Monetary Authority of Singapore Banking Compliance for Companies Guide

Fact: 90% of regulated firms in the city-state faced supervisory reviews in the past five years, showing how intensely rules shape operations.

This guide maps practical steps to meet MAS expectations. It explains what MAS banking compliance means in practice: aligning governance, policies, controls, monitoring and evidential records across payments and financial services.

Readers will get a clear, practical route through core laws such as the Banking Act, MAS Act and Payments Act, and learn how to operationalise controls.

This material targets compliance leaders, board members, senior management, risk and tech teams at banks, digital lenders and partner firms. It treats good compliance as a business-critical capability, not a box-tick exercise.

Expect coverage of licensing scope, AML/CFT and customer due diligence, technology and outsourcing risk, and steps to prepare for expanding supervisory powers.

Key Takeaways

MAS is the singapore central bank and sole regulator; firms must follow its notices and circulars.
Compliance requires strong governance, controls and defensible documentation.
Core laws include the Banking Act, MAS Act, FSMA and Payments Act.
Risk teams must prioritise AML/CFT and technology controls.
Prepare for inspections, remediation orders and escalated supervisory action.

MAS in Singapore’s banking and finance regulatory framework

MAS sits at the centre of the city-state’s financial system, combining central bank duties with integrated regulation of market participants.

Why MAS is the single supervisory hub

As the central bank, MAS holds prudential tools and conduct powers in one regulator. This single point of accountability means prudential oversight and conduct supervision work together.

How global standards shape local rules

International frameworks such as Basel, FATF and IOSCO influence capital, liquidity and AML rules that institutions must follow. MAS translates these into law, notices and supervisory expectations that banks operationalise day-to-day.

Where market bodies fit

Domestic bodies like the ABS provide codes and practical guidance that firms adopt as good practice. The SFEMC pushes FX Global Code alignment through the Singapore Guide to Conduct, so market conduct reflects both regulator and industry signals.

Strong programmes track laws, supervisory signals and market practice—this guide shows how to make that operational.

Core legislation and regulatory instruments companies must track

This part lists the legal instruments that set duties for a bank and its related services. Keep a short legal inventory to link rules to business owners and controls.

Primary Acts and what to track

Start with the Banking Act 1970 and its subsidiary regulations, including the Corporate Governance rules that assign board and senior management duties.

MAS Act supervisory powers

The MAS Act creates supervisory tools such as recovery and resolution planning. Triggers include severe capital stress or likely suspension of payments and require immediate notification.

FSMA and sector-wide coverage

FSMA 2022 unifies oversight across financial services and tightens rules for digital token providers. This matters where a bank offers token-related or cross-line services.

Payment Services Act (PSA)

The PSA targets AML/CFT, consumer funds protection in insolvency, interoperability and cyber risks. Even where banks are exempt from licensing, certain payment functions are treated “as if” regulated.

Other conduct rules

SFA, FAA and IA obligations still shape conduct for banks’ capital markets, advisory and insurance activities. Maintain a living obligations register and a change-management process tied to risk assessments and evidence trails.

monetary authority of singapore banking compliance for companies best practices

Operational readiness depends on mapping rules to roles, records and testing cycles. Build a practical operating model that links MAS notices and guidance to daily checks, evidence routines and inspection playbooks.

Building a compliance operating model

Design an evidence-first model that generates clear decision logs, approvals and remediation trails. Structure controls so inspections and information requests can be answered quickly.

Defining roles and governance

Specify what the board must approve: risk appetite, key policies and the governance framework. Assign senior management responsibility for resourcing and implementation. Give compliance leadership oversight, testing and regular reporting duties.

Policies, procedures and audit trails

Keep procedures concise and output-focused. Produce monitoring outputs, exception logs and remediation trackers that auditors and examiners can follow without extra bureaucracy.

Preparing for expanded supervisory powers

Since the 10 January 2024 bill boosts MAS inspection and investigative reach, firms should strengthen documentation discipline, data retention and investigation playbooks. Run horizon scanning, impact assessments and post-implementation validation to stay ahead.

Licensing, permissions and business scope controls

Licensing choices shape product lines, depositor access and how groups structure cross-border services. The three licence categories — full, wholesale and merchant — set clear operational limits on product scope, customer segments and deposit-taking.

