MAS Notice 626 Explained: AML/CFT Requirements for Singapore Banks
MAS Notice 626 is the principal AML/CFT obligation for banks licensed under the Banking Act in Singapore, supplemented by Notice 626A for branches of foreign banks. The Notice has been amended substantially since its 2007 introduction — most recently in 2023 — and remains the operational baseline MAS inspects against. This guide walks through the structure, the substantive obligations, and what MAS actually examines during compliance reviews.
Singapore's reputation as a major financial centre is anchored on a supervisory regime that has actively raised expectations on financial-crime compliance over the past fifteen years. MAS Notice 626 is the operational embodiment of those expectations for banks. The Notice is not the only AML/CFT instrument in the Singapore framework — the Corruption, Drug Trafficking and Other Serious Crimes Act (CDSA), the Terrorism (Suppression of Financing) Act, and parallel Notices for other sectors (PSN02 for payment service providers, FAA-N06 for financial advisers, SFA04-N02 for capital markets services) form the wider structure — but it is the document banks are inspected against most directly.
The Notice has evolved in step with international expectations. Major amendments in 2014, 2015, 2018, 2020 and 2023 expanded the obligations around beneficial ownership transparency, source of wealth verification, sanctions compliance, and digital-asset-related activity. The current text reflects a regime that operates well above FATF minimums in several areas — particularly on STR filing standards, on the depth of EDD expected for higher-risk relationships, and on the operational evidence MAS expects to see during inspection.
Who MAS Notice 626 Applies To
MAS Notice 626 is issued under the Monetary Authority of Singapore Act and the Banking Act. It applies to all banks licensed in Singapore — full banks (locally incorporated and branches) and wholesale banks alike. Any institution holding a Singapore banking licence is in scope; the obligations do not scale down for smaller or branch operations.
The Notice draws directly on the Financial Action Task Force (FATF) Recommendations, which is why its structure will be familiar to anyone who has worked under another FATF-aligned regime. It was first issued in 2007 and has been revised in step with international expectations — successive amendments expanded the treatment of beneficial ownership, correspondent banking, wire transfer information, and the risk-based approach. The version a compliance team works to is always the current consolidated text published on the MAS website, not a remembered earlier edition.
A point worth being precise about: the Notice sets binding obligations. It is distinct from the accompanying MAS Guidelines to Notice 626, which are not law but state how MAS expects banks to apply the rules — and which MAS will reference when assessing whether a programme is adequate. Treating the Guidelines as optional is one of the more common ways a programme drifts out of supervisory expectation.
Structure of the Notice
Notice 626 is organised into sections covering specific obligation areas. The principal sections, in order:
- Application and definitions — establishes which banks the Notice applies to, defines key terms (customer, beneficial owner, PEP, higher-risk customer), and references underlying legislation.
- Risk assessment and risk management — requires banks to conduct enterprise-wide AML/CFT risk assessment, document the methodology, and update the assessment periodically (in practice annually).
- Customer due diligence — sets out CDD requirements at onboarding, including identification, verification, beneficial ownership disclosure, and purpose-of-relationship documentation. CDD is required on all new customers and on existing customers undergoing certain events.
- Enhanced customer due diligence — specifies the additional measures required for higher-risk customers, PEPs, customers from higher-risk jurisdictions, and correspondent banking relationships.
- Reliance on third parties — when and how banks may rely on CDD performed by other regulated entities, with the bank retaining ultimate responsibility.
- Simplified customer due diligence — narrow circumstances where reduced measures are acceptable, primarily for lower-risk product types and customers in equivalent regulatory regimes.
- Targeted financial sanctions and other prohibitions — sanctions screening obligations against UN, MAS-listed, and other applicable lists.
- Ongoing monitoring — transaction monitoring requirements, frequency of CDD review, trigger events for re-review.
- Suspicious transaction reporting — STR filing obligations to the STRO, internal reporting processes, tipping-off prohibitions.
- Record-keeping — minimum retention periods (five years from the end of the relationship or transaction date), record format requirements.
- Internal policies, procedures and controls — board approval, MLRO appointment, training, independent audit.
The Notice is supplemented by guidelines (notably the MAS Guidelines to Notice 626) that provide operational interpretation. The guidelines do not have the force of the Notice itself but represent MAS's stated supervisory expectations and are referenced in inspection findings.
Where Notice 626 Sits in the Singapore Framework
Notice 626 is the most directly inspected instrument for banks, but it is one piece of a larger structure. Understanding the layers around it helps a compliance team know which document governs which obligation.
- Sector-specific MAS Notices. The same obligations apply across the financial sector through parallel notices — Notice 1014 for merchant banks, SFA04-N02 for capital markets intermediaries, PSN01 for payment service providers (see MAS compliance), and FAA-N06 for financial advisers, among others. A group operating across licences works to several notices at once.
