Regulations

Singapore AML/CFT Compliance Checklist: MAS Notice 626

A practical checklist of the AML/CFT obligations in MAS Notice 626, with the paragraph behind each check, the points firms most often misread, and an Excel version to track your own status, evidence and owners.

Published: October 2026 Category: Regulations Read time: ~12 minutes

Quick Answer

MAS Notice 626 sets the AML/CFT obligations for banks in Singapore. It took effect on 1 April 2024 and was last revised on 30 June 2025. Its core duties are: assess your ML/TF risks (paragraph 4), assess new products and technologies before launch (5), perform customer due diligence including beneficial owners and screening (6), apply simplified or enhanced CDD where the risk justifies it (7 and 8), keep records for at least five years (12), report suspicious transactions to STRO promptly (14), and maintain policies, a compliance officer, audit and training (15). Other MAS-regulated firms, such as payment service providers and capital markets intermediaries, have their own notice with a similar structure.

The checklist below follows the order of the Notice. Each line is a plain-English summary of an obligation, with the paragraph number so you can read the full text. It is a working aid, not legal advice: where the summary and the Notice differ, the Notice prevails.

For a fuller explanation of each requirement, see our guide to MAS Notice 626; for payment firms, see Notice PSN01.

Which MAS Notice Applies to You

Type of firm	AML/CFT notice
Banks	Notice 626
Merchant banks	Notice 1014 (reissued 30 June 2025, in force 1 July 2025)
Finance companies	Notice 824 (reissued 30 June 2025, in force 1 July 2025)
Payment service providers (specified payment services)	Notice PSN01
Digital payment token service providers	Notice PSN02
Capital markets intermediaries, including licensed fund managers	Notice SFA04-N02
Financial advisers	Notice FAA-N06
Direct life insurers	Notice 314
Trust companies	Notice TCA-N03

The paragraph numbers in this checklist are from Notice 626. The other notices cover the same ground but number their paragraphs differently, so check the equivalent paragraph in your own notice. Notices 824 and 1014 were reissued under the Financial Services and Markets Act 2022 on 30 June 2025, replacing earlier versions.

Risk Assessment and New Products

Area	Paragraph	What to check
4. Risk assessment and risk-based approach	4.1–4.2	Identify, assess and understand ML/TF risks for customers, countries, products, services, transactions and delivery channels; document the assessment, keep it up to date and be able to provide it to MAS.
4. Risk assessment and risk-based approach	4.3	Have policies, procedures and controls approved by senior management; monitor and enhance them; apply enhanced measures where risks are higher.
5. New products, practices and technologies	5.1–5.3	Assess the ML/TF risks of new products, practices, delivery channels and technologies before launch, paying special attention to those that favour anonymity.

Customer Due Diligence

Area	Paragraph	What to check
6. Customer due diligence	6.1	Do not open or maintain anonymous accounts or accounts in fictitious names.
6. Customer due diligence	6.2	Where there are grounds to suspect ML/TF before onboarding or a transaction, do not proceed; file an STR.
6. Customer due diligence	6.3–6.4	Perform CDD when establishing business relations and for occasional transactions above the Notice thresholds; aggregate transactions that appear linked.
6. Customer due diligence	6.5–6.6	Identify each customer and obtain at least the information the Notice lists for individuals and for entities.
6. Customer due diligence	6.8–6.8B	Identify the connected parties of entity customers; document any lower-risk alternative to identity numbers.
6. Customer due diligence	6.9	Verify the customer’s identity using reliable, independent source data, documents or information.
6. Customer due diligence	6.10–6.11C	Identify and verify natural persons appointed to act for the customer, and verify their authority.
6. Customer due diligence	6.13–6.15	Ask whether there are beneficial owners; for legal persons work through ownership, control and executive authority; for trusts, identify the trust relevant parties; understand the ownership and control structure.
6. Customer due diligence	6.14A–6.14D	Obtain the required beneficial owner information and take reasonable steps to verify it; document any lower-risk alternatives used.
6. Customer due diligence	6.16–6.17	Apply the exemptions from inquiring into beneficial owners only where there is no doubt or suspicion, and document the basis.
6. Customer due diligence	6.18	Understand and, where appropriate, obtain information on the purpose and intended nature of business relations.
6. Customer due diligence	6.19–6.23	Monitor business relations on an ongoing basis against your knowledge of the customer; examine complex, unusually large or unusual transactions and document the findings.
6. Customer due diligence	6.24–6.26	Review existing CDD information periodically, prioritising higher-risk customers; document decisions to retain customers you have concerns about.
6. Customer due diligence	6.27–6.29	Have policies for non-face-to-face business; non-face-to-face CDD must be at least as robust as face-to-face CDD.
6. Customer due diligence	6.32–6.34	Complete verification before onboarding; defer only where essential and the risks are managed, then complete as soon as reasonably practicable.
6. Customer due diligence	6.35–6.36	Where CDD cannot be completed, do not start or continue the relationship, and consider filing an STR.
6. Customer due diligence	6.38	Apply CDD to existing customers based on materiality and risk.
6. Customer due diligence	6.39–6.42	Screen customers, persons acting for them, connected parties and beneficial owners against relevant ML/TF information sources and MAS lists, at onboarding, on periodic review and when lists or parties change; document the results.
7. Simplified CDD	7.1–7.6	Apply simplified CDD only where low risk is supported by adequate analysis, never for high-risk jurisdictions or where ML/TF is suspected; document the assessment.

