Please read before starting

Why this matters

Anti-money laundering, counter-financing of terrorism, and counter-proliferation financing are not abstract concepts. They are the daily background to every customer relationship a CSP holds.

Singapore is one of the world's leading financial and corporate-services hubs. That status comes with exposure. Criminals look for jurisdictions with strong financial infrastructure and access to the global economy — the same qualities that make Singapore an attractive place to do legitimate business.

Corporate service providers sit at the entry point. The CSP incorporates the company, provides the registered office, files with ACRA, holds the customer relationship. Almost every cross-border financial structure that touches Singapore touches a CSP.

That position carries responsibility. ACRA regulates CSPs precisely because the corporate-services sector is exposed to misuse. The training you are starting now is the foundation of how the firm — and you, as a member of staff — meet that responsibility.

What is money laundering?

ACRA defines money laundering as a process carried out with the intention to conceal the benefits obtained from criminal activity so that they appear to have originated from legitimate sources.

The criminal proceeds — money, securities, property — are mixed with or exchanged for assets that have no obvious link to their criminal origin. By the time the laundering process is complete, the proceeds look clean.

The act of laundering is itself a criminal offence in Singapore. The legal framework that criminalises it is examined in Lesson 6. For now, the foundational point is this: laundering is a process, not a single act, and it is designed to defeat detection.

Key terms used throughout the programme

Tap each card to see the definition.

The three stages of money laundering

Money laundering generally moves through three distinct stages: placement, layering, and integration. Each stage has different exposure for a CSP — step through the diagram below to see each in turn.

Identify the stage

Knowledge checks are formative — they help you consolidate. Your answer is not scored toward the terminal assessment.

What is terrorism financing?

Terrorism seeks to influence, compel, or intimidate governments or the public through threats or violence. Terrorism financing is the funding of those activities. It overlaps with money laundering in method but differs in important ways.

The most consequential difference: the source of terrorism financing may be entirely legitimate. Funds for a terrorist act can come from criminal sources, but they can also come from a legitimate business, a charitable donation, or a personal salary.

Tap through the tabs below to see how TF is defined, how the funds move, and where it differs from ML.

What is proliferation financing?

Proliferation financing — abbreviated PF — is the provision of funds or financial services that support the development, acquisition, or transfer of nuclear, chemical, or biological weapons and their delivery systems.

This includes funding research and development, procuring materials and equipment, facilitating transportation and logistics, and supporting the overall infrastructure needed for weapons-of-mass-destruction programmes. The funds may flow through traditional banking, informal value transfer methods, or emerging technologies including cryptocurrencies. The methods are often deliberately complex to evade detection and sanctions.

Why this matters in Singapore

Singapore is a global trade and financial hub. Goods and funds transit through it, and corporate vehicles are incorporated and administered here. PF actors look for jurisdictions where the trade-and-finance ecosystem is deep and where structures can be set up quickly. CSPs are exposed because the corporate vehicles in the chain often run through CSP-incorporated companies.

Why CSPs are gatekeepers

Corporate service providers occupy a structural position in the financial system that financial criminals find useful. The CSP incorporates the company. The CSP provides the registered office. The CSP files with ACRA. The CSP holds the relationship.

That is exactly why ACRA regulates CSPs. The CSP Act 2024 was enacted to regulate persons who carry on a business of providing corporate services and to impose requirements on those persons so as to detect or prevent money laundering, the financing of the proliferation of weapons of mass destruction, and terrorism financing. The CSP is part of the front line.

The diagram below shows how a CSP-incorporated entity sits inside a typical layering structure. Click each entity to see what role it plays.

Recognise the pattern

Knowledge checks are formative — they help you consolidate. Your answer is not scored toward the terminal assessment.

The global framework — FATF

The Financial Action Task Force (FATF) is the intergovernmental body that sets the global standards for combating money laundering, terrorism financing, and proliferation financing. Singapore is a FATF member.

You do not need to memorise the FATF framework. What you do need to recognise is that the obligations the CSP — and you — operate under are not local inventions. They sit on a global standard that Singapore implements through its own laws.

Tap each tab to orient yourself to the pieces.

Why this matters to you

Whatever your role at the CSP — Compliance Officer, corporate-secretarial executive, accounts staff, IT support, reception — you are part of the firm's AML/CFT/CPF control framework.

The framework does not work because of the Compliance Officer alone. It works because the people who actually meet customers, handle documents, see transactions, and answer the phone notice things and escalate them. ACRA's expectations on the CSP run through the firm's people, and that includes you.

What is expected of every staff member

• Recognise. Notice when something does not look right — a customer's explanation that does not match the documents, an instruction that is unusual for that customer, a request to bypass a normal process.
• Escalate. Tell the Compliance Officer or MLRO per the IPPC. Internal escalation is the staff member's role. The MLRO decides what happens next.
• Document. Note what you saw, when, and who you told. Contemporaneous records protect both you and the firm.
• Do not investigate. Investigation is not the staff member's role. Asking the customer probing questions can damage the firm's response and can risk the criminal offence of tipping-off (covered in Lesson 6).
• Do not tell the customer. Even casual mentions can be tipping-off. Silence on the matter is the rule.

The legal obligation to train you

This training exists because the law requires the CSP to train its staff. The obligation is not optional and not a matter of internal preference — it is a regulatory mandate.

Under the Corporate Service Providers Regulations 2025 and the ACRA Guidelines for Registered Corporate Service Providers, the registered CSP must ensure that its employees are trained on:

• The laws for the prevention of money laundering, proliferation financing, and terrorism financing — including the CSP Regulations themselves, the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act, the Terrorism (Suppression of Financing) Act, and other legislation specified by ACRA.
• Prevailing methods of, and trends in, money laundering, terrorism financing, and proliferation financing.
• The CSP's own Internal Policies, Procedures and Controls (IPPC), including the roles and responsibilities of employees, registered Qualified Individuals, and officers in relation to those policies and procedures.

