is the history and legal framework for AML in Singapore?
Three dates frame AML in Singapore in 2026. In August 2023 police arrested 10 foreign nationals in what the FATF later called the "3 billion dollar Case". On 4 July 2025 MAS closed its actions against the financial institutions tied to that case, with S$27.45 million in composition penalties on nine of them. On 6 May 2026 the FATF and the Asia/Pacific Group on Money Laundering (APG) published Singapore's mutual evaluation report, based on an on site visit from 1 to 18 July 2025, and placed the country in regular follow up.
The Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 (CDSA) is Singapore's anti money laundering act: ss. 51 and 54 make laundering an offense, and s. 45 sets the duty to report suspicion. The Terrorism (Suppression of Financing) Act 2002 (TSOFA) does that work for terrorist financing. The Monetary Authority of Singapore (MAS) issues most sector Notices under s. 16 of the Financial Services and Markets Act 2022 (FSMA); the trust company Notice still sits under the MAS Act. Singapore is a member of the Financial Action Task Force (FATF), and its AML regulations follow the FATF Recommendations.
Which key AML laws apply in Singapore?
| Law | Latest dated change (in force, November 2026) | What it does for AML |
|---|---|---|
| CDSA 1992 | Amended from 8 February 2024 (Act 15 of 2023), 14 November 2024 (Act 24 of 2024) and 30 December 2025 (Act 21 of 2025); current version dated 17 August 2026 (S 556/2026) | Laundering offenses (ss. 51, 54), the reporting duty (s. 45), tipping off (s. 57), cross border cash reports (s. 60) |
| TSOFA 2002 | Last amended by an Act on 1 July 2022 (Act 17 of 2022); current version dated 26 August 2026 | Terrorist financing offenses (ss. 3 to 6); duty to disclose terrorist property (s. 8) and information about terrorism financing (s. 10); its own tipping off offense (s. 10B) |
| FSMA 2022 | Part 4A (COSMIC) from 1 April 2024; Part 9 (digital token service providers) from 30 June 2025 | The power behind most MAS AML Notices (s. 16) and their penalties |
| Payment Services Act 2019 (PSA) | In force 28 January 2020 (except ss. 111, 113 and 114); last amended 9 March 2025 (Act 5 of 2025) | Licenses payment and digital payment token services, which PSN01 and PSN02 then bind |
| Precious Stones and Precious Metals (Prevention of Money Laundering, Terrorism Financing and Proliferation Financing) Act 2019 (PSPM Act) | In force 10 April 2019, passed without "Proliferation Financing" in its title; scope widened in May 2024 to precious products priced above S$20,000 | Dealer registration, CDD, cash transaction reports and suspicious transaction reports |
| Securities and Futures Act 2001 (SFA) | Last amended 20 October 2026 (Act 24 of 2025) | Licenses the capital markets firms that MAS Notices bind |
| Corporate Service Providers Act 2024 | In force 9 June 2025 | Registration and AML duties for corporate service providers, under ACRA |
| Computer Misuse Act 1993 | Amended from 8 February 2024 (Act 16 of 2023) and 30 December 2025 (Act 21 of 2025) | Computer offenses; the 2023 changes target people who hand SingPass credentials to scammers |
| Personal Data Protection Act 2012 (PDPA) | Last amended 16 October 2026 (Act 2 of 2026) | Limits on using personal data, which frame how customer data is shared |
The old guide called the dealers' Act "PSMTFA" and used "CMCA" for the computer misuse law. For a compliance team, most of Singapore's money laundering regulations sit in two layers: the CDSA binds every person, and the MAS Notices bind each licensed firm. EU directives do not apply in Singapore, so a group with EU business keeps both rulebooks in view.
Who regulates AML in Singapore? The government and regulatory role
The FATF report describes MAS as Singapore's central bank and the "integrated regulator and supervisor of the financial sector". It issues the AML Notices, inspects firms and imposes penalties. The Suspicious Transaction Reporting Office (STRO) is the financial intelligence unit. It receives STRs, cash movement reports and cash transaction reports, and passes intelligence to enforcement and regulatory agencies. Its head also directs the Commercial Affairs Department (CAD) of the Singapore Police Force, the main investigator of laundering.