Enhanced CDD, Reliance, Correspondent Banking and Wire Transfers

Area	Paragraph	What to check
8. Enhanced CDD	8.2	Determine whether customers, persons acting for them, connected parties or beneficial owners are PEPs, or their family members or close associates.
8. Enhanced CDD	8.3	For PEPs: obtain senior management approval, establish source of wealth and source of funds, and conduct enhanced ongoing monitoring.
8. Enhanced CDD	8.4	For domestic PEPs, international organisation PEPs and PEPs who have stepped down, a risk-based approach is permitted unless the relationship presents a higher risk.
8. Enhanced CDD	8.5–8.8	Identify higher-risk customers, including those connected with jurisdictions the FATF calls on countries to act against, and apply enhanced measures.
9. Reliance on third parties	9.2–9.5	Rely only on third parties that meet the Notice’s conditions; obtain their CDD information immediately; never rely on them for ongoing monitoring. You remain responsible.
10. Correspondent banking	10.3–10.7	Assess respondent institutions and obtain senior management approval for new relationships; do not deal with shell, unsupervised or poorly controlled institutions, and make sure respondents do not let shell institutions use their accounts.
11. Wire transfers	11.3–11.9	As ordering institution, verify the originator and include the required originator and beneficiary information; do not execute a wire transfer that does not comply.
11. Wire transfers	11.10–11.16	As beneficiary or intermediary institution, identify wire transfers lacking required information and have risk-based policies to execute, reject or suspend them.

Records, Reporting and Governance

Area	Paragraph	What to check
12. Record keeping	12.1–12.3	Keep CDD records for at least 5 years after the relationship ends and transaction records for at least 5 years after completion, sufficient to reconstruct transactions.
12. Record keeping	12.5	Keep records relating to STRs or investigations for as long as the authorities direct.
13. Personal data	13.3	On request, give individual customers access to, and allow correction of, the personal data the Notice lists.
14. Suspicious transaction reporting	14.1	Establish a single reference point for internal suspicion reports and keep records of matters referred to STRO.
14. Suspicious transaction reporting	14.2	Submit STRs to STRO promptly, regardless of amount, including attempted transactions.
14. Suspicious transaction reporting	14.3	Consider and document whether to file an STR where CDD is incomplete or the customer is reluctant or withdraws.
14. Suspicious transaction reporting	14.4	Where CDD would tip off the customer, you may stop it; document the basis and file an STR.
15. Internal policies, compliance, audit and training	15.1–15.2	Develop and implement internal AML/CFT policies, procedures and controls suited to your risks and size, and communicate them to staff.
15. Internal policies, compliance, audit and training	15.4–15.9A	Singapore-incorporated banks: apply group-wide AML/CFT policies and share information within the group; apply the higher of home and host standards.
15. Internal policies, compliance, audit and training	15.10–15.11	Appoint a suitably qualified and resourced AML/CFT compliance officer at management level.
15. Internal policies, compliance, audit and training	15.12	Maintain an independent and adequately resourced audit function.
15. Internal policies, compliance, audit and training	15.13–15.14	Screen employees and officers when hiring and appointing, and train them regularly on AML/CFT laws, CDD, STRs, ML/TF trends and internal policies.

Points Firms Often Misread

There is no fixed deadline for STRs. Paragraph 14.2 requires reports to STRO to be submitted promptly, regardless of the amount and including attempted transactions. It does not set a number of days.
Screening can follow onboarding, but only just. Paragraph 6.40 allows screening when, or as soon as reasonably practicable after, business relations are established, and again on periodic review and when names or lists change. The Notice does not set a fixed rescreening interval.
Not every PEP needs the full enhanced measures. Paragraph 8.4 allows a risk-based approach for domestic PEPs, international organisation PEPs and PEPs who have stepped down, unless the relationship presents a higher risk. See our guide to PEP categories.
Digital token transactions count. The CDD triggers for occasional transactions include transactions in digital tokens.
Group rules apply to Singapore-incorporated banks. Paragraphs 15.4 to 15.9 require group-wide policies; Singapore branches of foreign banks have their own provision.
Third parties cannot monitor for you. Paragraph 9 lets you rely on some third parties for CDD, but never for ongoing monitoring, and you stay responsible.

Download the Checklist

The Excel version lists all 42 checks with their paragraph numbers, plus columns for status, evidence, owner and review date, so you can use it for an internal review or to prepare for an inspection.

Fill in the short form below to get the file. We will also email you a copy.

Your checklist is ready.

Download the Excel checklist

Frequently Asked Questions

What are the AML requirements for banks in Singapore?

MAS Notice 626 requires banks to assess their money laundering and terrorism financing risks, perform customer due diligence including beneficial owners and screening, apply enhanced measures to higher-risk customers and PEPs, keep records for at least five years, report suspicious transactions to STRO promptly, and maintain policies, a compliance officer, audit and training.

Is there a deadline for filing an STR in Singapore?

MAS Notice 626 does not set a number of days. Paragraph 14.2 requires suspicious transaction reports to be submitted to STRO promptly, regardless of the amount, including attempted transactions.

How long must AML records be kept in Singapore?

Under paragraph 12 of MAS Notice 626, CDD records must be kept for at least five years after the business relationship ends, and transaction records for at least five years after the transaction is completed. Records relating to an STR or investigation must be kept as the authorities direct.

Does this checklist apply to payment service providers?

Payment service providers follow MAS Notice PSN01, or PSN02 for digital payment token services. These notices follow a similar structure, but the paragraph numbers and some thresholds differ, so check your own notice.

Who must be screened under MAS Notice 626?

Paragraph 6.39 requires banks to screen the customer, natural persons appointed to act on its behalf, its connected parties and its beneficial owners against relevant ML/TF information sources and lists provided by MAS or other relevant authorities.

Sources

This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.

Turn the Checklist Into Daily Controls

One Constellation runs customer due diligence, screening, monitoring and STR/SAR case management in one platform, with workflows mapped to MAS requirements.

Book a Demo Explore MAS Compliance