Ultimate Guide: Customer Due Diligence Requirements for Singapore Business

How can one clear, practical CDD framework stop clever financial crime before it starts?

This present-day guide explains what customer due diligence is, why it matters, and how regulated entities operationalise it across onboarding, transactions and ongoing monitoring. It sets practical expectations for financial institutions, payment service providers, DNFBPs and other institutions with AML obligations.

Covers the risk-based approach that scales controls by product, geography and channel. Readers will learn the end-to-end process: identity verification, beneficial ownership checks, understanding purpose and nature of the relationship, and transaction surveillance over time.

Expect clear guidance on Enhanced Due Diligence for high-risk profiles, record retention (typically at least five years) and relevant updates to local regulations, including CDSA, MAS supervision and STRO reporting. The aim is practical outcomes: avoiding regulatory breaches, reducing exposure to money laundering and fraud, and keeping audit-ready documentation.

Key Takeaways

• Understand core cdd steps and when to apply EDD.
• Apply a risk-based model that scales with exposure.
• Keep records for the statutory retention period and stay audit-ready.
• Align processes with MAS, CDSA and STR obligations.
• Make compliance continuous with monitoring and periodic refreshes.

Customer Due Diligence in Singapore: definition, purpose, and why it matters

Practical identity and risk checks form the backbone of any robust anti-money laundering framework.

Definition: CDD is the structured checks used to know who a client is, how they will use services, and what risk they pose to institutions.

CDD sits under KYC within wider AML programmes. It drives onboarding controls, transaction monitoring, escalation and reporting.

How it fits within KYC and AML

KYC focuses on identity and risk understanding. AML covers the full compliance lifecycle, including surveillance and STRs.

CDD is the operational engine that collects identity data from declarations, public registries, sanctions lists and trusted third-party databases.

How CDD prevents illicit activity

Effective checks stop criminals from placing, layering and integrating illicit money and reduce exposure to financing typologies.

• Apply baseline checks for lower-risk profiles and enhanced measures for PEPs or sanctions-listed entities.
• Use verified documents — passports, driving licences, incorporation papers — and maintain a clear audit trail.
• Proportionate CDD reduces fraud losses and speeds investigations by documenting decisions and outcomes.

Who must comply with AML and CDD requirements in Singapore

Regulated oversight covers a broad set of licence‑holders and professional firms that handle money, assets or client funds.

Financial institutions, banks and securities firms

Banks and securities firms are central to AML control frameworks. They manage high‑value accounts and complex transactions that need identity checks at onboarding and during activity reviews.

Payment service providers and digital platforms

Payment firms, e‑money issuers and digital token services face wallet onboarding and transfer monitoring. Remote, non‑face‑to‑face onboarding is still subject to the same verification expectations.

Designated non‑financial professions and other sectors

Law firms, accounting practices, estate agents and dealers in precious metals must apply proportionate checks when they accept instructions or hold client funds.

Casinos, money transfer and trust or corporate service providers

Casinos, domestic and cross‑border money transfer companies, trust companies and corporate service providers are in scope because they move value or enable corporate structures that can be misused.

“Regulators focus on sectors that handle high‑value transfers, facilitate movement of funds, or enable corporate opacity.”

Controls must be tailored by entity type, product and client profile. Outcomes should align with local regulations while reflecting sector specifics.

For implementation details and internal policy pointers, read our privacy guidance.

Key regulators and oversight bodies for CDD in Singapore

Oversight combines central banking supervision with specialised regulators that target casinos, estate agents and corporate service providers.

Monetary Authority of Singapore (MAS)

MAS acts as the integrated financial regulator. It issues licensing conditions, conducts supervisory inspections and publishes AML/CFT guidance and sector notices.

Supervisory reviews typically check policy adequacy, evidence of monitoring, file quality and how teams escalate concerns. Inspectors look for clear ownership of procedures and easy retrieval of records.

Other sector regulators

The Casino Regulatory Authority oversees gaming operators, while the Council for Estate Agencies governs property agents. ACRA supervises registration and corporate service providers, and influences audits for public accountants.