ACRA's Guidelines further state that training should cover recognition of suspicious activities and transactions, the impact of ML/TF/PF on the firm, the risks the firm faces given its business profile, the changing behaviour of those who launder and finance terrorism, and the firm's CDD and ongoing monitoring measures.

On frequency, ACRA's Guidelines are direct: "the frequency of training should be sufficient to maintain the knowledge and competence of employees to apply CDD measures appropriately. For avoidance of doubt, employees should at least be trained on an annual basis."

Lesson 1 wrap

The five things to take from this lesson.

1. Money laundering, terrorism financing, and proliferation financing are different things. ML hides the origin of criminal funds. TF funds harmful activity, often from legitimate sources. PF funds weapons of mass destruction.
2. Money laundering moves through three stages: placement, layering, integration. CSPs are most exposed at the layering stage, where corporate vehicles are used to obscure the audit trail.
3. CSPs are gatekeepers. The CSP-incorporated company is a respectability layer in many laundering structures. ACRA regulates CSPs precisely because of this exposure.
4. The framework is global, the obligation is local. FATF sets the standards. Singapore implements them through the CSP Act, the CSP Regulations, the ACRA Guidelines, the CDSA, TSOFA, and the UN Act.
5. Recognise and escalate. Every staff member is part of the control framework. Notice things. Tell the Compliance Officer or MLRO per the IPPC. Do not investigate. Do not tell the customer.

ACRA — the regulator

The Accounting and Corporate Regulatory Authority is the regulator of business registration, financial reporting, public accountants, and corporate service providers in Singapore.

For a CSP and its staff, ACRA matters in three concrete ways.

1. ACRA registers the firm

A person who carries on a business of providing corporate services must be registered with ACRA as a registered Corporate Service Provider. Registration is granted under section 8 of the CSP Act, with conditions and a registration period set by the Registrar. The CSP must renew its registration to continue operating.

2. ACRA supervises the firm

Registration is not a one-time check. ACRA supervises CSPs continuously. The Registrar can request information, can inspect the CSP's records, and can take regulatory action where the CSP is contravening or has failed to comply with the CSP Act, the CSP Regulations, or the conditions of its registration.

3. ACRA enforces the framework

ACRA's enforcement powers are detailed and graduated — censure, financial penalty, ETS restriction, suspension, cancellation. Lesson 2.9 covers the consequences of breach in detail.

The CSP Act 2024 and CSP Regulations 2025

On 9 June 2025, the regime for corporate service providers in Singapore changed. The Corporate Service Providers Act 2024 and the Corporate Service Providers Regulations 2025 came into force, replacing the old Registered Filing Agent (RFA) regime under the ACRA Act.

The change was substantial. Under the previous regime, regulation focused mainly on entities filing transactions in BizFile. The new regime is broader and more demanding. It covers a wider set of corporate services, imposes more detailed AML/CFT/CPF duties, and introduces a more prescriptive framework around CDD, the IPPC, and the responsibilities of registered Qualified Individuals.

What you need to recognise

• The CSP Act 2024 is the primary statute governing the CSP's regulatory obligations.
• The CSP Regulations 2025 are the subsidiary legislation that puts detailed requirements on top of the Act — including the CDD measures, the IPPC components, and the staff training obligation.
• The ACRA Guidelines for Registered Corporate Service Providers translate the Act and Regulations into operational guidance the CSP follows. The Guidelines are how ACRA expects the framework to be applied in practice.

You do not need to read the Act and the Regulations cover-to-cover. The CSP's IPPC operationalises them for the firm, and your training operationalises the IPPC for you. But you should recognise the names — when a CO references "regulation 37" or "Guidelines paragraph 6.72," those references come from this framework.

Who is a Registered CSP?

The CSP Act regulates persons who carry on a business of providing "corporate services." That phrase has a specific meaning in the Act. Tap each tab to see the four categories at recognition level.

Recognise CSP-regulated activity

Fit and proper — the firm

For a firm to be registered as a CSP, every Key Appointment Holder of the firm must be a fit and proper person. This is checked at registration, at renewal, and continuously throughout the registration period.

"Fit and proper" is not a single test. It is a set of factors that the Registrar may consider. The Regulations and the Guidelines set out the factors.

The fit-and-proper factors for a Key Appointment Holder include

• Whether the person has been convicted (in Singapore or elsewhere) of an offence involving fraud or dishonesty punishable by imprisonment of three months or more, or of any other relevant offence.
• Whether the person is an undischarged bankrupt, in Singapore or elsewhere.
• Whether the person's previous conduct and compliance history as a KAH, registered CSP, or registered Qualified Individual has been satisfactory.
• Whether the person has acted in a manner that adversely reflects on their commercial integrity — including professional misconduct, breach of fiduciary duty, or serious negligence.
• Whether it would be contrary to the national or general public interest for the person to hold the position.

The Registrar may decline or withdraw a registration on fit-and-proper grounds. The firm's continued fitness and propriety is a continuous obligation — events after registration (a conviction, a bankruptcy, regulatory breaches) can change the position.

Fit and proper — staff

The fit-and-proper concept does not stop at the KAH layer. The CSP must screen the people it hires and continues to employ — and the people it authorises to use the electronic transaction system on the firm's behalf must themselves meet a fit-and-proper standard.

The Regulations require the registered CSP to screen its employees as part of its IPPC. The CSP must also be able to demonstrate that authorised employees of the firm are fit and proper to use the electronic transaction system.