Banks share risk information through COSMIC, launched by MAS on 1 April 2024 with DBS, OCBC, UOB, Standard Chartered, Citibank and HSBC. It carries information on customers who show several red flags once set thresholds are met, in three risks: misuse of legal persons, misuse of trade finance and proliferation financing. Notice 626 para 8.5 makes a COSMIC bank weigh it when rating a customer.
Who must comply with AML rules in Singapore?
The FATF report names the supervisor for each sector:
- Banks. MAS, under Notice 626.
- Payment service providers. MAS, under PSN01 for specified payment services such as cross border money transfer and money changing, and PSN02 for digital payment tokens; both are licensed under the Payment Services Act.
- Digital token service providers. From 30 June 2025, a firm serving only customers outside Singapore with digital payment tokens or tokens of capital markets products needs an FSMA license, and MAS said it "will generally not issue a licence".
- Insurers, capital markets firms and trust companies. MAS, with one Notice per sector.
- Precious stones and metals dealers, moneylenders, pawnbrokers and law practices. The Ministry of Law (for lawyers, s. 70C of the Legal Profession Act 1966).
- Corporate service providers and accountants. ACRA, the Accounting and Corporate Regulatory Authority.
- Casinos. The Gambling Regulatory Authority (Casino Control Act 2006).
- Real estate agents and developers. The Council for Estate Agencies, and the Urban Redevelopment Authority for developers selling uncompleted property.
What are the key AML compliance obligations under MAS Notice 626?
MAS Notice 626, dated 28 March 2024 and last revised on 30 June 2025 (in force from 1 July 2025), binds banks; the table maps its duties in twelve rows. Money laundering in the Notice includes proliferation financing (para 4.1, footnote 3). Three points from the old guide's checklist frame the rows:
- Risk based approach (para 4). The risk assessment sets how deep customer due diligence goes for each customer.
- Third parties (paras 9.2 to 9.5). A bank may rely on a supervised third party for CDD, never for ongoing monitoring, and stays responsible for its obligations.
- Technology. Para 6.42 requires screening results to be documented, so the screening system has to keep them.
In the fourth column, complead, formerly Sanction Scanner, sets out its control for each duty.
| Obligation | Legal basis (Notice 626 as revised 30 June 2025, in force November 2026, unless stated) | What a program must do | How complead does it |
|---|---|---|---|
| ML and TF risk assessment | Paras 4.1 to 4.3 | Identify, assess and document money laundering and terrorism financing risks by customer, country, product and channel, digital tokens included; senior management approves the policies. | Rules can be scoped per product, segment or jurisdiction, so the controls follow the categories the risk assessment uses. |
| Customer due diligence | Paras 6.3, 6.4 | CDD when a relationship opens. For walk in customers: any transaction above S$20,000, any digital token transaction, any domestic wire, cross border wires above S$1,500 and any digital token value transfer. Also on suspicion of money laundering or terrorism financing, or doubts about earlier information (6.3(f), (g)). Linked transactions count together (6.4). | Customer risk assessment and KYC leaves each customer with one risk score, and every search behind it is logged. |
| Beneficial owners | Paras 6.13 to 6.15; Guidelines 6-8-2, 6-8-3 | Identify the natural persons who ultimately own or control the customer. The Guidelines give more than 25 percent only as an example ("e.g."), and a person who controls the customer without that shareholding is also a beneficial owner. | KYB and UBO verification follows owners, parents and controlling entities up the chain until natural persons are reached; any layer it cannot resolve is flagged as unresolved in the report. |
| Politically exposed persons | Paras 8.2 to 8.4 | Check whether the customer, its agents, connected parties or beneficial owners are domestic, foreign or international organization PEPs, or their family members or close associates. Where the customer or a beneficial owner is such a person, senior management approval, source of wealth and funds, and enhanced monitoring follow (8.3). A risk based approach may apply to domestic and international organization PEPs and to PEPs who stepped down, unless the relationship is higher risk (8.4). | A PEP match feeds the customer's one risk score; a person makes the call, and the case keeps the name of who made it. |
