AML Laws and Regulations for Banks in Singapore

The Guidelines to MAS Notice 626 are the primary guidance a bank works with, and they are given the fullest treatment here. They are dated 28 March 2024 and last revised 1 July 2025, and their chapters mirror the paragraphs of the Notice, so a bank can read each obligation alongside its explanation. They are guidance rather than binding rules, but MAS states plainly that the degree of a bank’s observance may affect its overall assessment of the bank, including the quality of its board and senior management oversight, so in practice they set the standard a bank is measured against.

The Guidelines begin with accountability. They confirm that ultimate responsibility for AML/CFT compliance rests with the board and senior management, who must set a clear risk appetite and a culture in which financial crime is unacceptable. They describe the three lines of defence: business units that identify and control risk, the AML/CFT compliance function that monitors and tests, and internal audit that independently evaluates the framework. The board must receive timely, objective information about the risks the bank faces and whether its controls are adequate.

On the risk based approach, the Guidelines require a bank to assess ML/TF risk not only for individual customers but on an enterprise-wide level, consolidating risk across all business units, products and channels, including overseas branches and subsidiaries for a Singapore incorporated bank.

The enterprise-wide assessment must be approved by senior management, should combine qualitative and quantitative analysis, must incorporate the findings of Singapore’s national risk assessments, and should be reviewed at least once every two years or when a material trigger event occurs, such as a new customer segment, delivery channel or product.

The customer due diligence explains that the verification process should include the use of documents that cannot be replicated, and a bank should obtain background information such as occupation and expected activity.

The beneficial ownership must be pursued as outlined in the guideline. The Guidelines set the widely used benchmark that a beneficial owner is generally a natural person who owns more than 25% of the entity, while making clear that anyone who controls the customer through significant influence is a beneficial owner regardless of any percentage.

The Guidelines give practical treatment of portfolio managers and underlying investors, bearer shares, and listed company exemptions, and they address customer due diligence for non face to face relationships, where a bank should add anti impersonation checks. On timing, verification should generally be completed within 30 business days, with business relations suspended if it is not, and terminated if it remains incomplete after 120 business days.

Screening guidance requires all parties to be screened regardless of risk, sanctions hits to be frozen without delay, and an STR to be filed no later than one business day after suspicion is established in sanctions cases. It expects fuzzy matching calibrated to the bank’s risk, four eye checks on sanctions alerts and real time screening of payment messages before execution.

The enhanced due diligence chapter is central to Singapore’s private banking risk. It defines politically exposed persons in line with the FATF standard and confirms that domestic PEPs include at least Ministers and Members of Parliament.

It draws the important distinction between source of wealth and source of funds: source of wealth is the origin of the customer’s entire body of wealth and how it was acquired, while source of funds is the origin of the particular money involved in the relationship.

A bank should corroborate this information using reliable, independent sources, take a risk based approach that focuses on material or higher risk wealth, and, where it cannot corroborate, assess the residual risk and apply mitigation such as senior management approval and enhanced monitoring.

The Guidelines expect a bank to reject a prospective customer where there are reasonable grounds to suspect the assets are proceeds of serious crime, including wilful foreign tax evasion.

Furthermore, reliance is distinguished from outsourcing, with syndicated facility examples, and the bank always remains responsible. Correspondent banking guidance addresses nested relationships and explains that physical presence means genuine mind and management, not a mere local agent, when testing for a shell institution.

Record keeping, suspicious transaction reporting, and the chapters on the compliance officer’s seniority and independence, audit, employee screening and refresher training at least every two years, complete the picture.

A dedicated chapter on proliferation financing directs a bank to screen against the latest United Nations Security Council lists, freeze without delay and watch for proliferation indicators such as dual use goods and circuitous shipping. Two appendices give worked examples of customer due diligence information by customer type and of suspicious transactions, from cash and trade based patterns to tax crime red flags.

Legal grounding: three lines of defence and governance in chapter 1 to 4; enterprise-wide risk assessment and two-yearly review in chapter 4; beneficial ownership and the more than 25% test in paragraphs 6-8-2 and 6-8-3; non face to face checks in paragraph 6-11; verification timing (30 and 120 business days) in paragraph 6-13-2; screening and one-business-day sanctions STR in paragraph 6 to 15; PEPs and source of wealth versus source of funds in paragraphs 8-4 to 8-5-7; private banking in paragraph 8-6-4; reliance versus outsourcing in chapter 9; correspondent banking in chapter 10; STR timing in paragraph 14-1; compliance, audit and training in chapter 15; proliferation financing in chapter I; examples in Appendices A and B.