AML/CPF/CFT & Ongoing CDD for Singapore Corporate Service Providers

1. Enterprise-Wide & Customer Risk Assessments

Under the CSP Regulations, registered Corporate Service Providers must take appropriate steps to identify, assess, and understand their money laundering, terrorism financing, and proliferation financing risks. Risk assessment forms the mandatory foundation upon which all subsequent Customer Due Diligence (CDD) measures are calibrated:

• Enterprise-Wide Risk Assessment (EWRA): CSPs must periodically assess the inherent risks of their overall business, considering customer demographics, countries and geographic spheres of operation, the nature of corporate secretarial and accounting services provided, and the transaction or delivery channels employed.
• Individual Customer Risk Profiling: Before establishing any business relationship, the CSP must evaluate the specific customer, assign a documented risk rating (e.g. Low, Medium, High), and record the rationale. This risk rating directly governs the depth of verification and ongoing review frequency.
• Regular Review: Both enterprise-level and customer-level risk assessments must be updated periodically and upon triggering events to reflect evolving regulatory risks and typologies.

2. Identification & Verification of Customers, Agents & Beneficial Owners

The CSP Regulations establish distinct statutory obligations for identifying and verifying the legal customer, persons acting on its behalf, and ultimate beneficial owners:

A. Customer Identification & Verification

The CSP must obtain and verify the full legal name, legal form, registration or incorporation number, registered office address, and principal place of business of corporate entities, partnerships, and trusts, using reliable, independent source data.

B. Persons Purporting to Act on Behalf of the Customer

Where a natural person (e.g. an authorized director, company secretary, or agent) interacts with the CSP on behalf of the customer, the CSP must:

• Verify the identity of that natural person; and
• Verify that the person is properly authorized to represent and act on behalf of the customer entity (e.g. via board resolution or letter of authority).

C. Beneficial Ownership Identification under CSP Regulations

Beneficial ownership under the CSP Regulations is determined through a substantive legal analysis and must not be reduced to a single equity formula:

• Ultimate Ownership or Control: The natural person(s) who ultimately own or control the customer entity, or who exercise ultimate effective control over its legal arrangements;
• Executive Authority: Where no natural person is identified through ownership or control interests, the natural person(s) holding senior executive or managerial authority; and
• Underlying Principals: Any individual on whose behalf the transaction or business relationship is being conducted.

Note: While ACRA's Register of Registrable Controllers (RORC) uses a statutory >25% interest or voting threshold for registry filing purposes, AML/CPF/CFT beneficial-owner identification under the CSP Regulations requires a comprehensive assessment of effective control and underlying beneficiaries.

3. Customer Screening & Targeted Financial Sanctions

CSPs must screen counterparties against applicable statutory sanctions lists and risk databases in accordance with Singapore legal mandates and their firm-level risk framework:

Applicable Singapore Screening Requirements

• United Nations Security Council (UNSC) Sanctions Lists: Mandatory targeted financial sanctions and strict prohibitions on providing corporate services or assets to designated individuals or entities under Singapore regulations.
• Monetary Authority of Singapore (MAS) Sanctions & Terrorism Designations: Targeted financial restrictions, anti-terrorism asset freeze orders, and designations under the Terrorism (Suppression of Financing) Act.
• Proliferation Financing Prohibitions: Targeted screening against designated persons and entities involved in the proliferation of weapons of mass destruction under applicable Singapore orders.

Additional International Screening Sources Supported by ECKHO

• US Office of Foreign Assets Control (OFAC) & European Union (EU) Sanctions: Multi-jurisdiction financial sanctions screening for cross-border operations and international counterparties.
• Global Adverse Media & Law Enforcement Databases: Screening against international financial crime databases, Interpol red notices, and negative news to identify elevated reputational or legal risks.

4. Risk-Sensitive CDD & Enhanced Due Diligence (EDD)

The CSP Regulations mandate a risk-sensitive approach to Customer Due Diligence. Depending on the customer's risk profile, the CSP must apply proportionate measures:

A. Simplified Customer Due Diligence (SDD)

Where a customer presents an assessed low risk of money laundering and terrorism financing (and subject to specific statutory exclusions), the CSP may apply simplified CDD measures, such as reducing the frequency of information updates or verification steps.

