Singapore KYC & AML Compliance Guide 2026

The Shift

Why Singapore institutions are rebuilding KYC workflows after 2023?

On 15 August 2023, Singapore police arrested ten foreign nationals tied to a S$3 billion money laundering network. Proceeds from overseas fraud, illegal gambling, and other serious crime had moved through respected local institutions using falsified documents, opaque corporate structures, and unverified source-of-wealth claims. It remains the largest laundering case in the country's history.

The case did not dent Singapore's standing as a financial centre. It reset the enforcement bar for everyone operating inside it. MAS reviewed the failures and found five patterns that repeat across institutions, and then it built the machinery to catch them.

Five failure patterns MAS identified

Singapore's AML response, on a timeline

Two milestones matter most for how you onboard. The National AML Strategy, published 30 October 2024 by MAS and the Ministry of Finance, set a three-part approach: stronger pre-onboarding prevention, active detection through analytics and inter-agency sharing, and firm enforcement proportionate to the failure at any size of institution.

COSMIC, launched 1 April 2024, changes the maths. It lets financial institutions share customer information where money laundering, terrorism financing, or proliferation financing is suspected with MAS running the hub and DBS, HSBC, OCBC, Standard Chartered, UOB, and Citibank Singapore as founding participants. Suspicious activity one bank cannot see alone becomes visible once shared, so weak controls that used to stay private now surface.

The Enforcement Reality

What MAS actually penalised in July 2025?

On 4 July 2025, MAS fined nine financial institutions a total of S$27.45 million. Every one had written compliance policies. The penalties were not for missing policy they were for execution: procedures applied unevenly, evidence not generated, and governance that tolerated the gap between what the policy said and what staff did.

Scale and reputation did not decide who got fined. The quality of control execution did, and the penalty summaries name four failure categories that map straight to fixes you can make before the next supervisory cycle.

Read the matrix as a self-diagnostic: the right-hand column is what a MAS supervisor expects to find in the file, not what your policy promises.

Before the next supervisory cycle, four questions are worth asking. Can you prove why a customer sits in their current risk tier, who decided, and when? Can you show who reviewed the source-of-wealth evidence for each higher-risk customer, and what they concluded? For every alert closed in the past 12 months, can you produce the case note, the reviewer, and the rationale? And for each higher-risk customer, can you show when EDD was triggered, who approved it, and the review schedule?

Regulatory Architecture

Which MAS framework applies to your institution?

MAS Notice 626 gets most of the coverage in compliance writing, but it applies to banks. Singapore's wider financial sector runs on a network of separate AML/CFT notices, and non-bank institutions routinely under-scope their obligations by treating Notice 626 as the universal reference.

Find your institution type first. The notice that governs you sets the depth of verification, the data-residency question, and the workflow you have to design around.

If your controls were built around Notice 626 and you are not a bank, pull your specific notice and confirm your platform supports its distinct obligations, whether that is PSN01 payment thresholds, DPT Travel Rule workflows, or TCA-N03 beneficial-ownership depth.

Customer Segments

Which Singapore customers need which verification path?

The popular shorthand citizens onboard instantly and everyone else waits is commercially neat and operationally wrong. FIN holders with valid Employment Passes, S Passes, Dependant Passes, and Long-Term Visit Passes can register for Singpass and may hold MyInfo profiles, provided they are 15 or older and hold a valid ICA pass.

MyInfo completeness varies. A recent arrival may have very little government-held data populated, so a path that assumes a full MyInfo profile will break. The design has to route by segment and fall back to documents wherever data has gaps.

Singapore citizen or PR

Singpass / MyInfoBiometric fallback

Holds a valid FIN (EP / S Pass / DP / LTVP)

MyInfo where availableDocument fallback for data gaps

New arrival with an IPA letter

AddressPassportIPA letterEmployment

Non-resident investor or director

PassportSoW / SoFPEP / sanctionsEDD

Corporate entity or UBO

KYBACRABeneficial-ownership trace

The full six-segment model in the guide adds MyInfo eligibility and the exact controls for each path from citizens and PRs through FIN holders, new arrivals with IPA letters, non-resident investors, foreign corporate UBOs, and DPT or PSP wallet users.

The Fraud Threat

What fraud is hitting Singapore onboarding in 2026?

Singapore's identity-fraud picture has changed in two years. Three typologies now drive onboarding-stage losses and each exploits a different blind spot in traditional KYC. A fourth, the digital injection attack, bypasses the camera entirely.

The thread running through all four is simple. A control tuned for a 2020 threat model passes the attacker through. The mule case is the sharpest example, because the document, the face, and the person are all real.