| Higher risk customers | Paras 8.5 to 8.8; Guidelines 8-5-7 | Enhanced due diligence (EDD) for higher risk relationships, with source of wealth and funds corroborated; COSMIC banks weigh what COSMIC returns (8.5). | Because onboarding, screening and monitoring share one engine, the higher risk rating and the EDD findings land on the same customer score. |
| Ongoing monitoring | Paras 6.19, 6.20, 9.3 | Monitor the relationship and scrutinize transactions against what the bank knows of the customer; never rely on a third party for it. | API triggers start and stop ongoing monitoring per name, so a name that no longer matters drops out of screening. |
| Screening and sanctions | Paras 6.39 to 6.42; Guidelines 6-15-2 | Screen customers, their agents, connected parties and beneficial owners, including against lists from MAS and other Singapore authorities. On a sanctions hit, freeze without delay and without prior notice under the TSOFA and the FSM Sanctions Regulations (DPRK and Iran, per the Guidelines), report the assets promptly and file an STR no later than 1 business day after suspicion was first established. | Every name is screened on a data set of 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. No match results stay in the log too. |
| Wire and value transfers | Paras 11.4, 11.5, 11A | Cross border wires carry names and account numbers at any amount; above S$1,500 they add the originator's address, ID number or birth date. Digital token transfers follow the travel rule in para 11A. | While a transfer is processed, transaction screening runs both parties, sender and receiver, through the API. |
| Suspicious transaction reports | CDSA s. 45(1); para 14.2; Guidelines 14-1 | Report to STRO "as soon as is reasonably practicable" at any amount, attempted transactions included; within 5 business days of suspicion, 1 for sanctioned parties; a copy to MAS on request; no tipping off (CDSA s. 57). | Regulatory compliance reporting support sits within case management, and each alert shows which rule fired and which signals matched. |
| Information sharing | FSMA Part 4A; paras 8.2, 8.5 | Participating banks share risk information through COSMIC once set thresholds are met. | COSMIC is a MAS platform between banks, outside complead; inside the bank, the connections graph searches up to six hops around a customer for sanctioned, PEP or adverse media links, each hop sourced. |
| Record keeping | Para 12.3 | Retain CDD information and transaction records for at least five years from the end of the relationship or the completion of the transaction. | For every check, the search audit trail stores the searcher, the search term, the time and the result. |
| Compliance, audit and training | Paras 15.10, 15.12 to 15.14 | An AML/CFT compliance officer at management level, independent audit, screening of new hires and regular training. | The rule change log gives an independent auditor each threshold's history with the reason for every change. |
Which thresholds apply in 2026?
Each Notice sets its own lines, so a bank and a remittance arm in one group run different triggers. PSN01 and PSN02 are both dated 2 April 2024 and were revised on 30 June 2025. For walk in customers, PSN01 lowers the transaction line to S$5,000 and checks every cross border transfer, while PSN02 has no minimum at all.
Outside the Notices, anyone moving cash or bearer negotiable instruments worth more than S$20,000 into or out of Singapore files a cash movement report (CDSA s. 60). Cash received from abroad above that amount is reported within five business days.
| Rule (walk in customers unless stated; revised 30 June 2025, in force November 2026) | Notice 626, banks | PSN01, specified payment services | PSN02, digital payment tokens |
|---|---|---|---|
| CDD on a transaction | Above S$20,000 (6.3(b)) | Above S$5,000, except a specified money changing transaction funded from an identifiable source (7.3(d)) | Any transaction (6.3(b)) |
| CDD on a transfer | Any domestic wire; cross border wire above S$1,500 (6.3(d)) | Any cross border wire or money transfer (7.3(b), (c)) | Any digital payment token transfer (6.3(c)) |
| Full originator data | Cross border wires above S$1,500 (11.5) | Cross border wires above S$1,500 (15.6) | Value transfers above S$1,500 (13.6) |
| STR | Any amount, copy to MAS on request (14.2) | Any amount, copy to MAS on request (18.2) | Any amount, copy to MAS on request (16.2) |
How fast must a suspicious transaction report reach STRO?
The statute sets no number of days. CDSA s. 45(1) asks for a disclosure "as soon as is reasonably practicable" once the suspicion reaches a person at work, completed transaction or not (s. 45(2)). Lawyers and in house counsel need not disclose legally privileged material, nor arbitrators what they learn in arbitral proceedings (s. 45(5)). Reporting through the employer's internal procedure is a defense (s. 45(8)).