Full, wholesale and merchant bank regimes

Full banks can take retail deposits and run broad retail and corporate products. Wholesale banks focus on institutional clients and markets activity but cannot offer general retail services. Merchant banks face tighter rules: they may not solicit SGD deposits or raise funds locally.

Anti-commingling and related non-banking business

MAS applies an anti-commingling policy that keeps banks concentrated on financial lines unless expressly allowed. Regulation 23G permits linked non-banking activities only with board-approved governance and robust risk management.

Controls, thresholds and notifications

Aggregate non-financial business size is capped: 10% of capital funds for local-incorporated banks, or 1.5% of assets for foreign branches. Notify the regulator with a clear business description, investment quantum and governance plans.

Checklist: prepare a business case, governance policy, risk assessment and notification pack.
Report periodic measurements to senior management and keep inspection-ready records.
Consider partner structures where merchant or wholesale licence limits affect product design.

Digital bank realities

Restricted digital banks face deposit and capital caps (example: S$75,000 per depositor; S$50m aggregate; minimum paid-up capital S$15m) and must meet milestones to become full DFBs (minimum paid-up capital S$1.5bn). Recent entrants such as MariBank, GXS Bank and Trust Bank illustrate supervisory focus on capital, liquidity and untested models.

For payment-related permissions and licensing details consult the regulator’s guidance on payment services: payment service licensing.

Financial crime compliance: AML/CFT, customer due diligence and risk assessment

Strong financial crime programmes start with a clear, enterprise-wide risk map that links products, channels and customer types to specific threats.

Develop a documented AML blueprint that ranks risks by product, geography and client segment. Keep the risk assessment live and refresh it after new products or threat alerts.

Enterprise-wide risk assessment and control testing

Test controls regularly to show transaction monitoring, sanctions screening and escalation workflows work in practice. Evidence must include sampling, root‑cause notes and remediation logs.

Customer due diligence and lifecycle monitoring

Apply onboarding checks, beneficial ownership verification and periodic reviews tied to risk ratings. Document due diligence decisions and enhanced due diligence (EDD) outcomes.

Red-flag intelligence and collaborative sharing

Link behavioural red flags — unusual flows, rapid transfers, or inconsistent source‑of‑wealth statements — to clear escalation paths. Collaborative models such as COSMIC enable controlled sharing of red‑flag information among major banks and can improve detection.

Governance: record rationale for ratings, closures and suspicious transaction reporting.
Resilience: harden defences against scams, mule accounts and digital channel abuse.
Training: deliver role‑based, recurring AML and KYC programmes to sustain judgement and reduce gaps.

For regulatory detail on supervisory expectations and notice guidance, refer to the MAS notice on supervisory requirements: notice 626.

Technology, data and outsourcing risk management under MAS expectations

Effective tech governance turns guidance into controls that protect critical services and customer information. The MAS Technology Risk Management guidelines expect institutions to show measured, evidence‑led action on cyber resilience.

Applying principles to cyber security and resilience

Translate high‑level guidelines into an actionable control set: governance, secure architecture, vulnerability scans, access controls, logging and resilience testing. Ensure business owners and IT share clear roles.

Outsourcing, cloud and materiality

Decide if an arrangement is material by its potential operational or customer impact. Keep a documented, defensible self‑assessment that records why a cloud deal is material or not.

Contractual controls and third‑party oversight

Include audit rights, incident notification, continuity clauses and exit plans in contracts. Use ABS‑aligned practices to operationalise provider due diligence and subcontractor chains.

Data protection and incident readiness

Encrypt data in transit and at rest; manage keys and note that encrypted customer data may alter materiality tests. Prepare playbooks for breaches, escalate swiftly and be ready to notify MAS and stakeholders.

Keep evidence ready, and link contractual and technical controls to board‑level reporting and testing regimes. For legal terms see the terms and conditions.

Conclusion

An evidence-led operating model helps a bank meet evolving rules and keep services steady. Clear roles, routine testing and quick remediation make management accountable from board level to frontline teams.

Treat licence scope, anti-commingling limits and permissions as ongoing controls, not one-off checks. Maintain a living obligations register that links the Banking Act, MAS Act, FSMA and PSA to enacted controls.

Financial crime work must be core: carry out enterprise risk assessments, lifecycle CDD, regular AML/CFT testing and use red-flag intelligence where useful.