What this means for you as a staff member

• Pre-employment screening. The CSP will carry out checks before hiring you — typically including criminal-record check, bankruptcy check, prior employment, and references. This is part of the firm's IPPC.
• Ongoing disclosure. The firm relies on you to disclose changes during your employment. If you become bankrupt, are charged with or convicted of an offence, are subject to regulatory action by another supervisor, or otherwise have a circumstance that would change the firm's assessment of you, you must tell the firm. The IPPC sets out how.
• Authorised employees. If you are an authorised employee using the electronic transaction system, your fit-and-proper status is supervised continuously by the registered Qualified Individual.

The IPPC — your firm's internal rulebook

The Internal Policies, Procedures and Controls (IPPC) is the document — or set of documents — in which the CSP records how it meets its AML/CFT/CPF obligations. Every registered CSP must have one. Every staff member must follow it.

The Regulations require the IPPC to cover specified components. The Guidelines elaborate on what each component contains. Tap through the four groupings below to see what is in scope.

Roles in the firm

The CSP's controls are operated by people in defined roles. Click each role in the diagram below to see what the role does and how you interact with it.

Correct internal escalation

Consequences of breach — the firm

When a CSP contravenes or fails to comply with the CSP Act, the CSP Regulations, or the conditions of its registration — and that contravention is not a criminal offence — the Registrar has a graduated set of regulatory tools. Tap each card to see what they are.

Before the Registrar takes any of these regulatory actions, the CSP must be given written notice of the proposed action and at least 14 days to make written representations. The CSP also has a right of appeal to the Minister, within 30 days of the regulatory decision. These are due-process protections — they do not stop the action, they regulate how it is taken.

Where the criminal offences sit

The S$25,000 financial penalty is for contraventions that are not criminal offences under the CSP Act. Where a contravention is a criminal offence under the Act, the criminal penalties for that offence apply instead — these can include imprisonment. Separately, criminal liability for money laundering itself sits under the CDSA (covered in Lesson 6) and for terrorism financing under TSOFA. A serious AML breach can therefore involve regulatory action under the CSP Act and separate criminal proceedings under another statute.

Consequences of breach — individuals

The CSP Act regime does not stop at the firm. Key Appointment Holders, Registered Qualified Individuals, and ordinary staff each have individual exposure under the framework — though the type of exposure differs.

Key Appointment Holders

A KAH must be fit and proper continuously. Loss of fit-and-proper status — through a criminal conviction, bankruptcy, prior regulatory action, or conduct adverse to commercial integrity — can result in the firm losing its registration, or in regulatory action targeting the KAH directly.

Registered Qualified Individuals

An RQI is individually registered with ACRA. The Registrar can take regulatory action against an RQI directly under section 21 of the Act, including cancellation of the RQI's registration, suspension up to 12 months, ETS restriction, financial penalty, and censure. The RQI's individual fit-and-proper status is checked at registration and continuously.

Authorised employees

Authorised employees who use the electronic transaction system must themselves meet a fit-and-proper standard, supervised by the RQI. Loss of fit-and-proper status terminates their authorisation.

All staff — and you

For ordinary staff, the regulatory exposure under the CSP Act is indirect — through the firm and through your fit-and-proper status as an employee. But criminal exposure is direct: criminal offences under the CDSA (money laundering offences, tipping-off), under TSOFA (terrorism financing offences), and under the UN Act (sanctions offences) apply to individuals regardless of role. These are covered in Lesson 6.

Lesson 2 wrap

The seven things to take from this lesson.

1. ACRA is the regulator. ACRA registers, supervises, and enforces against CSPs.
2. The CSP Act 2024 and CSP Regulations 2025 are the framework. They came into force on 9 June 2025 and replaced the old RFA regime.
3. Four broad categories of corporate services trigger CSP registration — director/nominee provision, registered office, corporate secretarial, and ACRA filing.
4. Fit-and-proper is continuous. KAHs, RQIs, and staff must meet the standard at registration and throughout their role.
5. The IPPC is your firm's rulebook. Eight components grouped across CDD/monitoring, reporting/records, risk/audit, and people/communication.
6. Roles and escalation paths are defined. CO/MLRO, RQI, authorised employees, all staff. Recognise and escalate to the CO/MLRO per the IPPC.
7. Consequences of breach are graduated and reach individuals. Up to S$25,000 per contravention at firm level; cancellation, suspension, ETS restriction, censure on top. Individual regulatory exposure for KAHs and RQIs. Individual criminal exposure for everyone under the CDSA, TSOFA, and UN Act.

What CDD is

Customer Due Diligence — CDD — is the structured set of measures the CSP performs on every customer to know who the customer is, who really owns or controls the customer, what the relationship is for, and to keep watching the relationship over time.

CDD is the central AML/CFT/CPF control. It is what the regulator inspects when it inspects a CSP. It is what makes the firm's risk-based approach possible — without knowing the customer, the firm cannot calibrate its controls to risk. And it is what gives the staff member the information they need to recognise when something does not look right.

Why CDD exists

CDD is not paperwork for the sake of paperwork. It is the firm's evidence — to itself, to its regulator, and if necessary to the authorities — that it knew its customer and acted reasonably on what it knew. Where a customer turns out to be involved in ML, TF, or PF, the firm's CDD is what shows whether the firm met its obligations or did not.

The four CDD triggers

CDD applies in four specific situations. Tap each tab to explore — at the All-Staff level, you need to recognise that all four exist and that any one of them triggers CDD.

Identification vs verification

Identification and verification are different things. Both are required. A common error in compliance work is to treat collecting the customer's information as completing CDD — it is not.

Identification vs verification

Identifying an individual customer

For an individual customer — a natural person — the CSP must identify and verify the following five data points. Tap each card to see what the data point is and what counts as verification.

Identifying a corporate or legal-entity customer

When the customer is a company, partnership, trust, or other legal arrangement, identification has more layers. The CSP must identify the entity itself, the individuals who are authorised to act for the entity, and — crucially — the natural persons who ultimately own or control the entity (covered in detail on the next two screens).