Each regulator applies a tailored rulebook and inspection style. Firms should map which authority covers them and align controls to that framework.

• Regulators expect a risk-based model and will assess proportionality, not just checklists.
• Clear documentation of decisions, monitoring logs and retrievable files are central to good compliance.
• Guidance is living: update procedures as risk and industry practice evolve.

Singapore’s AML legal framework shaping CDD duties (present‑day updates)

Legislative changes in 2024 sharpened enforcement tools and clarified reporting lines for regulated firms.

Key statutes and strategy documents now form the operational map for frontline controls. The Corruption, Drug Trafficking and Other Serious Crimes Act (CDSA) remains the core reporting law: firms must detect suspicious activity, document the rationale for decisions, and file timely reports with the authorities.

Corruption, Drug Trafficking and Other Serious Crimes Act (CDSA)

Operationally, the CDSA means active monitoring, clear logging of alerts and prompt reporting when indicators meet the reporting threshold.

Records and investigation notes should show why a transaction was escalated or closed, not rely on informal judgement.

Anti‑Money Laundering and Other Matters Act 2024

This Act strengthens enforcement and aligns casino controls with FATF standards.

It raises expectations for handling property, expands investigative powers, and increases penalties for serious money laundering offences.

National AML Strategy 2024

The Strategy drives more coordinated prevention, detection and international cooperation.

Expect pressure for intelligence‑led controls in higher‑risk sectors and for evidence of outcome‑based compliance rather than box‑ticking.

“Compliance is judged by outcomes: effective risk identification, timely escalation and demonstrable monitoring — backed by records.”

MAS notices and practical compliance markers

Firms should apply the MAS notice relevant to their licence as the primary benchmark (626, 1014, 824, PSN01, PSN02). These notices guide what to capture at onboarding, what monitoring thresholds to set, and what documentation will satisfy supervisors.

Implementation note: regulatory changes should prompt updates to procedures, training modules and monitoring rules. For internal policy alignment, consult our terms and conditions.

customer due diligence requirements singapore business: what regulated entities must do

Practical controls require firms to set trigger points for verification at onboarding, during certain transfers and whenever risk shifts.

When checks are required across the lifecycle

Must‑do triggers include onboarding new clients, executing higher‑risk transactions and refreshing details during an ongoing relationship.

Checks are not one‑off. Repeat verification when profile data is old, behaviour deviates from the expected pattern, or intelligence raises concern.

How expectations scale with size and complexity

Smaller firms must still show effective controls, but the depth of recordkeeping and system sophistication should be proportionate to risk and volume.

Large volumes often need automation for screening, alerting and audit trails. A risk‑based model helps select the right level of control — it is mandatory, not optional.

Design auditable procedures that state who performs checks, what evidence is kept, how decisions are logged, and who approves exceptions.

Timing note: Service speed pressures are real, but do not start a relationship until adequate verification is completed where required. This section bridges regulator obligations and hands‑on workflows in later chapters.

The core components of an effective CDD programme

Four pillars make CDD operational and auditable.

Identify and verify

For individuals, collect name, address, nationality and reliable ID documents such as passports or national ID. For entities, capture incorporation documents, list of directors, shareholders and the operating address.

Beneficial ownership and control

Identify persons owning 25% or more, or those who exert control. Shell companies and nominee structures increase risk. Record search steps, registry extracts and interview notes that support ownership conclusions.

Purpose and nature of the relationship

Assess expected product usage, typical transaction volumes, source markets and the rationale for the relationship. This creates a clear risk profile and flags implausible activity early.

Ongoing monitoring and refresh

Monitoring is not just payments surveillance. It includes periodic refreshes of customer information and reassessment when behaviour changes.

Align review frequency to the risk rating assigned at onboarding and whenever alerts arise.

“A consistent programme reduces operational friction by standardising evidence and exception handling.”

