MAS Notice 626 and Singapore AML Compliance: A Practical Guide
MAS Notice 626 is the document every bank licensed in Singapore is inspected against. It is not a long instrument, but the gap between what it says and what MAS expects to see in practice is where most compliance programmes succeed or fail. This guide walks through what the Notice actually requires, where it sits in the wider Singapore framework, and the practical steps a compliance team needs to take to operationalise it rather than merely document it.
Singapore's standing as a financial centre rests on a supervisory regime that has steadily raised the bar on financial-crime compliance over the past fifteen years. MAS Notice 626 is the operational embodiment of that regime for banks. It is short relative to the obligations it creates, because it sits on top of a layer of MAS Guidelines, information papers and thematic reviews that fill in the supervisory expectation.
The honest framing for any compliance lead is that the Notice is the floor, not the ceiling. A bank can satisfy every literal clause and still fail an inspection if its monitoring does not surface activity the data clearly contained, or if its analysts close alerts without genuine investigation. This guide is structured around that distinction — what the Notice requires, and what it takes to satisfy it in practice.
What MAS Notice 626 Is — and Who It Applies To
MAS Notice 626 is issued under the Monetary Authority of Singapore Act and the Banking Act. It applies to all banks licensed in Singapore — full banks (locally incorporated and branches) and wholesale banks alike. Any institution holding a Singapore banking licence is in scope; the obligations do not scale down for smaller or branch operations.
The Notice draws directly on the Financial Action Task Force (FATF) Recommendations, which is why its structure will be familiar to anyone who has worked under another FATF-aligned regime. It was first issued in 2007 and has been revised in step with international expectations — successive amendments expanded the treatment of beneficial ownership, correspondent banking, wire transfer information, and the risk-based approach. The version a compliance team works to is always the current consolidated text published on the MAS website, not a remembered earlier edition.
A point worth being precise about: the Notice sets binding obligations. It is distinct from the accompanying MAS Guidelines to Notice 626, which are not law but state how MAS expects banks to apply the rules — and which MAS will reference when assessing whether a programme is adequate. Treating the Guidelines as optional is one of the more common ways a programme drifts out of supervisory expectation.
The Core Obligations
The Notice's substantive requirements fall into six areas. Each is straightforward to state and demanding to operate.
Customer Due Diligence (CDD)
Banks must identify and verify every customer and, where relevant, the beneficial owners behind them, before or during the establishment of the relationship. CDD is not a one-time onboarding event — the Notice requires that customer information be kept current through periodic and trigger-based reviews. For a practitioner's walk-through of the underlying process, see our complete guide to customer due diligence.
Enhanced Due Diligence (EDD)
Higher-risk relationships attract additional measures: more detailed verification, senior-management approval to onboard or continue the relationship, and closer ongoing scrutiny. The Notice singles out politically exposed persons, customers connected to higher-risk jurisdictions, and relationships with complex or opaque ownership structures. The risk assessment that drives EDD is itself an inspectable artefact — MAS expects to see how a bank decided a given customer was higher risk.
Ongoing and Transaction Monitoring
This is the most operationally demanding area. Banks must monitor activity on a continuing basis and apply a risk-based approach: higher-risk customers warrant more intensive monitoring, and the typologies monitored for should reflect Singapore's actual exposure. A uniform, one-size-fits-all rule set is unlikely to satisfy modern expectations. Effective programmes pair rule-based detection with behavioural baselining — a distinction we cover in transaction monitoring.
Suspicious Transaction Reporting (STR)
Once suspicion is formed, a bank must file a suspicious transaction report with the Suspicious Transaction Reporting Office (STRO) within a reasonable timeframe. The reporting obligation flows from the Corruption, Drug Trafficking and Other Serious Crimes Act (CDSA) and sits alongside the Notice. The supervisory focus here is timeliness and quality — a backlog of unreviewed alerts, or reports filed long after suspicion should reasonably have formed, is a recurring inspection finding.
Record-Keeping
Banks must retain CDD records, transaction records, and STR-related documentation for at least five years from the end of the relationship or the date of the transaction, whichever is later. Records must be retrievable in a form usable by regulators and law enforcement. Retention that exists in principle but cannot be produced quickly during an inspection does not meet the requirement.
Governance, Independence and Training
The Notice requires documented AML/CFT policies and procedures approved by senior management, an independent compliance function, an internal audit function with AML/CFT in scope, and ongoing training for all relevant staff. The board or a delegated senior committee is expected to review and approve the programme at least annually, and to update it promptly when the bank's risk profile changes materially.
Where Notice 626 Sits in the Singapore Framework
Notice 626 is the most directly inspected instrument for banks, but it is one piece of a larger structure. Understanding the layers around it helps a compliance team know which document governs which obligation.
- Sector-specific MAS Notices. The same obligations apply across the financial sector through parallel notices — Notice 1014 for merchant banks, SFA04-N02 for capital markets intermediaries, PSN01 for payment service providers, and FAA-N06 for financial advisers, among others. A group operating across licences works to several notices at once.
- MAS Guidelines and information papers. Non-binding but supervisorily expected. These include thematic reviews that signal where MAS sees heightened risk and what good practice looks like — effectively a preview of what inspections will probe.
- Primary legislation. The CDSA and the Terrorism (Suppression of Financing) Act sit beneath the notices and create the criminal offences and reporting duties the AML/CFT framework operationalises.
- The FATF framework. Above the domestic structure sits FATF, whose Recommendations the Singapore regime implements and against whose standards Singapore is periodically assessed through the mutual evaluation process.
The practical consequence: when a requirement is ambiguous in the Notice itself, the answer usually lives in the Guidelines or the most recent thematic review, not in a stricter reading of the Notice's wording.
What MAS Actually Inspects
MAS has been explicit that AML controls must be more than procedural. Inspection findings, and the enforcement actions that have followed serious failures, consistently turn on whether controls operated effectively — not on whether a policy existed. Four areas attract the most scrutiny:
- Does monitoring surface what the data contained? The most damaging finding is that suspicious activity was identifiable from the bank's own records but the monitoring did not flag it. This points to rule libraries, calibration, or coverage rather than to data access.
- Are alerts genuinely investigated? High alert volumes closed quickly with thin rationale suggest a triage process under pressure rather than a functioning control. MAS looks at disposition quality, not just throughput.
- Is the risk-based approach evidenced? A bank must be able to show how it assessed customer and product risk and how that assessment shaped its monitoring. A risk rating that exists as a label, without the reasoning behind it, is weak.
- Is STR filing timely and complete? Delays between suspicion forming and a report reaching STRO, or reports missing key context, are recurring themes.
A Practical Compliance Checklist
Translating the Notice into an operating programme comes down to a manageable set of recurring activities. The following is the practical core most banks build around:
- Maintain a current enterprise-wide risk assessment. Document the bank's exposure across customers, products, channels and geographies, and refresh it when the profile changes. Everything downstream — monitoring scope, EDD triggers, thresholds — should trace back to it.
- Calibrate monitoring to that assessment. Map each material typology to detection logic, set customer-specific baselines rather than uniform thresholds, and tune rules against alert outcomes on a regular cycle.
- Keep CDD live. Run periodic reviews on a risk-based schedule and build trigger-based reviews so that material changes in customer behaviour prompt re-assessment rather than waiting for the next scheduled cycle.
- Resource alert handling realistically. Ensure analyst capacity matches alert volume so that disposition quality holds. Record the reasoning behind every closure and every escalation.
- File STRs promptly and track the timeline. Measure the interval from suspicion to filing and treat persistent delay as a control issue to fix, not a workload to absorb.
- Make records retrievable, not just retained. Confirm that five years of CDD, transaction and STR documentation can be produced quickly and in a usable format.
- Keep governance evidenced. Board-approved policies, an independent compliance function, internal audit coverage of AML/CFT, and dated, role-appropriate training records — all available on request.
Common Failure Points
The same weaknesses recur across programmes that struggle under inspection:
- Policy without practice. A comprehensive manual that the day-to-day operation does not actually follow. MAS tests the operation, not the manual.
- Uniform monitoring. One rule set applied across the whole customer base, producing noise on high-volume customers and silence on the ones whose behaviour has genuinely shifted.
- Alert backlogs. Volume outrunning capacity, leading to rushed closures and delayed STRs.
- Stale CDD. Customer information that was accurate at onboarding and never refreshed, so the risk rating no longer reflects reality.
- Weak audit trail. Decisions — risk ratings, alert closures, EDD approvals — recorded as outcomes without the reasoning, leaving nothing for an inspector to assess.
Each of these is a practice failure rather than a documentation gap, which is precisely why they survive in programmes that look complete on paper. For the structural treatment of t