B. Enhanced Due Diligence (EDD)

Where higher risks are identified—such as complex or opaque corporate structures without apparent economic rationale, links to high-risk jurisdictions, or high transaction volumes—CSPs must apply Enhanced Due Diligence measures:

• Obtaining senior management approval prior to establishing or continuing the business relationship;
• Taking reasonable measures to establish the source of wealth (SOW) and source of funds (SOF) of the customer and beneficial owners; and
• Conducting intensified, enhanced ongoing monitoring of transactions throughout the engagement.

C. Risk-Sensitive Approach to Politically Exposed Persons (PEPs)

The CSP Regulations distinguish between categories of Politically Exposed Persons (foreign PEPs, domestic PEPs, international organization PEPs, and their family members and close associates). CSPs must implement risk-sensitive controls to determine whether a customer or beneficial owner is a PEP and apply the appropriate enhanced measures required for that category under the Regulations and firm risk framework.

5. Ongoing Monitoring & Event-Driven Reviews

Customer Due Diligence is not a static onboarding milestone. Under the CSP Regulations, CSPs are required to conduct ongoing monitoring and, where appropriate, enhanced ongoing monitoring throughout the lifecycle of the business relationship:

• Transaction & Activity Scrutiny: Ensuring that transactions and corporate filings are consistent with the CSP's knowledge of the customer, its business model, and risk profile.
• Event-Driven CDD Triggers: Reviewing and refreshing CDD whenever there is a material corporate event, such as a change in directors, change in ultimate beneficial owners, significant share transfers, change in registered office, or negative media alerts.
• Periodic Re-Screening Frequency: Re-screening counterparties at frequencies calibrated to customer risk (e.g. monthly for high risk, quarterly for medium risk, annually for standard risk).

6. Statutory Recordkeeping & Audit Defensibility

To ensure complete auditability during regulatory compliance reviews and law enforcement inquiries, the CSP Regulations prescribe strict record retention rules:

• 5-Year Statutory Retention: CSPs must retain all identification documents, verification data, beneficial ownership determinations, screening logs, and business correspondence for a minimum of five years following the termination of the business relationship or completion of an occasional transaction.
• Immediate Accessibility: Records must be maintained in a form that permits prompt retrieval and production to ACRA or competent authorities upon request.
• Audit Trail Integrity: Compliance justifications, false-positive resolution rationales, and approval timestamps must be securely archived to demonstrate non-repudiation during regulatory reviews.

7. Internal Policies, Procedures, Controls (IPPC) & Compliance Governance

Regulated CSPs must operationalize their statutory duties through documented governance structures:

• Written Compliance Manual: Developing and maintaining internal policies, procedures, and controls (IPPC) addressing risk assessment, CDD, sanctions screening, reporting of suspicious transactions (STR), and recordkeeping.
• Compliance Management & Screening Officer: Designating a suitably qualified compliance officer or Registered Qualified Individual (RQI) to oversee firm-wide adherence to the CSP Act and Regulations.
• Independent Audit Function: Maintaining an independent audit process (commensurate with the firm's size and complexity) to test and verify the adequacy and effectiveness of internal AML/CPF/CFT controls.
• Ongoing Staff Training: Providing regular, documented AML/CPF/CFT training to secretarial associates, managers, and partners on new typologies, red flags, and statutory updates.

8. ECKHO Audit Control: 10-Minute Resolution Lock

When a screening search produces a potential name match (true hit or false positive), the compliance officer must investigate and record an auditable justification.

When a user records a screening resolution, ECKHO applies a 10-minute system control before locking the recorded decision and associated rationale. This is an ECKHO workflow feature designed to support record integrity; it is not an ACRA-prescribed 10-minute regulatory requirement. Once a compliance officer enters their reasoning and marks a screening as resolved, the recorded resolution is locked against ordinary user editing after the configured resolution period.

9. Supporting AML/CPF/CFT Workflows with ECKHO

ECKHO's dedicated AML Screening & Scheduled Monitoring Software enables Singapore CSPs to:

• Run automated batch screening against international sanction lists, PEPs, and adverse news media.
• Set configurable recurring screening intervals (e.g. monthly, quarterly, annual) across entire entity portfolios.
• Enforce prerequisite compliance workflow gates before approving statutory lodgments.
• Generate watermarked screening summary reports and documented resolution records for internal compliance files and regulatory-review preparation.

10. Primary Regulatory Sources & Official References

Singapore CSPs and RQIs should consult primary legislation and official ACRA guidance to ensure firm-level compliance: