KYC Compliance in Singapore: Rules & Process for 2026

Singapore is a major financial hub, making strong customer verification essential. KYC compliance Singapore focuses on identifying customers, assessing risk and verifying business ownership.

Singapore’s 2024 Money Laundering National Risk Assessment identified banks, including wealth management, as the country’s highest-risk financial sector. For KYC Singapore, this increases focus on identity checks, ownership, screening and monitoring.

In 2026, MAS KYC requirements go beyond ID checks. Firms must apply risk-based due diligence, assess ownership, screen for financial crime risks and keep customer data updated.

In this guide, we cover Singapore’s KYC rules, verification process, CDD and EDD, beneficial ownership, AML screening and ongoing monitoring.

What Is KYC Compliance in Singapore?

KYC compliance Singapore refers to the process of identifying customers, verifying their identities and assessing the risks they may present. In practice, KYC Singapore is one part of a broader Customer Due Diligence process that helps regulated firms understand who they are dealing with and whether the relationship creates money laundering, fraud or sanctions risk.

The process typically follows a clear flow: KYC → AML Screening → Risk Assessment → CDD → EDD, with enhanced checks applied where risk is higher. Under MAS KYC requirements, compliance does not end after onboarding. Firms must keep customer information current, review changes in risk and monitor activity throughout the business relationship.

Key Singapore KYC and AML Rules for 2026

Singapore’s KYC framework combines financial regulation, AML laws, beneficial ownership rules and data protection requirements. Businesses managing KYC compliance Singapore should identify which rules apply to their sector and build their compliance process accordingly.

1) Financial Services and Markets Act 2022

The Financial Services and Markets Act 2022 provides an important legal foundation for Singapore’s financial regulatory framework. MAS issues AML/CFT requirements under this Act, including MAS Notice 626 for banks, which sets requirements covering customer due diligence, beneficial ownership, risk assessment, screening and ongoing monitoring.

2) Corruption, Drug Trafficking and Other Serious Crimes Act

The Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992, commonly called the CDSA, addresses money laundering and proceeds of crime. Section 45 also requires suspicious transactions to be reported when there are reasonable grounds to suspect that property is connected with criminal activity, making STR reporting an important part of KYC Singapore controls.

3) Terrorism (Suppression of Financing) Act 2002

The Terrorism (Suppression of Financing) Act 2002 targets terrorist financing and dealings involving terrorist property. Sections 8 and 10 impose duties to provide information concerning terrorist property and related transactions, reinforcing the need for effective customer screening and escalation procedures.

4) MAS AML/CFT Notices and Guidelines

There is no single set of MAS KYC requirements for every regulated business. MAS applies sector-specific AML/CFT notices, such as Notice 626 for banks, PSN01 for specified payment services and PSN02 for digital payment token services, with each framework setting relevant CDD, risk management, monitoring and reporting requirements.

5) Companies Act and ACRA Beneficial Ownership Requirements

Singapore’s corporate transparency rules require most companies, foreign companies and LLPs to maintain and file information on their registrable controllers through ACRA’s Register of Registrable Controllers (RORC) framework. These rules support ownership transparency, but they should not be confused with an institution’s AML obligation to independently identify and verify beneficial owners during KYC compliance Singapore checks.

6) Personal Data Protection Act

KYC involves collecting sensitive identity and customer information, so firms must also consider the Personal Data Protection Act (PDPA). The PDPA establishes requirements around the collection, use, disclosure, accuracy, protection and retention of personal data, helping ensure that information gathered during KYC Singapore processes is handled securely and for appropriate purposes.

When Is KYC Required in Singapore?

The exact trigger for KYC compliance Singapore depends on the regulated sector and the MAS notice that applies. For banks under MAS Notice 626, CDD is generally required when starting a business relationship, carrying out certain qualifying transactions, handling relevant wire transfers, or where money laundering or terrorist financing is suspected.

In practice, KYC Singapore checks may also need to be refreshed when existing information looks unreliable, ownership or control changes, or customer activity no longer matches the original risk profile. Because MAS KYC requirements vary by sector, firms should follow the thresholds and triggers set out in the rules governing their specific licence.

Singapore KYC Compliance Process: 8 Key Steps

A strong KYC compliance Singapore process starts with accurate customer identification and continues throughout the relationship.

Following MAS KYC requirements, firms can structure KYC Singapore checks around these eight key steps.

Step 1: Collect Customer Information

The first step in KYC compliance Singapore is collecting the right information based on the customer type. For individuals, this usually includes name, date of birth, nationality, address and identification details. For businesses, firms may need registration data, business addresses, directors and ownership information.

Simply collecting documents is not enough. Information should be captured in a structured way so it can be checked against reliable sources and used throughout the wider KYC Singapore process.

Step 2: Verify the Customer's Identity

Customer information must then be verified using reliable and independent sources. For individuals, this may involve checking government-issued IDs, validating identity attributes and confirming that the document belongs to the person presenting it.

For companies, verification should confirm legal existence, registration and relevant corporate information. Under MAS KYC requirements for banks, legal-person customers must be verified using reliable independent data, documents or information.

Step 3: Identify Connected Parties and Authorised Persons

For business customers, KYC extends beyond the company itself. Firms should identify relevant directors, executives, partners and other connected parties who may influence or act for the customer.

