AML Supervision by the Institute of Singapore Chartered Accountants (ISCA)
In a Nutshell
ISCA is a professional body, and its AML/CFT/CPF instrument is Ethics Pronouncement EP 200. EP 200 binds ISCA members and the professional firms they run.
EP 200 is scoped. Its detailed AML obligations bite when a professional firm performs designated high-risk services; where a firm does not, EP 200 still requires a risk-based approach. Not every accounting engagement is a FATF designated activity.
EP 200 and the Accountants Rules are aligned. EP 200 was revised on 1 June 2023 to match the Accountants (Prevention of ML and FT) Rules 2023 that ACRA administers, so the two speak the same language.
Mind the boundary. ISCA is professional oversight of members; ACRA is the statutory supervisor of public accountants and accounting entities. A practitioner can answer to both.
AML Supervision by ISCA
Accountants can lend a veneer of legitimacy to dirty money, structure entities that hide an owner, or move funds through client engagements, which is why the profession is supervised for anti money laundering compliance. For ISCA members, that supervision runs through Ethics Pronouncement EP 200. ISCA is not a statutory regulator like MAS or ACRA; it is the professional body for the accountancy profession, and EP 200 is the mandatory ethics standard through which it holds members to AML expectations. This guide explains how EP 200 works, who it catches, how it fits with ACRA’s statutory regime, and how ISCA monitors and disciplines members.
For the full set of supervisors, see the guide to AML supervisory authorities. For the underlying statutes, see the AML laws and regulations in Singapore pillar. The statutory supervisor of public accountants and corporate service providers is covered in the ACRA supervision guide. This page is about ISCA and EP 200.
What ISCA is and Why it Matters
The Institute of Singapore Chartered Accountants is the national professional body for accountants, setting membership standards and issuing the ethics pronouncements that members must follow. Its authority over AML is professional rather than statutory: it flows from membership and the disciplinary consequences of breaching a mandatory pronouncement, not from a licence to trade. That distinction matters, but it does not make EP 200 soft. For an ISCA member, breaching EP 200 is a professional conduct matter that can lead to disciplinary action, and the standard was developed with the statutory authorities, so it carries real weight.
EP 200, the pronouncement on anti money laundering and countering the financing of terrorism, was first issued in 2014 and has been revised several times, most significantly on 1 June 2023. It is benchmarked to the FATF Recommendations and was developed by an ISCA working group that included MAS, ACRA and the Commercial Affairs Department, so it is aligned with the wider national framework rather than a profession going its own way.
Who is in Scope Under EP 200
EP 200 applies to ISCA members and to the professional firms they own or control. Within that, the depth of obligation depends on what the firm actually does. The revised EP 200 defines a professional firm to include public accountants and accounting entities registered under the Accountants Act, and other entities owned or controlled by professional accountants that provide professional services. The full, detailed AML obligations engage when such a firm performs designated high-risk services, the FATF scoped activities set out in the Accountants Rules 2023.
Where a firm does not perform those designated high-risk services, EP 200 does not simply fall away; it requires the firm to adopt a risk-based approach appropriate to its practice. So, there are two tiers: full AML measures for firms doing designated high-risk services, and a proportionate risk-based baseline for the rest. The covered activities under the Accountants Rules 2023 set out exactly which services are designated, and are the right reference for deciding which tier a firm sits in. This scoping is why two accountancy practices of similar size can carry very different AML burdens.
The Scale of the Scoping
According to the 2024 Money Laundering Risk Assessment Report, based on ISCA’s 2023 membership renewal results, 807 of approximately 29,000 ISCA members declared that they performed FATF scoped services. Of these, 756 were already under existing DNFBP supervisors. These figures illustrate the scope of ISCA’s monitoring role.
From client risk assessments and due diligence to ongoing monitoring and record-keeping, implement effective AML/CFT controls to meet Singapore’s regulatory obligations and support your accounting practice’s compliance with applicable supervisory requirements.
