MAS Notice 626 and Singapore AML Compliance: A Practical Guide
MAS Notice 626 is the cornerstone of Singapore's AML and CFT regime for banks, with parallel notices applying to merchant banks, capital markets intermediaries, payment institutions, and other regulated entities. This guide walks through what the notices require, how they map to FATF standards, and how regulated firms operationalise compliance — including the post-2023 supervisory environment.
Singapore's position as a global financial centre depends on the credibility of its AML regime. The 2023 enforcement action involving more than S$3 billion in seized assets — the largest money-laundering case in Singapore's history — has reset supervisory expectations across every regulated sector. MAS has subsequently issued reinforced guidance, increased the frequency of inspections, and significantly raised the bar for what constitutes adequate AML controls.
For any firm operating in Singapore, or doing business with Singapore-licensed counterparties, MAS Notice 626 and its sectoral siblings are not just regulatory documents — they are the operational blueprint for compliance. Understanding what they require in practice, and how MAS interprets them in supervision, is the difference between a programme that passes inspection and one that does not.
The Singapore AML Architecture
Singapore's AML/CFT regime has three layers. Understanding which document governs which obligation is the first step to navigating the regime correctly.
The three layers of Singapore AML law:
- Primary legislation — the CDSA criminalises money laundering and provides for asset confiscation; the TSOFA criminalises terrorism financing; the Mutual Assistance in Criminal Matters Act enables international cooperation.
- Sector-specific MAS Notices — MAS Notice 626 (banks), 1014 (merchant banks), SFA04-N02 (capital markets), PSN01 (payment services), and equivalents for other regulated sectors. These notices set the operational AML/CFT requirements firms must meet.
- MAS Guidelines and Information Papers — non-binding but supervisorily expected. Includes thematic reviews on areas of heightened risk and supervisory expectation.
Above this domestic structure sits the FATF framework. Singapore was assessed by FATF most recently in 2016 and is preparing for the next mutual evaluation cycle. The MAS Notices are explicitly aligned to FATF Recommendations, and any divergence is generally to make the Singapore standard more stringent, not less.
Core Obligations Under MAS Notice 626
MAS Notice 626 imposes a coherent set of operational obligations covering the full customer lifecycle. Each of the parallel sectoral notices imposes substantively equivalent obligations on the relevant sector.
Customer Due Diligence (CDD)
The Notice requires CDD on every new customer, including identity verification using reliable, independent source documents; identification of beneficial owners for non-individual customers; and understanding of the purpose and intended nature of the business relationship. See our complete CDD guide for the full FATF-aligned process.
Enhanced Due Diligence
EDD is mandatory for PEPs (foreign and domestic), customers from FATF higher-risk jurisdictions, and any other customer the bank classifies as higher risk. See our EDD guide for the full operational requirements.
Ongoing Monitoring and Periodic Review
The Notice requires continuous monitoring of business relationships and transactions to ensure consistency with the bank's knowledge of the customer, and periodic review of customer information at intervals tied to risk rating. See our transaction monitoring guide for operational implementation.
Suspicious Transaction Reporting (STR)
Where a bank has reasonable grounds to suspect money laundering or terrorism financing, it must file a Suspicious Transaction Report with the Suspicious Transaction Reporting Office (STRO) of the Singapore Police Force. Filing must be prompt — MAS expectations effectively require filing within days of forming suspicion. The no-tipping-off rule prohibits informing the customer that a report has been or will be filed. See our SAR filing guide for filing mechanics.
Record-Keeping
Banks must retain all customer due diligence records, transaction records, and STR documentation for at least five years from the end of the customer relationship or transaction date, whichever is later. Records must be retrievable in a format usable for regulatory and law enforcement inspection.
Internal Policies, Controls and Training
The Notice requires documented AML/CFT policies approved by senior management, an independent compliance function, an internal audit function with AML/CFT scope, and ongoing AML training for all relevant staff. The board and senior management are explicitly accountable for AML/CFT effectiveness.
MAS Supervisory Expectations Post-2023
The S$3 billion money laundering case has been the most consequential AML enforcement event in Singapore's history. Beyond the prosecutions and asset seizures, MAS has used the case to recalibrate its supervisory expectations across every regulated sector. Three shifts are particularly visible.
First, deeper source-of-wealth scrutiny on high-net-worth customers. Where firms previously treated SoW as a documentation exercise, MAS now expects substantive investigation — independent verification of declared wealth origins, scrutiny of inconsistencies between declared profile and observed flows, and willingness to decline relationships where the explanation is implausible.
Second, stronger expectations on KYC of corporate structures. Shell companies, complex multi-jurisdictional ownership chains, and nominee arrangements that previously cleared standard KYB now attract enhanced scrutiny. UBO unwrapping must be substantive, with independent verification at every layer.
Third, increased focus on cross-sector coordination. Many of the entities in the 2023 case held relationships across banks, payment institutions, real estate firms, and corporate service providers. MAS now expects firms in different sectors to share intelligence (where lawful) and to recognise that risk indicators visible to one regulated entity may be invisible to another.
The Parallel Notices: Beyond Banks
MAS Notice 626 governs banks. Equivalent — and substantively similar — notices apply to every other regulated sector in Singapore. Firms operating across multiple licences must comply with multiple notices simultaneously.
The parallel sectoral notices most relevant to financial-services firms:
- MAS Notice 1014 — applies to merchant banks; substantively mirrors Notice 626.
- MAS Notice SFA04-N02 — applies to capital markets intermediaries (fund managers, broker-dealers, REITs).
- MAS Notice PSN01 — applies to holders of a Payment Services Act licence (payment institutions, digital payment token providers, e-money issuers).
- MAS Notice TCA-N03 — applies to licensed trust companies.
- MAS Notice FAA-N06 — applies to licensed financial advisers.
- MAS Notice CMG-N01 — applies to insurance brokers and capital markets intermediaries combined.
Each notice should be read in conjunction with the firm's licence terms and any sector-specific guidance MAS has issued. For groups operating multiple licensed entities, AML governance must be coordinated across the group while respecting the entity-level obligations of each licence.
Operationalising MAS Compliance
MAS has been clear in supervisory communications that compliance technology is now an expected feature of any reasonably-sized regulated business — not a competitive differentiator. The volume and complexity of the obligations under MAS notices makes manual compliance infeasible at any scale beyond a small private bank or family office.
One Constellation is built specifically for the Singapore regulatory environment, with our headquarters in Singapore, hosting on Google Cloud Singapore, certifications from the Singapore FinTech Association alongside ISO 27001 and SOC 2, and product capabilities mapped directly to MAS Notice obligations: customer onboarding and CDD, transaction monitoring aligned to STRO reporting workflows, KYB and UBO unwrapping, sanctions and PEP screening, and a unified compliance portal for case management and audit reporting.
Singapore-Built Compliance for Singapore-Regulated Firms
One Constellation is headquartered and hosted in Singapore, certified by the Singapore FinTech Association, and built to map directly to MAS Notice 626, 1014, SFA04-N02, PSN01, and the wider sectoral framework.