On mules specifically, the Singapore Police Force placed 550 individuals under banking restrictions and 801behavioural under telecommunications restrictions for mule-related activity as of February 2026. The risk signal is not the identity, it is the behaviour. Watch the gap between onboarding and first transaction, the velocity of activity, and the distance between stated occupation and actual account use.

One certification note worth carrying into vendor calls. iBeta PAD Level 1, Level 2 and Level 3 confirm a liveness solution can defeat static images, pre-recorded video, and 3D masks. It does not, on its own, prove defence against modern injection attacks or AI-generated video. Ask for test evidence on deepfake, replay, screen-presentation, and digital-injection attack types specifically.

The 31 December 2026 Deadline

Who must stop using NRIC for authentication, and by when?

On 2 June 2025, MDDI, the Personal Data Protection Commission, and the Cyber Security Agency of Singapore issued a joint advisory: private organisations must stop using NRIC numbers as authentication credentials by 31 December 2026, with PDPC enforcement stepping up from 1 January 2027.

The trap is a single word. Identification is still required. Authentication is what gets banned. Miss the distinction and you either keep an illegal credential live or rip out a number you are still obliged to collect.

The work runs in three phases. Discovery maps every customer-facing flow, backend default, call-centre script, and password-reset path that uses NRIC as a credential. Architecture picks the replacement, biometric with anti-deepfake detection, MFA, or device-bound credentials, and designs accessible fallbacks. Implementation notifies customers, retrains agents, runs parallel systems, and assesses fraud risk, since migration windows see elevated account-takeover attempts. With under eight months left from April 2026, institutions on complex legacy systems that have not started vendor procurement face a real risk of missing the deadline.

Source of Wealth

What source-of-wealth evidence does MAS expect you to verify?

Source of wealth became the defining test of compliance quality after July 2025. Several penalised institutions collected SoW documentation, then failed to show the stated origins were independently corroborated, specific enough to the claimed wealth level, and consistent with the customer's profile and conduct. The gap between collecting a document and assessing it is exactly what MAS acted on.

Two terms get conflated. Source of funds verifies the money behind one transaction. Source of wealth covers the customer's total accumulated wealth, and it is an ongoing obligation that has to be refreshed when circumstances change materially.

MAS does not expect certainty. It expects professional scepticism on the record. Document the discrepancy, the questions you asked, and the resolution. If it cannot be resolved, escalate to the MLRO with a recommendation to continue or exit. The full matrix in the guide runs nine wealth categories, including inheritance, property sales, gifts, offshore corporate proceeds, and trust or family-office distributions.

The Operating Model

What does a compliant Singapore KYC operating model look like?

A compliant model is not one set of steps applied to everyone. It is a tiered, segment-aware system that puts the right depth of verification on each customer type while generating the audit evidence a MAS reviewer expects to find. Ten steps, each owned by a function, each producing a record.

The point of the flow is the last step. If you cannot reconstruct the decision trail later, the work in steps one through nine does not protect you in a review.

Each step has to leave a record the segment rationale, the pathway chosen, the evidence collected and assessed, the risk tier and who approved it, the SoW outcome, the screening results, EDD completion or escalation, and any suspicious-transaction referral. That consolidated case file is what turns a defensible process into a provable one.

Platform Selection

How should you evaluate an IDV platform for Singapore?

Three forces make platform selection a near-term decision, not a 2027 project. The NRIC authentication deadline is fixed at 31 December 2026. MAS has shown that penalties follow execution gaps, not policy gaps. And the fraud environment needs controls that were not standard in platforms built for a 2020 threat model.

The criteria below are written in the language of a compliance evaluator, not a technology buyer. The full sixteen-point scorecard sits in the guide. These are the must-haves that decide a Singapore deployment.

Institutions starting procurement in April 2026 have roughly eight months. Vendor selection and sandbox integration usually take four to six weeks, integration and testing eight to twelve, and parallel running plus training another four to six. Teams that have not started face a material risk of incomplete migration by the deadline.

Where Shufti Fits

How Shufti maps to Singapore's KYC requirements?

Singapore institutions need a platform that routes by customer segment, integrates with Singpass and MyInfo for eligible users, falls back to documents when government-held data is thin, meets MAS TRM data-residency requirements, and produces the audit evidence a supervisor looks for. Shufti is built around those requirements rather than retrofitted to them.

Shufti is a technology platform, not a compliance consultancy. It provides the verification, screening, case management, and audit-trail tooling that lets your team execute its obligations the regulatory interpretation stays yours.

Inside the Full Guide

What the downloadable guide adds?

This page gives you the argument and the frameworks. The 22-page PDF gives you the working tools your team can pick up and run every checklist, matrix, and scorecard in full.