What the CSP identifies for a corporate customer

• The entity's name and registered name(s). Verified from the corporate registry of the place of incorporation.
• The entity's registration number. ACRA UEN for Singapore companies; equivalent for foreign companies.
• The entity's registered address and place of business. Verified from the corporate registry and from independent sources.
• The entity's legal form. Pte Ltd, public company, partnership, LLP, foundation, trust, etc.
• The entity's directors, partners, or equivalent. Identified individually as natural persons.
• The persons authorised to act for the entity. Officers, signatories, agents — covered on screen 3.9.
• The beneficial owners. Covered on screens 3.7 and 3.8.

The challenge with corporate customers

An individual customer is one natural person whose identity can be checked against one identification document. A corporate customer is a legal entity whose ownership and control can run through multiple layers, multiple jurisdictions, and multiple legal forms. CDD on a corporate customer is more demanding because the firm must keep tracing until it reaches the natural persons behind the structure.

Beneficial ownership — two regimes that connect

Identifying the beneficial owner is the hardest and most important part of CDD. In Singapore, two distinct regimes both require identification of who really owns or controls a company. They overlap, but they are not the same. A staff member needs to recognise both.

Regime 1 — The CSP Regulations beneficial-owner test

Under the CSP Regulations 2025, a "beneficial owner" of a customer is:

Note what is and is not in this definition. No percentage threshold. No minimum shareholding. The test is "ultimate" ownership, "ultimate" control, or "on whose behalf." The CSP must keep tracing until it reaches a natural person who answers one of (a), (b), or (c).

Regime 2 — The Companies Act controller-identification methodology

Singapore companies must maintain a Register of Registrable Controllers (RORC) under the Companies Act 1967. To identify who goes in the RORC, the company applies the controller-identification methodology in the Sixteenth Schedule of the Companies Act. The methodology uses a 25% threshold for "significant interest" plus additional tests for "significant control."

The methodology also includes an indirect-deeming rule: where a person controls 20% or more of the voting power in a legal entity that is itself a registrable controller of the company, that person is deemed to have an interest in the underlying shares.

How they connect

The Companies Act controller methodology is the practical Singapore tool for tracing ownership through layered structures. It is what the CSP often uses to identify candidate beneficial owners. But it is not the same as the CSP Regulations CDD obligation.

• Every registrable controller under the Companies Act methodology is a strong candidate to be a beneficial owner under the CSP Regulations.
• But the CSP Regulations definition is broader. A person can be a beneficial owner under regulation 16 even if they do not cross the 25% controller thresholds — because the test is "ultimate" ownership or control, not a percentage.
• This matters most with nominee arrangements, trust structures, and chains where each layer has small ownership stakes that aggregate to a single ultimate person.

Tracing beneficial ownership — a worked example

Click each entity in the structure below. Each click shows you what the entity is, whether it is a registrable controller under the Companies Act methodology, whether it is a beneficial owner under the CSP Regulations, or both.

Agents and authorised representatives

Sometimes the customer does not deal with the CSP directly. An agent, an attorney, an introducing professional, or a corporate officer may act on the customer's behalf.

When that happens, the CSP must identify and verify both the customer and the person acting for them. The customer remains the customer — CDD on the customer is unchanged. The agent is identified as a separate matter, and the CSP must also satisfy itself that the agent has authority to act.

What the CSP identifies and verifies

• The agent's identity. The same five data points as for an individual customer — name, identity number, address, date of birth, nationality.
• The agent's authority. Power of attorney, board resolution, appointment letter, or equivalent. The CSP must record what authority the agent has and the limits of that authority.
• The relationship between the agent and the customer. How they are connected, why this person is acting for the customer.

A common pattern that needs care

Where the agent is also the person who appears to make all the decisions, who never lets the CSP speak with the customer directly, who is the only point of contact and resists any direct customer engagement — that combination is a recognisable red flag. It can mean the named "customer" is a front for the agent.

Beneficial ownership in a layered structure

Purpose and ongoing monitoring

CDD has two further components beyond identification, verification, and beneficial ownership: understanding the purpose of the relationship, and monitoring the relationship over time.

Purpose and intended nature of the relationship

At onboarding, the CSP must understand what the customer wants the corporate structure for. "Investment holding" without further detail is insufficient. "International trade" is insufficient unless the CSP knows what is being traded, with whom, and why this structure suits that activity. The purpose informs the firm's risk assessment and informs what looks unusual later.

Ongoing monitoring

The relationship is monitored throughout its life. Trigger events for CDD refresh include:

• Changes in ownership or control — new directors, new shareholders, change of beneficial ownership.
• Changes in the nature of the customer's business activity.
• Unusual transactions or instructions inconsistent with the established profile.
• Periodic review based on risk rating — higher-risk customers more often, lower-risk customers less often.

Why monitoring matters

Onboarding CDD is a snapshot. The relationship lives over months or years. A customer who looked low-risk at onboarding may become higher-risk later — perhaps because the customer's circumstances changed, or because the CSP learns something new. Monitoring is what catches that change.

Simplified CDD vs Enhanced CDD

Standard CDD is the default. The CSP performs the full set of CDD measures on every customer. In two specific situations, the level of CDD changes: Simplified CDD is permitted for genuinely lower-risk customers, and Enhanced CDD is required for higher-risk customers. Tap each tab.

Reliance on third parties for CDD

In limited circumstances, the CSP may rely on CDD performed by another regulated party — for example, a Singapore financial institution that has already done CDD on the same customer. Reliance is permitted under regulation 24 of the CSP Regulations, but it comes with a critical caveat.

The conditions for reliance

• The third party must be a permitted person — typically a Singapore-regulated financial institution, an advocate or solicitor, a public accountant, or a group entity subject to equivalent AML/CFT/CPF requirements.
• The third party must be subject to AML/CFT/CPF measures equivalent to FATF standards.
• The third party must be able and willing to provide the CDD documents to the CSP without delay on request.
• The CSP must satisfy itself that the third party has adequate measures in place.

The critical caveat

This is the most important point on this screen. Reliance is permitted as a practical accommodation, not as a transfer of liability. A CSP that relies on a third party must do so deliberately, document the basis for the reliance, and keep evidence on file.

CDD red flags — recognise and escalate

The list below is a recognition checklist. These are the kinds of features that should make a staff member pause during CDD and consider whether the matter should be escalated. The drag-and-match exercise sorts each red flag into the part of the customer relationship where it typically appears.

Lesson 3 wrap

The six things to take from this lesson.

1. CDD is the central control. Identification, verification, beneficial ownership, purpose, and ongoing monitoring — performed and documented.
2. Four CDD triggers. New relationship, suspicion, doubt about earlier information, periodic risk-based refresh.
3. Identification ≠ verification. Both are required. Identification is the claim. Verification is the independent evidence the claim is true.
4. Beneficial ownership runs through two regimes. The Companies Act methodology (25% controller test plus significant-control tests) is the practical Singapore tool for tracing ownership. The CSP Regulations definition (ultimate ownership, ultimate control, on whose behalf) is the broader CDD test. Identifying every controller is necessary; reaching every natural person at the end of every chain is sufficient.
5. Standard CDD is the default. Simplified CDD is reserved for documented low-risk customers. Enhanced CDD is required for higher-risk customers — PEPs, FATF-listed jurisdictions, complex unexplained structures.
6. Reliance on a third party does not transfer the obligation. The CSP remains responsible for CDD even where another regulated party has already performed it.

The risk-based approach

Not every customer presents the same risk. The CSP Regulations require the firm to perform CDD on a risk-sensitive basis — meaning the level of CDD applied to a particular customer must reflect the risk that customer presents.

This is the risk-based approach. It is the framework that decides whether a customer gets Standard CDD, Simplified CDD, or Enhanced CDD. It is the framework that decides how often the firm refreshes CDD on a customer. And it is the framework the regulator inspects when it examines whether the firm's controls are adequate.

Two layers of risk assessment

The risk-based approach has two layers, and you should recognise both.

• Firm-level risk assessment. The CSP must assess its overall ML/PF/TF risk exposure — the risks it faces given its customer base, the corporate services it provides, the jurisdictions it touches, and the contextual environment. This is the firm's enterprise-wide risk assessment, and it informs the firm's controls overall.
• Customer-level risk rating. For each individual customer, the CSP rates the risk that customer presents — typically as low, medium, or high. The customer rating drives the CDD level applied to that customer.

Customer risk factors — what drives the rating

A customer's risk rating is built from several dimensions. ACRA's Guidelines and Annex B set out the factors. Tap each tab to explore the four major dimensions.

Country risk — the FATF lists

Country and jurisdiction risk is often the single most consequential risk factor. ACRA's Guidelines explicitly require the CSP to keep up to date on two FATF lists and to apply different CDD treatment depending on which list a customer's jurisdiction is on.

What this means for the CSP

The firm must subscribe to FATF updates and refresh its country-risk information as the lists change. A customer onboarded when their country was unlisted may need a CDD refresh if the country is added to the black list or grey list later. This is one of the trigger events for ongoing monitoring (Lesson 3).

Country risk and CDD level

What is a Politically Exposed Person?

A Politically Exposed Person — PEP — is an individual entrusted with a prominent public function. PEPs are higher-risk customers because of their position, exposure to influence, and access to public funds. The CSP Regulations define three categories, plus an extension to family members and close associates.

PEP risk treatment — not all PEPs are treated the same

The CSP Regulations and ACRA Guidelines treat the three PEP categories differently. The decision tree below shows the treatment for each category. Foreign PEPs always receive Enhanced CDD; Singapore and International Organisation PEPs may receive a risk-sensitive approach in defined circumstances.

Source of Wealth and Source of Funds

For Enhanced CDD, the CSP must establish — by appropriate and reasonable means — both the Source of Wealth (SOW) and the Source of Funds (SOF) involved in the proposed business relationship. They are different things, and the firm must document both.

Why the firm needs both

SOW and SOF together let the firm assess whether the customer's profile makes sense. A customer with substantial declared wealth (SOW) but unexplained funds in the relationship (SOF) is a recognisable concern. A customer with modest declared wealth but very large funds in a single transaction is another. The two together give the firm a check.

Targeted financial sanctions — the four sources

The CSP must screen every customer, agent, connected party, and beneficial owner against designation lists. ACRA's Guidelines identify four sources the CSP must subscribe to and screen against. Click each source in the diagram below to see what it is.

Customer screening — what, when, and who

The previous screen showed the four sources to screen against. This screen sets out the operational discipline of screening — who gets screened, when, and what the CSP does with the results.

Who must be screened

Under regulation 22, the CSP must screen each of the following against the four sources:

• The customer.
• Every agent of the customer.
• Every connected party of the customer (directors, officers, partners, equivalent).
• Every beneficial owner of the customer.
• Where the transaction relates to forming a new corporation or other legal person — every agent, connected party, and beneficial owner of the proposed entity.

When screening happens

• At onboarding. Before the relationship is established or the corporate service is provided.
• On periodic basis. The frequency depends on the customer's risk rating — higher-risk customers more often.
• On changes to the customer. New beneficial owner, new director, new authorised representative — re-screening is triggered.
• On changes to the lists. When the MAS list, the TSOFA First Schedule, the IMC-TD list, or the UN designations are updated, the CSP must re-screen affected customers.

What the CSP must document

The CSP must document the results of every screening — including any determination made about ML/PF/TF risk in relation to the customer or any agent, connected party, or beneficial owner. Screenshots or printouts of search results are typical evidence. Without documentation, the CSP cannot demonstrate to the regulator that screening was performed.

Foreign PEP CDD treatment

Scenario — recognising and responding

A short branching scenario. You will move through three decision points — at each, choose the response you think is correct. Each choice plays out and you see the consequence. Restart at any time.

Lesson 4 wrap

The seven things to take from this lesson.

1. The risk-based approach. CDD level is calibrated to risk. Firm-level risk assessment plus customer-level rating drive the controls applied.
2. Customer risk has four major dimensions. Profile, country, service or transaction, source of funds.
3. FATF black list = mandatory Enhanced CDD; FATF grey list = informs the firm's risk assessment. Both lists are live and change at every FATF Plenary.
4. PEPs come in three categories. Singapore, Foreign, International Organisation. Plus immediate family members and close associates.
5. Foreign PEPs always get Enhanced CDD. Singapore and IO PEPs get a risk-sensitive approach unless high risk is present. Stepped-down PEPs are assessed on remaining influence.
6. Source of Wealth ≠ Source of Funds. Both must be established for Enhanced CDD. Customer pushback on either is a red flag.
7. Targeted financial sanctions screening has four sources. UN Act, TSOFA First Schedule, MAS list, MHA IMC-TD list. Customer + agent + connected party + beneficial owner all get screened.

What red flags are

A red flag is a feature of a customer, a transaction, or a structure that does not look right and that warrants further attention. ACRA's Guidelines include a substantial Annex A — "Indicators of Suspicious Transactions" — which sets out red flags by category.

Annex A is the canonical Singapore red-flag list for CSPs. It is not exhaustive — and it explicitly says so. New patterns emerge, criminals adapt, typologies evolve. The Annex is a recognition baseline, not a closed catalogue. The CSP and its staff must also recognise patterns that are not specifically listed but that share the features of patterns that are.

Recognition vs investigation

This is the central discipline of Lesson 5. The All-Staff member's role is recognition — noticing the red flag — and escalation. Investigation is not the All-Staff member's role.

• Recognise. See the pattern. Note what you saw.
• Document. Write it down — what you saw, when, who said what.
• Escalate. Report internally to the CO or MLRO per the IPPC.
• Do not investigate. Asking the customer probing questions is not your job.
• Do not tell the customer. Silence is the rule. Tipping-off is a criminal offence — covered fully in Lesson 6.

Red flags by category

ACRA's Annex A organises red flags by where in the customer relationship they appear. Tap each tab to see the major categories. The lists below are illustrative — Annex A contains more.

The Singapore shell-company pattern

ACRA's Annex A documents a specific Singapore-typology pattern — a recognisable sequence of features that frequently appears together in Singapore-incorporated shell companies misused for laundering. Step through the four phases of the pattern below.

Pattern recognition

Tipping-off — the discipline that makes recognition work

Recognition only protects the firm if the customer never finds out. If the customer knows or suspects that the firm has flagged them, the firm's response is compromised — and the staff member who told them may have committed a criminal offence.

What you can — and cannot — do

• You can continue ordinary professional dealings with the customer. The relationship does not pause just because you escalated.
• You can document what you saw, when, and what you said. Contemporaneous records protect you and the firm.
• You can — and must — report internally to the CO or MLRO per the IPPC.
• You cannot tell the customer that you have escalated, that the firm is reviewing them, that an STR is being considered, that authorities have been informed, or that any compliance concern has been raised.
• You cannot tell anyone outside the firm — friends, family, social contacts — about a customer matter that has been or might be reported.
• You cannot tell anyone within the firm who does not have a legitimate need to know.

Why this is in Lesson 5

Tipping-off is a criminal offence under section 48 of the CDSA. The full treatment of the offence — what it covers, what the penalties are, how it interacts with the STR process, and how to act in the often-difficult situation where you have flagged a customer but must continue interacting with them — is in Lesson 6.

Lesson 5 introduces tipping-off as a behavioural rule because the rule is part of the recognise-and-escalate principle. Recognition without the discipline of silence is not a complete control.

Spot-the-red-flag — practice scenario

A practice exercise. Below is a fictional onboarding-pack extract for a new corporate customer. Click on the parts of the text that strike you as red flags. The exercise highlights each correct flag as you find it. Five flags are present.

Terrorism financing red flags

TF red flags differ from ML red flags in three important ways: TF amounts can be small, TF funds can come from legitimate sources, and TF detection often depends on screening more than on transaction analysis.

Indicators worth recognising

• Adverse news links. Customer or counterparty featured in adverse news or sanctions lists related to terrorism or terrorism financing.
• Designation list hits. The customer, an agent, a connected party, or a beneficial owner is on the TSOFA First Schedule, the UN Security Council ISIL/Al-Qaida list, the UN Taliban List, or the MHA IMC-TD list.
• Conflict-zone activity. Transactions linked to entities in conflict zones where terrorism activity is present and the declared purpose does not match the parties' profile.
• Charitable veneer. Transactions characterised as donations or contributions to humanitarian aid, particularly to NPOs or religious organisations in conflict zones.
• Dormant-account activation. Dormant accounts with minimal activity show inflows from unknown origins followed by transfers to conflict-zone beneficiaries.
• Profile mismatch. Customer suddenly procuring or shipping items to conflict zones inconsistent with the customer's line of business.
• Online-account anomalies. Customer logs in to online banking from locations in conflict zones with no lawful or legitimate purpose.
• Cash patterns. Frequent cash deposits and withdrawals; counterparties making frequent cash deposits into customer accounts.

Proliferation financing red flags

PF red flags concentrate around dual-use goods, opaque trade structures, and links to countries of proliferation concern. CSPs see PF most often through the corporate vehicle being used in the chain.