Embedding into a programme: policies, controls, approval gates, recordkeeping and periodic quality assurance ensure consistent assessment by frontline teams and compliance functions. Use standard evidence lists to speed decisions and cut manual review time.

Risk-based approach to CDD and customer risk assessment

Use simple, repeatable scoring to turn disparate data points into an operational risk ranking.

Build profiles from concrete inputs. Start with product features (cash-like, fast transfers, anonymity), geography (cross-border exposure, high-risk jurisdictions), channel (non‑face‑to‑face onboards) and observable behaviour. Combine these into a compact score that guides next steps.

Triggering deeper review with thresholds and red flags

Set transaction thresholds and behavioural rules that step work up to enhanced checks. Examples of red flags:

• Sudden volume spikes or rapid in/out movements.
• Complex layering patterns or multiple small transfers to different jurisdictions.
• Inconsistent explanations for source of funds or account activity.
• Unreliable documents or indicators of identity anomaly.

Mapping risk levels to review frequency

Low scores need light monitoring and annual refresh. Medium scores require periodic reviews and alert tuning. High scores demand more frequent refresh cycles, additional approvals and possible enhanced screening.

Document everything. Record the assessment rationale, evidence used and any score changes. Test and tune models regularly to cut false positives and close blind spots.

Good governance links senior management risk appetite with compliance ownership of methodology and exception approvals.

CDD onboarding workflow: a practical, compliant process

A practical onboarding flow balances speed and verification, so teams can spot risk without blocking legitimate activity.

Collecting identity details and documents

Start with essentials: full name, date of birth, address and national ID for individuals; incorporation details, directors and registered address for entities.

Request reliable evidence: passport, driving licence, utility bill, business licence or incorporation extract. Tailor requests to risk to avoid unnecessary friction.

Verifying information with trusted sources

Use authoritative registries, screening databases and document-authenticity checks. Cross‑check names, addresses and licence numbers.

Where remote onboarding occurs, apply stronger verification or electronic ID services with liveness checks.

Creating, storing and retrieving records

Store copies of IDs, screening results, risk scores and approval notes. Index files by account ID and date to speed retrieval for MAS or other inspections.

Handling unreliable or incomplete information

Pause onboarding if documents are inconsistent. Escalate to a senior reviewer for further evidence or EDD. Refuse or exit relationships when verification fails.

Tip: design the process to minimise cycle time while preserving compliance and auditability.

Sanctions screening, adverse media checks, and watchlist controls

Watchlist checks and media screening form an ongoing shield against sanctioned parties and emerging crime indicators.

Purpose: Sanctions screening uses government‑published and international lists to prevent access by designated persons. Watchlist controls must run continuously — not as a one‑off — so new matches surface as lists and intelligence change.

Operational screening moments

Screening should occur at onboarding, during periodic refresh and in near‑real‑time when identifying information changes. Integrate automated checks with manual review to balance speed and accuracy.

Handling potential matches

Apply triage logic: automated name normalisation, fuzzy matching and contextual filters reduce false positives.

• Investigate matches with source information and corroborating records.
• Document investigation steps, timestamps and the final disposition.
• Escalate verified hits to senior compliance and legal for action.

Adverse media and criminality indicators

Use credible sources: established news outlets, official court records and law enforcement releases. Assess relevance by recency, direct link to the individual or entity, and corroboration.

Avoid overreliance on unverified claims. Treat adverse media as a risk signal that can trigger enhanced checks, not an automatic exclusion without verification.

“Effective screening reduces exposure to financial crime and supports defensible outcomes during regulatory reviews.”

Governance and evidence: Keep list versions, screening timestamps and analyst notes in the audit trail. This shows regulators that monitoring was active, methodical and defensible.

Politically exposed persons and high-risk customers: when Enhanced Due Diligence applies

High‑profile public roles create elevated laundering and corruption risks that require extra checks and controls.

Who counts as a PEP and why that matters

Politically exposed persons include senior public officials, prominent politicians and judges. Close associates and immediate family members are treated the same, because influence and access can be channelled through them.