The Guidelines to Notice 626, paragraph 14-1, set the clock: within 5 business days after suspicion was first established, unless the circumstances are exceptional or extraordinary, and within 1 business day for sanctioned parties and anyone acting for them or under their direction.
Picture suspicion confirmed on a Wednesday, two days after an analyst flagged the payment. With no public holiday in between, the report is due by the next Wednesday, or by Thursday for a sanctioned party. It goes through SONAR as a suspicious transaction report. Tipping off is an offense under s. 57; lawyers and legal counsel may still advise a client or act in legal proceedings, never to further an illegal purpose (s. 57(3) to (5)).
What are the money laundering risks in Singapore?
Picture a shell company set up through a corporate service provider, owned by a trust formed abroad, that takes in scam proceeds from three countries and buys a condominium. Each step touches a risk the old guide named.
The evaluators call Singapore "a passthrough/integration point" for proceeds of crimes committed abroad, and they write that its "main ML threat is fraud", with cyber enabled fraud the highest risk. The old guide's six risks still hold:
- Trade based laundering through trade finance.
- Shell companies and offshore entities that hide ownership.
- Cross border transactions through correspondent banking and remittance.
- Real estate, where high values absorb large sums.
- Virtual currencies and fintech, now under PSN02 and FSMA Part 9.
- Corruption proceeds.
Beneficial ownership is the weak spot. The report rates transparency of legal persons and arrangements (IO.5) as Moderate, and R.24 and R.25 as Partially compliant.
What are the penalties for AML noncompliance in Singapore?
| Offense or breach | Basis | Maximum (in force, November 2026) |
|---|---|---|
| Laundering, individual | CDSA s. 51(5), s. 54(5) | S$500,000 or 10 years or both |
| Laundering, any person who is not an individual (rash and negligent laundering included) | CDSA s. 51(7), s. 54(7) | S$1 million or twice the value of the benefits from criminal conduct, whichever is higher |
| Rash laundering, individual (from 8 February 2024) | CDSA s. 51(1A), (6)(a); s. 54(3A), (6)(a) | S$250,000 or 5 years or both |
| Negligent laundering, individual (from 8 February 2024) | CDSA s. 51(1A), (6)(b); s. 54(3A), (6)(b) | S$150,000 or 3 years or both |
| Laundering serious scam proceeds, individual (from 30 December 2025) | CDSA s. 51(8), (9); s. 54(8) | Up to 12 strokes of the cane on top of the s. 51(5) or s. 54(5) penalty, unless the accused proves reasonable steps; that defense is not open for laundering one's own proceeds (s. 54(1)) |
| Failure to report | CDSA s. 45(3) | Individual: S$250,000 or 3 years or both; any other person: S$500,000 |
| Tipping off | CDSA s. 57(1), (2) | S$250,000 or 3 years or both |
| Unreported cross border cash above S$20,000 | CDSA s. 60(2) | S$50,000 or 3 years or both |
| Breach of a Notice issued under the FSMA | FSMA s. 16(4) | S$1 million, plus S$100,000 for every day or part of a day the offense continues after conviction |
| Breach of a Notice still under the MAS Act (trust companies) | MAS Act s. 27B(2) | S$1,000,000 per offense |
Two tracks run side by side. Prosecutors bring CDSA charges in court, and the Minister, or a person the Minister authorizes, can instead compound CDSA offenses prescribed as compoundable (s. 81). MAS compounds Notice breaches with composition penalties, and it also issues prohibition orders and revokes licenses. The Padang Trust release spells out the mechanism: each breach of the trust company Notice is an offense under MAS Act s. 27B(2), compounded under s. 176(1A) of the MAS Act 1970.