Sanctions evasion patterns

Sanctions evasion is the activity of structuring transactions to avoid detection by the sanctions framework. ACRA's Annex A lists specific evasion patterns. The CSP rarely sees the sanctioned activity itself — but the corporate vehicles used in evasion pass through CSPs.

The patterns to recognise

• WMD-controlled items. Transactions involving items controlled under WMD export control regimes or national control regimes.
• Dual-national involvement with technical mismatch. A dual-national connected with a country of proliferation concern is involved in transactions for complex equipment for which they lack the technical background. The mismatch between technical capacity and the goods being handled is the indicator.
• Cash or precious metals for industrial items. Use of cash or precious metals (e.g. gold) in transactions for industrial items where bank instruments would be normal. Suggests deliberate avoidance of the banking-channel scrutiny that sanctions screening relies on.
• Small intermediary companies. A small trading, brokering, or intermediary company carrying out business inconsistent with its normal business — a tell that the company is being used as a pass-through.
• Customer acting as money-remittance. A declared commercial business whose transaction patterns suggest it is acting as a money-remittance service rather than as the business it claims to be.
• "Ledger" arrangements. Companies dealing on the basis of internal ledger arrangements that obviate the need for international financial transactions. Funds offset across jurisdictions without crossing borders.
• Linked counterparties. Customers and counterparties sharing common addresses, IP addresses, telephone numbers, or apparent coordination of activity — suggesting the same actor controlling multiple ostensibly independent parties.
• University involvement. Involvement of a university in a country of proliferation concern — research and procurement vectors are recognised concealment routes.
• Falsified documentation. Evidence that shipping, customs, or payment documents have been altered or fabricated.
• Personal-account use for industrial items. Use of personal bank accounts to purchase industrial equipment or goods — separating the transaction from the corporate-account scrutiny it would normally attract.

Mixed typology recognition

When red flags are not red flags

Annex A is explicit on a point worth understanding: not every red flag turns out to be a real concern. Many features on the list have legitimate explanations. The discipline of recognise-and-escalate works because the CO/MLRO has the time, the information, and the authority to assess each case — not because every red flag is automatically a confirmed problem.

Common false positives

• The legitimate offshore holding. A BVI or Cayman holding company is not, by itself, suspicious. Many legitimate businesses use these structures for tax and asset-protection reasons. The structure becomes a flag only when combined with other features — opaque ownership, no commercial logic, unexplained funds, and so on.
• The wealthy customer with cash exposure. A genuinely wealthy customer may have substantial cash flows that look unusual at first glance. Documented Source of Wealth and Source of Funds may explain them.
• The high-volume legitimate trader. A real trading business may have rapid in-out flows that look like a pass-through. Trading documents, invoices, and counterparty profiles may explain the pattern.
• The non-resident director. Many legitimate Singapore companies have non-resident directors. The director becomes a flag only when combined with the other shell-company features.

The principle

Red flags are starting points, not conclusions. The staff member's job is recognition. The CO/MLRO's job is to take recognised red flags, gather context, and decide whether the case is what the pattern suggests or has a legitimate explanation. Even where the assessment concludes the case is legitimate, the firm documents the reasoning — that is the audit trail the regulator inspects.

Lesson 5 wrap

The seven things to take from this lesson.

1. Annex A is the canonical Singapore red-flag list. Five major categories: incorporation/address, nominee, transaction, ML, and TF/PF/sanctions. Not exhaustive — a starting point.
2. Recognise, document, escalate. Do not investigate. Do not tell the customer. This is the All-Staff discipline that does not change across lessons.
3. The Singapore shell-company pattern. Low paid-up capital + foreign directors with no Singapore activity + multiple bank accounts + rapid pass-through remittances + low end-of-day balances. Documented in Annex A.
4. TF red flags differ from ML. Small amounts, legitimate sources, conflict-zone exposure, charitable veneer. Detection depends on screening and profile-matching.
5. PF surfaces through the corporate vehicle. Dual-use goods, opaque trade chains, designated-person involvement, trade-document inconsistencies.
6. Sanctions evasion uses concealment patterns. Ledger arrangements, dual-national mismatch, cash for industrial items, small-intermediary use.
7. Not every red flag is a real concern. The CO/MLRO assesses. The staff member's job is recognition; the firm's documented assessment is what the regulator inspects.

The two-step model — internal escalation, then STR filing

The framework operates in two distinct steps. Conflating them is one of the most common errors. Staff members never file STRs directly. The two steps run through different people and serve different functions.

Why the separation matters

The CO/MLRO has visibility across the firm's customer base, has seen comparable matters before, and is trained to assess whether a particular concern crosses the suspicion threshold under the CDSA. The staff member is the recognition point — closest to the customer, often the first person to see something odd. The two-step model puts each role where it adds value: recognition at the front, assessment and filing at the centre.

Internal escalation — what triggers it

The threshold for internal escalation is "knows or has reasonable grounds to suspect." This is a meaningful standard — and it is lower than "knows for certain" or "has proof of."

What "reasonable grounds to suspect" means

The staff member does not need to be certain that a customer's property is connected to ML, PF, or TF. The staff member does not need to have proof. The standard is reasonableness — would a reasonable person in the staff member's position, given what is known, suspect a connection? If the answer is yes, the duty to escalate is triggered.

This is deliberately calibrated. If escalation required certainty, criminals would simply remain ambiguous enough to avoid the trigger. The "reasonable grounds" standard means the framework can act on patterns — recognised typologies, red flag combinations, customer behaviours — without waiting for proof.

Recent change — the "rash" and "negligent" offences

The CDSA was amended in February 2024 to add new offences. Among them: continuing with a transaction in the face of red flags that should have prompted further inquiry can itself be an offence — even without proof of actual knowledge. This makes the recognise-and-escalate discipline more important than ever. Doing the work despite obvious concerns is no longer a defence.