PEP status increases exposure to bribery, corruption and complex money flows. That higher risk triggers an enhanced approach to verification and monitoring.

The EDD decision path and recordkeeping

Identification starts with screening and plain‑language declarations. If a match appears, document the screening output, analyst notes and the final classification.

Keep a clear audit trail showing who made the call, why, and what further checks were ordered.

Senior management approval and assessing funds

Any new or continuing relationship with a PEP should require senior sign‑off. Approval must include a written rationale, risk acceptance limits, conditions and a review date.

Establishing source of wealth and source of funds needs pragmatic evidence: employment records, tax returns, sale agreements or bank statements. Evaluate plausibility against known roles and declared income. Where gaps remain, record the gap and impose controls or decline the relationship.

Enhanced monitoring expectations

Apply tighter rule sets: lower thresholds, more frequent reviews and faster escalation for anomalies. Ongoing monitoring should catch behaviour inconsistent with the declared profile and prompt immediate review.

• Also treat other high‑risk profiles—jurisdictions with weak controls, opaque structures, rapid in/out transfers and remote onboarding—with EDD‑style measures.
• Maintain confidentiality. Avoid tipping‑off when investigations or reports are in progress.

“Documented senior approval, verified funding evidence and intensified monitoring create a defensible stance when handling exposed persons.”

Ongoing monitoring and transaction surveillance across the customer lifecycle

Monitoring should treat the relationship as a living record, assessed continuously against the declared purpose and expected flows.

Detecting unusual patterns and behaviour

Lifecycle monitoring is more than alerts; it is a continuous evaluation of whether activity aligns with the original profile and risk assessment.

Watch for rapid value movement, fragmented transfers intended to avoid thresholds, or behaviour that differs from stated operations. Cross-border corridors and sudden new counterparties often signal elevated concern.

Alert handling and investigative framework

Use a clear triage model: validate the alert, gather information, document findings and decide outcomes—close, escalate, file an STR or exit the relationship.

“Triage, record decisions, and link outcomes back to rule tuning to close the feedback loop.”

Reducing false positives and tuning rules

Tune scenarios by adjusting thresholds, refining segments and feeding investigation results back into the rule-set. Regular testing reduces noise and improves detection of true anomalies over time.

When to request further information and re‑verify identity

• Request documents for material ownership changes, unexpected transaction corridors, or use of new products.
• Re‑verify identity when documents expire, contact attempts fail, or activity repeatedly breaches norms.

Governance: demonstrate monitoring effectiveness with metrics, QA samples and regular reports to senior management. Keep records to show that aml and cdd procedures operated over time and that assessment changes were justified.

For practical guidance on aligning monitoring with local expectations, see our primer on anti‑money‑laundering in Singapore.

Recordkeeping requirements in Singapore: retention periods and audit readiness

Good recordkeeping creates a searchable audit trail that proves what was done, when and why.

Baseline retention: keep CDD and transaction information for a minimum of five years from the end of the relationship or the final transaction. This is the standard time frame that supports regulatory checks and legal obligations.

What to retain: identity evidence, beneficial ownership documentation, risk assessments, screening outcomes, monitoring alerts, investigation notes and approval logs. Include correspondence and account files that explain the purpose and nature of the relationship.

Account files, correspondence and analysis outcomes

Store statements, emails and meeting notes that substantiate decisions. Preserve analysis results and decision logs so reviewers can see the rationale, not just the final outcome.

Data security and audit readiness

Apply access controls, encryption where appropriate and segregation of duties. Use consistent naming conventions, version control for policies, and fast retrieval pathways so supervisors can find relevant files.

“Well-structured records turn regulatory scrutiny into a procedural check, not an operational crisis.”

Clear records demonstrate effective compliance with aml obligations and help institutions justify decisions. Secure disposal policies should remove data when the retention time ends, while keeping an audit log of destruction.

Suspicious Transaction Reporting in Singapore: obligations and the role of STRO

A clear escalation path helps frontline teams turn transaction anomalies into formal reports when warranted.

STRO’s role and the detection‑to‑report chain

STRO analyses AML/CFT reports submitted by regulated firms and converts signals into intelligence for law enforcement and financial investigations.

Firms must promptly submit a Suspicious Transaction Report (STR) when internal checks show activity that may indicate money laundering or related crimes. Include linked transactions and contextual details to aid analysis.

What typically triggers an STR and how to document rationale

Triggers include inconsistent identity information, unexplained transfers, adverse media matches, suspicious source of funds indicators or behaviour misaligned with the customer profile.

Document: what was observed, why it seems suspicious, checks performed, and the evidence relied upon. Keep timestamps, screening outputs and investigator notes to make the decision defensible.

Tipping‑off risks and managing internal communications

Tipping‑off is an offence. Limit case knowledge to the investigation team and MLRO equivalent. Use neutral, operational language in external contact and log all communication attempts.

Restrict file access and mark sensitive records. Train staff to avoid disclosing that an STR has been considered or filed.

Sector reporting examples and practical links to monitoring

Certain sectors have specific movement reporting. For example, dealers in precious stones and metals must report transactions over S$20,000 within 15 business days. Casinos must report transactions over S$10,000 within 15 business days.

Quality alert triage and well‑documented investigations reduce missed filings and unnecessary STRs. Define clear roles for front line, compliance and senior management to ensure accountability.

For a practical primer on aligning systems to local AML expectations, see our guide on anti‑money‑laundering in Singapore.

National Risk Assessment insights: aligning your controls to Singapore’s highest-risk areas

Use the NRA as a practical map to focus controls where threats and impact are greatest.

Practical value: the 2024 National Risk Assessment pinpoints sectors and channels with the highest risk of money laundering and related financial crime. Institutions can use these findings to prioritise resources and sharpen monitoring for the most exposed flows.

Digital payment systems and cross-border transfers are flagged as elevated risk vectors. Their speed and scale can outpace manual checks and amplify suspicious transactions across corridors.

Strengthening CDD and monitoring for fast payment rails

Align onboarding with clearer purpose-and-activity profiling. Ask targeted questions, verify funds sources and set scenario-based rules for rapid transfers.

Addressing misuse of legal persons and opaque ownership

Apply deeper beneficial ownership verification for complex shareholding chains. Scrutinise nominee arrangements and require documentary proof of economic purpose for companies and trusts.

Fraud typologies and overseas syndicates

Fraud schemes often connect to cross-border syndicates that use local accounts to launder money. Investigations must be prompt and escalate when patterns suggest organised involvement.

• Segment clients by identified risk drivers and raise monitoring sensitivity for high-risk corridors.
• Maintain investigator playbooks for common laundering and fraud patterns, with clear escalation paths.
• Continuously update controls as NRA themes evolve and internal incidents teach new lessons.

“Treat the NRA as a living checklist: focus controls where the evidence shows real exposure, and tune monitoring as threats change.”

Sector-specific considerations: payments, digital tokens, and casinos

High-velocity value flows need sector-tailored controls to spot abuse quickly and keep records audit-ready.

Digital token value transfers and recording steps

Operational rule: the ordering institution must identify and verify the value-transfer originator and record the transfer details.

Capture at minimum: date, token type and amount, value date and originator identity. For transfers above S$1,500 gather stronger verification and keep a clear audit trail.

For lower-value movements, retain the same fields but apply proportionate checks and automated screening to maintain scalable compliance.

Adapting monitoring for token rails

Tune monitoring to wallet behaviour, rapid in/out flows, cross-chain hops and new counterparty patterns.

Use pattern detection to flag layering, quick swaps or sudden corridor changes and escalate where evidence is weak.

Casino controls and tightened thresholds

MAS-aligned law lowered the CDD threshold from S$10,000 to S$4,000. Front-line teams must now verify identity and screen more transactions at an earlier stage.

Gaming risks include high cash turnover, third-party play and rapid chip redemption. Controls must be fast, accurate and supported by clear escalation routes.

Audit trail expectation: transaction logs, verification evidence and decision notes must be retrievable within the inspection time frame.

Practical steps: train staff on sector signals, test controls regularly, and document escalation paths so institutions can show effective aml practice over time.

Implementing a sustainable compliance programme: people, process, and technology

A resilient compliance programme links clear ownership, simple processes and fit‑for‑purpose technology so controls scale with growth.

This operating model ensures aml compliance is consistent, auditable and proportionate to risk. Assign clear owners, document procedures and choose tools that preserve control quality as volume rises.

Appointing a compliance officer and defining responsibilities

Staff training, policy communication, and annual refresh cycles

Provide onboarding modules and role‑based training for higher risk teams. Refresh content at least annually and keep evidence that staff understood updates.

• Short courses for front line staff on spotting suspicious activity.
• Annual tests and signed acknowledgements for policy changes.

Outsourcing CDD: maintaining accountability while assessing third‑party controls

Retain final accountability when outsourcing. Conduct vendor screening, require contractual controls and run periodic assurance checks.

Automation and AI: identity verification, liveness/deepfake detection, and real‑time monitoring

Automate where volume, speed or complexity overwhelm manual checks. Use AI carefully: liveness checks, faster identity verification and real‑time monitoring can reduce false positives.

“Test models, log decisions and retain human oversight to avoid automation drift.”

Continuous improvement: close the loop with QA, MI reporting, rule tuning and periodic risk reassessments to keep the programme effective over time.

Penalties and business impacts of non-compliance in Singapore

Enforcement outcomes range from fines to licence revocations, and they often follow clear patterns of control weakness. Regulators use a graded approach that punishes failures and forces remediation.

Regulatory enforcement actions and monetary penalties for regulated entities

Supervisors can issue warnings, reprimands and prohibition orders. For serious or persistent breaches, financial institutions may face fines up to S$1,000,000, management removal or licence termination.

Enforcement frequently triggers remediation programmes, intensified monitoring, and additional audits that increase operational cost and slow onboarding processes.

Criminal penalties under CDSA and reputational impacts

Under the CDSA, individuals may face fines up to S$500,000 and/or imprisonment for up to 10 years. Companies can be fined up to S$1,000,000 or double the value of the benefits, whichever is higher.

Failing to report or control laundering risks can therefore escalate from administrative action to criminal prosecution. That legal exposure raises the stakes for senior teams and legal advisors.

“Reputation loss often outlasts any fine: loss of counterparties, banking access issues and investor concern follow swiftly.”

Reputational damage leads to partner exits, tougher commercial terms, and erosion of public trust. Recovery can take years and cost more than the original penalties.

Root causes regulators commonly cite include weak identity verification, poor beneficial ownership work, ineffective monitoring and inadequate documentation. Addressing these lowers both enforcement and operational risks.

Risk mitigation: investing in controls, training and clear governance is typically less costly than enforcement and reputational recovery. Senior management should set risk appetite, own outcomes and foster a culture where escalation is supported rather than discouraged.

Conclusion

, Treat CDD as an operational cycle: verify identity, assess risk, apply measures and review results.

This guide closes with a short recap of the end-to-end journey: onboarding checks, risk rating, enhanced measures where needed, and lifecycle monitoring tied to real account behaviour.

Four pillars to keep front of mind are identity verification, beneficial ownership transparency, clear purpose and expected activity, and active monitoring with timely refresh.

Align controls to current regulations and MAS notices, test workflows, refresh staff training and tune monitoring rules to reduce false positives and manage transactions linked to higher risk segments.

Strong CDD and proportionate AML controls lower exposure to financial crime and support safer, sustainable relationships. Treat compliance as a continuous programme with governance, metrics and steady improvement.

Dean Cheong

Based in Singapore, Dean Cheong is a B2B growth consultant and CEO of VOffice who works with companies to unlock revenue through smarter sales processes and data-driven CRM adoption. Drawing on his finance training at Nanyang Technological University and years of hands-on leadership, he builds sustainable growth engines that turn strategy into measurable results.

hub.com.sg