Recent enforcement by MAS, including the S$3 billion case
Read the 4 July 2025 decision first. MAS found that all nine firms "did not detect or adequately follow up on significant discrepancies or red flags" that should have cast doubt on some customers' purported source of wealth. Eight failed to adequately review transactions their own systems had flagged as suspicious. The 2023 case sits among the biggest money laundering scandals, yet MAS's findings name everyday controls, among them source of wealth checks at all nine firms and alert reviews at eight.
| Firm | Date | Action | What MAS found or alleged | Source |
|---|---|---|---|---|
| Nine institutions, including Credit Suisse Singapore Branch (S$5.8m), UOB (S$5.6m) and UBS Singapore Branch (S$3m) | 4 July 2025 | S$27.45 million in composition penalties | Source of wealth red flags missed by all nine; flagged transactions not adequately reviewed at eight | MAS release (linked above) |
| Five major payment institutions, including Remsea (S$280,000) | 27 June 2025 | S$960,000 in composition penalties | PSN01 breaches; Remsea omitted originator information from wire transfer messages | MAS release |
| Capital Asia Investments | 9 March 2026 | Joint police and MAS operation on 5 March; police seized more than S$160 million | Suspected laundering under CDSA s. 54; MAS found serious control failings against its AML requirements | MAS release |
| Two former relationship managers from the 2023 case | 17 March 2026 | Prohibition orders of 16 and 7 years | Convictions for forgery, laundering and obstruction, and for using a forged document | MAS release |
| Padang Trust Singapore | 25 May 2026 | S$300,000 composition penalty | No inquiry into unusual transactions with no apparent economic or lawful purpose; STRs not filed promptly | MAS release |
| Sir Money Changer | 14 October 2026 | Major payment institution license revoked from 15 September 2026 | A third party ran a cross border transfer business under its name; false or misleading information to MAS | MAS release |
How do AML solutions for Singapore handle screening and monitoring?
When MAS inspects, it reads the record: which names went against which list, what rule raised the alert and who closed it. Any AML software a Singapore firm runs has to produce that record; complead writes it as the work happens.
Client screening and ongoing monitoring logs every AML check with who searched, what was searched, when and the result, no match results included, which is the documentation para 6.42 asks for. Payment screening takes both sides of a Singapore dollar or foreign currency transfer through the API while it is processed.
Take an illustrative remittance firm licensed under the Payment Services Act and bound by PSN01. Its team wants sanctions lists matched more loosely than watchlists, so it gives them a lower fuzzy matching threshold; complead lets the threshold differ per list type and per individual list. Its S$5,000 walk in line and its S$1,500 originator data line become rules in transaction monitoring, written without code and backtested against the firm's own history over 30, 60 or 90 days before they go live. Agents clear the routine alerts, and each closed alert carries its evidence, a narrative and a work log. The compliance officer takes what is left, decides whether to file on SONAR, and the case keeps the name of the person who signed.
What changed in Singapore AML in 2025 and 2026, and what comes next?
- 9 June 2025. The Corporate Service Providers Act 2024 takes effect.
- 30 June 2025. Digital token firms serving only overseas customers need an FSMA license.
- 1 July 2025. Revised Notices and Guidelines take effect, with changes on beneficial ownership, proliferation financing and digital token transactions.
- 4 July 2025. MAS ends its actions against firms tied to the 2023 case: S$27.45 million on nine.
- 30 December 2025. Caning of up to 12 strokes for laundering serious scam proceeds (CDSA s. 51(8)).
- 6 May 2026. The FATF and APG publish the evaluation.
- 14 October 2026. MAS announces the Sir Money Changer revocation.
Regular follow up comes next. The report rates 7 of 11 effectiveness outcomes Substantial and 4 Moderate (IO.5, IO.7, IO.10, IO.11), with 24 Compliant, 14 Largely compliant and 2 Partially compliant technical ratings. Its roadmap opens with IO.5: sharper risk assessments of legal persons and arrangements, unregistered foreign companies and trusts formed abroad among them, and more accurate ownership data in ACRA's registers.
That leaves your team one decision: where the 5 business day STR clock starts in your workflow. Guidelines 14-1 count from the moment suspicion is first established, so the case file should record that moment on its own, apart from the alert date.
What the 2026 PDF adds. Every rule above stays open on this page. The PDF from the form beside it is built for the compliance file: a 14 item program checklist keyed to the Notice paragraphs, a customer risk factor template for Singapore and a suspicious transaction decision record with a line for "report or not", so a case that was reviewed and not reported still leaves a trace.