- MAS Guidelines and information papers. Non-binding but supervisorily expected. These include thematic reviews that signal where MAS sees heightened risk and what good practice looks like — effectively a preview of what inspections will probe.
- Primary legislation. The CDSA and the Terrorism (Suppression of Financing) Act sit beneath the notices and create the criminal offences and reporting duties the AML/CFT framework operationalises.
- The FATF framework. Above the domestic structure sits FATF, whose Recommendations the Singapore regime implements and against whose standards Singapore is periodically assessed through the mutual evaluation process.
The practical consequence: when a requirement is ambiguous in the Notice itself, the answer usually lives in the Guidelines or the most recent thematic review, not in a stricter reading of the Notice's wording.
Customer Due Diligence Requirements
CDD under Notice 626 is more prescriptive than the FATF baseline, with explicit requirements MAS inspects directly.
- Identification. Full legal name, residential address, date of birth, nationality, identity document with reference number. For corporates: legal name, registered address, registration number, type of legal entity.
- Verification. Identity verified by reference to reliable, independent source documents. For natural persons: original or certified-true-copy identity documents. For corporates: certificate of incorporation, business profile from ACRA (for Singapore-incorporated entities) or equivalent for foreign entities.
- Beneficial ownership. For corporate customers, ownership and control structure documented up to the natural persons who ultimately own or control 25% or more of the entity. For complex structures, beneficial ownership must be traced through intermediate entities.
- Purpose and intended nature of business relationship. Documented at onboarding — what the customer will use the relationship for, expected transaction volumes and types, expected counterparties and jurisdictions.
- Source of funds (for higher-risk customers) and source of wealth (for PEPs and EDD cases). Documented and verified against independent evidence.
MAS expects CDD to be a substantive exercise, not a documentation tick-box. Inspections frequently identify gaps where the bank has collected documents without examining their consistency — beneficial ownership declarations that do not reconcile with publicly available registry data; declared business activity that does not align with the actual transaction patterns; identity documents from jurisdictions where the bank has no operational presence and no relationship with the issuing authority. The bank's KYC platform should support not just data collection but data validation.
Enhanced Due Diligence Triggers
EDD is mandatory for several customer categories under Notice 626. The triggers are explicit:
- Politically Exposed Persons (PEPs) and their family members and close associates. Foreign PEPs always require EDD; domestic PEPs and PEPs of international organisations require EDD where a risk-based assessment identifies higher risk.
- Customers from higher-risk jurisdictions, including FATF-identified jurisdictions under increased monitoring (the FATF Grey List) and jurisdictions on MAS's own higher-risk countries assessment.
- Customers with complex or unusual ownership structures, particularly cross-jurisdictional ownership without coherent commercial rationale.
- Customers in higher-risk sectors — gaming, virtual asset service providers, dealers in precious metals and stones, money services businesses, charities and NPOs where risk assessment indicates elevated risk.
- Customers introduced through unusual or higher-risk channels, including non-face-to-face onboarding where additional measures are required to compensate for the channel risk.
The EDD measures expected for these customers include senior management approval before account opening, deeper source of funds and source of wealth verification, enhanced transaction monitoring with lower thresholds, more frequent CDD review (typically annual rather than the standard three-year cycle), and structured customer-engagement protocols where unusual activity is detected. The depth of EDD is calibrated to the risk profile, but the floor MAS expects is substantively above standard CDD.
Transaction Monitoring and STR Filing
Notice 626 requires banks to operate transaction monitoring calibrated to the bank's risk profile, the customer base, and the products offered. The Notice does not prescribe specific rule logic, but inspections examine the rule coverage, the calibration evidence, and the disposition workflow.
STR filing obligations under Section 39 of the CDSA require banks to file with the STRO where there is reasonable grounds to suspect that property is the proceeds of crime or related to a serious offence. The "reasonable grounds to suspect" standard is a low bar — substantially lower than "evidence of crime" — and Singapore courts have interpreted it as requiring filing even where the bank has not investigated to certainty. Under-filing relative to detected suspicious patterns is a recurring finding in MAS enforcement actions.
Operational expectations:
- STR filing within reasonable time of suspicion arising — typically interpreted as days to a small number of weeks, not months.
- Internal SAR escalation procedure documented and approved by the MLRO, with the MLRO having ultimate sign-off on filing decisions.
- Tipping-off prohibition strictly enforced. Staff cannot disclose to a customer (or to anyone) that an STR has been or may be filed. Branch and relationship staff training on tipping-off is inspection-relevant.
- Continued transaction monitoring after an STR is filed. The filing does not pause the relationship; the bank continues to monitor and may file follow-up STRs as additional information emerges.
For broader transaction monitoring context, see our guides on rule tuning and alert triage workflows.