What a Suspicious Transaction Report is

An STR is the formal report a Singapore-regulated person (or a CSP) files with STRO when there are reasonable grounds to suspect that property is connected to a criminal conduct under the CDSA. Tap each tab to explore — at the All-Staff level, you need to recognise what an STR is and how it works, even though you do not file it yourself.

Internal escalation vs direct filing

STR timing — two deadlines

ACRA's Guidelines set two STR-filing deadlines depending on the risk type. Both run from the establishment of suspicion — not from when the suspicious feature was first observed.

The decision not to file

The CO or MLRO can decide not to file an STR despite an internal escalation. The framework recognises that not every internal escalation crosses the suspicion threshold. But the non-filing decision is itself regulated.

What the framework requires for non-filing

Under ACRA's Guidelines paragraph 6.84, where a decision is made not to file an STR, the reasons for the non-filing must be documented and made available to the Registrar when required. The non-filing decision is part of the firm's audit trail. ACRA inspects the documented reasoning during supervisory reviews.

Why this matters

Non-filing without documentation looks identical to non-filing because of regulatory failure. The firm cannot defend a non-filing decision after the fact unless the reasoning was recorded at the time. The discipline of contemporaneous documentation protects the firm against later second-guessing — by the regulator, by law enforcement, or by the firm's own internal auditors.

Tipping-off — the criminal offence

Tipping-off is a criminal offence under section 48 of the CDSA. It carries fines of up to S$250,000 and imprisonment. It applies to anyone — staff, officers, agents, anyone in the firm — who discloses to another person information that is likely to prejudice an investigation by an authorised officer under the CDSA.

Tipping-off in the CDD context — the hardest case

Sometimes the CDD measures themselves would tip off the customer. The verification request, the SOW investigation, the document re-request — any of these can signal to the customer that the firm is escalating concerns. The framework provides a specific carve-out.

The carve-out — Guidelines paragraph 6.85

Where the CSP forms knowledge or suspicion of ML/PF/TF, and reasonably believes that performing any of the required CDD measures will tip off the customer (or their agent, connected party, or beneficial owner), the CSP may stop performing those measures, must document the basis for the assessment, and must file an STR without delay.

What this is, and what it is not

• It is a specific carve-out for the case where CDD itself would tip off. Three conditions must be met: knowledge or suspicion of ML/PF/TF, reasonable belief that CDD would tip off, and immediate STR filing.
• It is not a general license to skip CDD when it is inconvenient or when the customer pushes back. Customer pushback alone does not trigger the carve-out.
• It is not a way to onboard a customer without CDD. The carve-out applies after suspicion has formed — typically late in a relationship, not at onboarding.

Tipping-off scenario

TSOFA reporting — sections 8 and 10

The CDSA framework covers ML and predicate-offence reporting. Terrorism-financing reporting runs through the Terrorism (Suppression of Financing) Act (TSOFA) — sections 8 and 10 — using the same SONAR channel.

Record-keeping — the 5-year rule

Records of CDD, screening, monitoring, and STR-related activity must be kept for a minimum of 5 years from the date the CSP stops providing services to the customer. The clock runs from termination of the relationship — not from individual transactions.

What the rule says

Regulation 30 of the CSP Regulations 2025 sets the minimum at 5 years from termination of the business relationship with the customer. ACRA's Guidelines paragraph 6.55 confirms this. The Guidelines also state that the records may be kept in any format — hard copy or electronic — provided the standard for reconstruction is met.

The reconstruction standard

Guidelines paragraph 6.56 sets the substantive standard: records must be kept in a manner sufficient to permit a reconstruction of individual transactions, including the amounts and types of currency involved. This is the standard the regulator inspects. Records that cannot be reconstructed do not satisfy the requirement, regardless of format.

What records must be kept

ACRA's Guidelines specify the categories of records the CSP must retain. The list is set out in the IPPC sample (paragraph 5.1 of the model IPPC). Tap each card to see the four major groups.

Lesson 6 wrap

The seven things to take from this lesson.

1. The two-step model. Internal escalation (staff to CO/MLRO), then STR filing (CO/MLRO to STRO via SONAR). Staff never file directly.
2. The trigger is "reasonable grounds to suspect." Not certainty, not proof — reasonableness. If you find yourself asking "should I escalate?", the threshold has likely been met.
3. STR timing. 5 business days standard, 1 business day for higher-risk TFS/sanctions cases.
4. Tipping-off is criminal. CDSA s.48: fine up to S$250,000 / imprisonment. TSOFA s.10B: parallel offence. Silence on compliance matters is the rule.
5. The CDD-tipping-off carve-out. Where CDD itself would tip off the customer, the CSP may stop the measure, must document, must file STR without delay. Specific carve-out, not a general license.
6. 5-year record-keeping from termination of the relationship. Records must permit reconstruction including amounts and types of currency.
7. Good-faith filers are protected. CDSA s.39(6) protects good-faith disclosures. CDSA s.56 protects filer identity. The framework removes the personal-liability disincentive for escalating.

Terminal assessment

You have completed the six lessons. The terminal assessment confirms your understanding of the foundational AML/CFT/CPF framework. Read this introduction carefully before beginning.

Certificate

Issued by

OnResource Global Services FZC

Certificate of Completion

This is to certify that

[Learner name]

has completed the foundational training programme

Anti-Money Laundering,
Counter-Financing of Terrorism,
and Counter-Proliferation Financing
Foundations for Corporate Service Providers

comprising six lessons and a terminal assessment, achieving a passing score on the assessment.

Date

—

Score

—

This certificate confirms completion of an AML/CFT/CPF foundational training programme. It does not represent any specific ACRA training certification.

Print certificate / Save as PDF Edit my name