How EP 200 works with the Accountants Rules
The most useful thing to understand about EP 200 is how it dovetails with the statutory rules. The Accountants (Prevention of Money Laundering and Financing of Terrorism) Rules 2023, administered by ACRA, set the statutory AML obligations for public accountants and accounting entities performing designated high-risk services. EP 200, revised from 1 June 2023 and effective from 1 July 2023, was aligned to those Rules, and it requires firms in scope to comply with the Rules 2023 when they perform designated high-risk services. In other words, EP 200 does not create a competing standard; it channels ISCA members to the same requirements and adds the professional conduct obligation to follow them.
ISCA supports this with implementation guidance, including an EP 200 Implementation Guidance FAQ, that helps firms work out whether they are in scope and how to build the required internal policies, procedures and controls. For a member firm, the practical path is to work out whether you perform designated high-risk services, and if you do, comply with the Rules 2023 as EP 200 requires; if you do not, run a proportionate risk-based approach under EP 200.
Either way, EP 200 expects a firm to have internal policies, procedures and controls in place. Under EP 200, the professional firm must develop and implement controls proportionate to its risk, covering how it assesses and accepts clients, performs customer due diligence and ongoing monitoring on scoped engagements, screens for sanctions and politically exposed persons, keeps records, trains its people and reports suspicion. For a small practice, the answer is not a bank sized compliance function; it is a documented, workable programme that matches the services actually offered. The common failing ISCA guidance is designed to prevent is the firm that has no view at all of whether it does designate high-risk services, and therefore no programme and no defence if asked.
How ISCA monitors compliance
The starting point is identification: ISCA needs to know which members and firms perform designated high-risk services, so that it can focus on the population that carries the AML risk. It then monitors compliance with EP 200, supports firms in implementing the requirements through guidance and the implementation FAQ, and can require remediation where a firm falls short. Where a member breaches EP 200, ISCA can investigate and refer the matter into its professional disciplinary process. Because the precise monitoring mechanics, such as how ISCA collects member declarations and risk-rates firms, are administered by ISCA and can evolve, a firm should confirm the current process with ISCA rather than assume it.
ISCA and ACRA: Professional Oversight versus Statutory Supervision
The boundary between ISCA and ACRA is the point this guide most wants to make clear, because the two overlap on the same people. ACRA is the statutory supervisor of public accountants and accounting entities under the Accountants Act and the Rules 2023, and it also supervises corporate service providers. ISCA is the professional body that binds its members through EP 200. A public accountant who is also an ISCA member therefore answers to both: to ACRA as a matter of statutory supervision, and to ISCA as a matter of professional conduct. The two are aligned by design, since EP 200 tracks the Rules 2023, but they are separate channels with separate consequences.
|
Body |
Basis of authority |
What it can do |
|
ISCA |
Professional body; EP 200 binds members |
Monitor, support and discipline members for breaches of EP 200 |
|
ACRA |
Statutory supervisor under the Accountants Act and Rules 2023 |
Inspect, direct and impose statutory consequences on public accountants and accounting entities |
This interlock also extends to other sectors. The Institute of Singapore Chartered Accountants (ISCA) is among the recognised professional accounting bodies whose members may qualify to conduct the external assessment of a pawnbroker’s AML/CFT/CPF policies, procedures and controls required by the Registry of Pawnbrokers. This illustrates how professional accounting expertise can support assurance requirements imposed by a separate sectoral regulator.
The Accountancy Sector and the National Strategy
Singapore’s national risk assessment work treats accountants as gatekeepers whose services can be misused to give illicit funds a clean face or to build the entity structures that obscure ownership. That gatekeeper risk is why the profession is supervised at all, and why EP 200 concentrates its full requirements on the designated high-risk services, which are the ones closest to moving money and forming structures. The 2026 FATF and APG Mutual Evaluation, based on an onsite visit in July 2025, examined the supervision of accountants and noted the roles of both ACRA and ISCA, an overlap the profession should understand rather than be confused by. Any FATF point should be read with the 18 July 2025 assessment cut-off in mind.
Discipline and Enforcement
Enforcement in the accountancy sector runs on two tracks that should not be confused. ISCA, as the professional body, can take disciplinary action against a member for breaching EP 200, with outcomes that bear on the member’s professional standing. ACRA, as the statutory supervisor, can impose the statutory consequences available under the Accountants Act and the Rules 2023 on public accountants and accounting entities. A single failing can therefore attract both a professional disciplinary outcome from ISCA and a statutory consequence from ACRA. The statutory maximums are set by the legislation and should be cited from the Act and Rules at publication, kept separate from any disciplinary outcome. What reduces exposure on both tracks is the same: identify whether you are in scope, comply with the Rules where you are, and evidence a genuine risk-based approach where you are not.
Putting Supervision into Practice
What ISCA looks at
Scoped services: whether the member applied EP 200 to scoped designated high-risk services.
Client due diligence: whether client and beneficial ownership work was done on those engagements.
Risk assessment and records: whether the member has a risk assessment and complete records.
Coordination with ACRA: how the member meets ACRA obligations where both apply.
Worked example (illustrative)
An ISCA member provides company formation support as a designated service but treats it as ordinary bookkeeping and skips due diligence. Under EP 200 that scoped service required CDD; a review would flag the omission.
Compliance cadence at a glance
Event-driven: customer due diligence, screening and reporting on scoped engagements as they arise.
Periodic: risk-assessment refresh and training on the member’s own cycle.
No fixed filing calendar: EP 200 duties are triggered by the engagement, not by a statutory filing date.
Your Reporting Line: STRO
Whoever supervises you, you report suspicion to the same place. File a suspicious transaction report with the Suspicious Transaction Reporting Office as soon as reasonably practicable after suspicion arises, through the SONAR platform. The supervisor changes with the activity; the reporting line does not.
Conclusion
ISCA supervises accountants the way a profession polices itself, through a mandatory ethics standard with real disciplinary consequences. EP 200 is scoped, biting hardest on the designated high-risk services and requiring a risk-based approach elsewhere, and it is deliberately aligned with the Accountants Rules 2023 that ACRA administers. For an ISCA member, the task is to work out which tier the firm sits in, comply with the Rules where the high-risk services are performed, run a proportionate programme where they are not, and remember that ACRA may be supervising the same work from the statutory side. Get the scoping right, and the rest follows.
If you need help deciding whether your firm is in scope or building an EP 200 aligned programme, our AML policy documentation service is built for professional firms, and suspicions go to the Suspicious Transaction Reporting Office.
Establish effective risk assessments, client due diligence procedures and documented internal controls to meet Singapore’s AML/CFT requirements and support compliance with ISCA’s supervisory expectations.
Frequently Asked Questions
EP 200 is the instrument issued by the Institute of Singapore Chartered Accountants on anti money laundering and countering the financing of terrorism. It is a mandatory standard for ISCA members and the professional firms they run, benchmarked to the FATF Recommendations and revised on 1 June 2023 to align with the Accountants Rules 2023.
ISCA members and the professional firms they own or control. The full AML requirements apply when a firm performs designated high-risk services; where it does not, EP 200 still requires a proportionate risk-based approach.
No. Its detailed obligations bite on the designated services set out in the Accountants Rules 2023. Other work is covered by a risk-based approach rather than the full requirements, so not every engagement is a FATF designated activity.
Both, on different bases. ACRA is the statutory supervisor of public accountants and accounting entities under the Accountants Act and Rules 2023. ISCA is the professional body that binds its members through EP 200. A public accountant who is an ISCA member answers to both.
Yes. A single failing can attract a statutory consequence from ACRA and a separate professional disciplinary outcome from ISCA, because the two supervise on different bases even though EP 200 and the Rules are aligned.
EP 200 was revised on 1 June 2023 and took effect from 1 July 2023, aligning it with the Accountants (Prevention of ML and FT) Rules 2023.
ISCA can investigate and take professional disciplinary action, with consequences for the member’s professional standing. Where the same conduct breaches the statutory Rules, ACRA can also act, so the member may face both.
About the Author
Pathik Shah
FCA, CAMS, CISA, CS, DISA (ICAI), FAFP (ICAI)
Pathik is a Chartered Accountant with more than 26 years of experience in governance, risk, and compliance. He helps companies with end-to-end AML compliance services, from conducting Enterprise- Wide Risk Assessments to implementing the robust AML Compliance framework. He has played a pivotal role as a functional expert in developing and implementing RegTech solutions for streamlined compliance.