What MAS Actually Inspects
MAS supervisory examinations have evolved into a structured framework that compliance teams should understand operationally:
- Risk assessment quality. Does the bank's enterprise-wide risk assessment reflect its actual customer base and product mix? Does it identify the right inherent risks and document the residual risk after controls? Generic risk assessments lifted from templates are a frequent inspection finding.
- CDD file quality on sampling. MAS samples customer files across risk tiers. For higher-risk customers, the inspection focuses on whether the documented EDD is substantively supported by evidence in the file — declared source of wealth supported by tax returns or asset documentation; beneficial ownership reconciled with registry data; purpose of relationship aligning with transaction patterns.
- Transaction monitoring effectiveness. Are the rules calibrated against the actual customer base? Are alerts being dispositioned substantively rather than rubber-stamped? Are the SLAs being met? Are the dispositions defensible on case-file evidence?
- STR filing rate and quality. Is the filing rate proportionate to the bank's risk profile and customer base? Are the filings substantive (not just check-box submissions)? Are the underlying internal escalations documented and supported by analyst reasoning?
- Sanctions screening operations. Is screening occurring on the right frequency? Are alerts being dispositioned by trained staff? Is sanctions list update lag within acceptable bounds?
- Governance and oversight. Is the MLRO appropriately senior and independent? Are board reports substantive? Is independent audit producing findings that drive remediation?
Practical Compliance for Production Programmes
Five operational priorities for banks operating under Notice 626:
- Maintain a current and substantive risk assessment. The enterprise-wide risk assessment is the foundation MAS uses to assess proportionality. A generic or stale risk assessment makes every downstream control hard to defend.
- Invest in CDD file substance, not just file completeness. The verification evidence behind each documented field matters more than the existence of the field. Banks operating mature programmes invest in independent verification — registry checks, sanctions and PEP screening, beneficial ownership traversal — at onboarding and on each refresh cycle.
- Calibrate transaction monitoring to the actual customer base. Vendor-default thresholds do not survive MAS inspection. The bank should have documented its own calibration methodology, applied it, and validated the outputs.
- File STRs substantively and on time. Under-filing is a recurring finding. So is delayed filing. Build the escalation workflow that produces high-quality STRs at the right cadence.
- Treat the MLRO function as senior. MAS expects the MLRO to have authority, independence and resources proportionate to the bank's risk profile. Junior or under-resourced MLRO functions are inspection-relevant in themselves.
One Constellation's AML/CFT platform supports the operational evidence MAS inspects against — CDD with structured EDD workflow, beneficial ownership traversal across 130+ jurisdictions, transaction monitoring with documented calibration, and STR-ready case management aligned to STRO submission requirements.
A Practical Compliance Checklist
Translating the Notice into an operating programme comes down to a manageable set of recurring activities. The following is the practical core most banks build around:
- Maintain a current enterprise-wide risk assessment. Document the bank's exposure across customers, products, channels and geographies, and refresh it when the profile changes. Everything downstream — monitoring scope, EDD triggers, thresholds — should trace back to it.
- Calibrate monitoring to that assessment. Map each material typology to detection logic, set customer-specific baselines rather than uniform thresholds, and tune rules against alert outcomes on a regular cycle.
- Keep CDD live. Run periodic reviews on a risk-based schedule and build trigger-based reviews so that material changes in customer behaviour prompt re-assessment rather than waiting for the next scheduled cycle.
- Resource alert handling realistically. Ensure analyst capacity matches alert volume so that disposition quality holds. Record the reasoning behind every closure and every escalation.
- File STRs promptly and track the timeline. Measure the interval from suspicion to filing and treat persistent delay as a control issue to fix, not a workload to absorb.
- Make records retrievable, not just retained. Confirm that five years of CDD, transaction and STR documentation can be produced quickly and in a usable format.
- Keep governance evidenced. Board-approved policies, an independent compliance function, internal audit coverage of AML/CFT, and dated, role-appropriate training records — all available on request.
Common Failure Points
The same weaknesses recur across programmes that struggle under inspection:
- Policy without practice. A comprehensive manual that the day-to-day operation does not actually follow. MAS tests the operation, not the manual.
- Uniform monitoring. One rule set applied across the whole customer base, producing noise on high-volume customers and silence on the ones whose behaviour has genuinely shifted.
- Alert backlogs. Volume outrunning capacity, leading to rushed closures and delayed STRs.
- Stale CDD. Customer information that was accurate at onboarding and never refreshed, so the risk rating no longer reflects reality.
- Weak audit trail. Decisions — risk ratings, alert closures, EDD approvals — recorded as outcomes without the reasoning, leaving nothing for an inspector to assess.
Each of these is a practice failure rather than a documentation gap, which is precisely why they survive in programmes that look complete on paper. For the structural treatment of t
AML/CFT Platform Built for MAS Inspection
One Constellation supports Notice 626 compliance with risk-based CDD, structured EDD workflow, calibrated transaction monitoring, and STR-ready case management — designed for the operational evidence MAS expects to see.