Under MAS Notice 626, banks must also identify people authorised to act on a customer's behalf. Their identity and authority should be verified so the institution knows who is permitted to make decisions or conduct transactions.

Step 4: Identify and Verify Beneficial Owners

A strong KYC Singapore process should look beyond the legal entity to identify the natural persons who ultimately own or control it. This often requires mapping direct and indirect ownership across multiple layers.

MAS applies a cascading approach: identify owners first, then individuals exercising ultimate control, and finally persons with executive authority if no beneficial owner can be identified through ownership or control. For trusts, relevant parties can include settlors, trustees, protectors and beneficiaries.

Step 5: Conduct AML Screening

Once the relevant people and entities are identified, firms should screen them for financial crime exposure. Under MAS KYC requirements, banks screen customers, beneficial owners, connected parties and authorised representatives where applicable.

Checks may include sanctions, PEPs, watchlists and adverse information. Screening should take place during onboarding and continue periodically, especially when lists, ownership structures or customer information change.

Step 6: Assess Customer Risk

Every customer should be assigned a risk level based on the information collected. A robust KYC compliance Singapore framework can consider geography, customer type, products, delivery channels, transaction behaviour, ownership complexity, PEP exposure and source of funds.

MAS expects banks to assess money laundering and terrorist financing risks across customers, jurisdictions, transactions and services. Current requirements also incorporate proliferation-financing risk into the wider risk assessment process.

Step 7: Apply CDD or EDD

Customers presenting standard risk can generally be managed through proportionate Customer Due Diligence. Higher-risk customers require Enhanced Due Diligence, with deeper checks designed to understand and manage the additional exposure.

EDD may include extra documentation, detailed ownership reviews, source-of-funds or source-of-wealth checks, senior management approval and enhanced monitoring. The depth of review should reflect the customer's actual risk rather than applying the same level of scrutiny to everyone.

Step 8: Monitor the Customer

KYC Singapore does not end once onboarding is complete. Firms should continue monitoring transactions and customer behaviour to identify activity that does not match the expected business model, transaction profile or known source of funds.

Customer information should also be reviewed and updated when circumstances change. Under MAS KYC requirements, higher-risk relationships generally require closer ongoing scrutiny so emerging risks can be detected and addressed early.

Digital KYC Verification in Singapore

Digital onboarding allows businesses to verify customers remotely, but it does not reduce their compliance responsibilities. Under KYC compliance Singapore, firms still need to establish that the customer is genuine, verify identity using reliable sources and apply controls suited to the risks of non-face-to-face onboarding.

A digital KYC Singapore process can combine identity document verification, OCR, biometric face matching, liveness detection, fraud checks, document authenticity analysis and database verification. These tools help firms confirm identity faster while reducing risks such as impersonation, forged documents and synthetic identities.

Under relevant MAS KYC requirements, firms should apply additional safeguards where identity verification takes place electronically. Platforms such as Binderr can support this process by combining document checks, biometric verification, fraud detection and AML screening within a single digital onboarding workflow.

Common KYC Compliance Mistakes in Singapore to Avoid

Even well-designed KYC compliance Singapore processes can fail when ownership, screening or documentation checks are handled incorrectly.

Following the right MAS KYC requirements helps firms avoid gaps across the wider KYC Singapore process.

Checking the Company but Not Its Owners - Confirming that a company legally exists is only one part of KYC compliance Singapore. Firms should also identify and verify the individuals who ultimately own or control the business, especially where layered ownership structures make the true beneficial owner harder to see.

Automatically Treating 25% as the Only UBO Test - A 25% ownership threshold can be useful, but it should not be treated as the only test in KYC Singapore. An individual with a smaller shareholding may still qualify as a beneficial owner if they exercise significant control through voting rights, agreements or influence.

Ignoring Ownership Changes - Ownership structures can change after onboarding, so firms should not rely indefinitely on the original KYC file. Good KYC compliance Singapore includes event-driven reviews when shareholders, directors, controllers or other key ownership details change.

Weak PEP Handling - A PEP alert should trigger a risk-based review, not an automatic approval or rejection. Under relevant MAS KYC requirements, firms may need to assess source of wealth, source of funds, the nature of the relationship and whether enhanced monitoring is appropriate.

Poor Recordkeeping - Good KYC is not only about performing checks, but also proving that they were completed properly. Firms should retain clear records of customer information, verification evidence, screening results, risk decisions and the reasoning behind any escalation or approval.

Applying the Wrong MAS Notice - One common KYC Singapore mistake is assuming the same rules apply to every regulated business. MAS KYC requirements differ across sectors, including banks, payment service providers and digital payment token providers, so firms should follow the notice that applies to their licence and activities.

Bottom Line

KYC compliance Singapore is built around continuous, risk-based due diligence rather than a one-time identity check. Firms need to verify customers, understand beneficial ownership, assess financial crime risk, screen relevant parties and keep customer information current throughout the relationship.

A strong KYC Singapore framework should also reflect the specific rules that apply to the business. Because MAS KYC requirements vary by sector and licence type, organisations should follow the relevant MAS notice and tailor their controls to the risks they actually face.

Binderr Services helps businesses streamline KYC, KYB, AML screening and ongoing monitoring in one compliance platform.

FAQs About KYC Compliance in Singapore