Protect technology and data with risk-based materiality tests, audited contracts and ready incident playbooks. As the monetary authority singapore widens powers, banks should invest in stronger management information, clearer decision trails and proactive assurance.

Checklist mind-set: confirm accountability, confirm controls, confirm evidence, confirm readiness to engage.

FAQ

What is the role of the MAS in Singapore’s regulatory framework?

The MAS serves as the central bank and sole prudential regulator for financial institutions in Singapore. It supervises banks, insurers and capital market intermediaries, issues licensing requirements, and enforces prudential rules to preserve stability, protect consumers and uphold market integrity.

How do international standards influence local regulations?

Singapore adopts international frameworks such as Basel III, FATF recommendations and IOSCO principles. These standards shape local rules, drive supervisory expectations and ensure cross-border consistency in capital, liquidity, AML/CFT and conduct requirements.

Where do industry bodies like the Association of Banks in Singapore fit into everyday conduct?

Industry associations provide guidance, best-practice templates and forums for collaboration. They work with regulators on implementation issues, publish technical notes and support member firms in meeting supervisory expectations for governance and risk management.

Which core laws must firms track to stay compliant?

Firms should monitor the Banking Act and its subsidiary regulations, the MAS Act, the Financial Services and Markets Act (FSMA) provisions, the Payment Services Act, and securities‑related statutes such as the Securities and Futures Act and Insurance Acts. These instruments set licensing, conduct and supervisory obligations.

What governance requirements does the Banking Act impose?

The Banking Act and associated regulations require boards and senior management to maintain robust corporate governance frameworks, conflict‑of‑interest policies, fit-and-proper assessments for key persons, and documented escalation and reporting lines.

How does the MAS Act strengthen supervisory powers, including resolution planning?

The MAS Act grants powers for prudential inspections, enforcement actions and recovery and resolution planning. Regulators can require submission of contingency plans, impose corrective measures and direct business continuity actions where necessary.

How are digital token services regulated under recent FSMA changes?

Revised rules expand oversight of digital token services, requiring licencing, custody controls, AML/CFT safeguards and market conduct standards. Firms offering token trading or custody must meet disclosure, security and capital expectations.

What risks does the Payment Services Act address?

The Payment Services Act covers operational, AML/CFT, insolvency and cyber risks tied to payment systems and e-money issuance. It mandates licensing, capital thresholds, safeguarding of client funds and incident reporting obligations.

How should a firm build a MAS‑aligned compliance operating model?

Start with a risk-based framework that maps MAS notices and guidelines to policies, controls and monitoring. Define ownership across the first, second and third lines, implement testing and assurance, and maintain clear evidence trails for inspections.

What roles should the board and senior management play?

The board sets risk appetite and governance, approves key policies and receives assurance on regulatory adherence. Senior management operationalises strategy, enforces controls and ensures timely remediation of supervisory findings.

What documentation does MAS expect during inspections?

Inspectors expect policy manuals, risk assessments, control testing results, training records, KYC files, incident logs and evidence of remediation. Firms should keep version control and audit trails to demonstrate ongoing compliance.

How do licensing regimes differ for full, wholesale and merchant banks?

Full banks can accept retail deposits and offer a wide product range; wholesale banks serve corporates with limits on retail services; merchant banks focus on specialised corporate and investment activities. Each regime carries distinct capital, liquidity and conduct constraints.

What is Singapore’s anti‑commingling policy for banks entering non‑financial businesses?

The policy discourages banks from mixing customer funds or core banking activities with unrelated commercial ventures. Banks must demonstrate segregation of assets, governance controls and that non‑banking activities do not compromise prudential soundness.

What governance is expected for related or complementary businesses?

Firms must implement risk assessments, ring‑fencing where necessary, conflict‑management policies and reporting lines that ensure these businesses do not increase group risk beyond MAS thresholds.

What are the practical constraints for digital bank licences?

Digital bank licences, whether full or restricted, impose capital minimums, deposit caps, technology resilience requirements and customer protection measures. Restricted licences often include phased business expansion conditions.

How should firms conduct enterprise‑wide AML/CFT risk assessments?

Adopt a risk‑based approach that identifies vulnerable products, customer segments and delivery channels. Use transaction monitoring, scenario testing and independent reviews to validate control effectiveness and to prioritise remediation.

What are the KYC and customer due diligence expectations?

Firms must apply customer identification, beneficial‑ownership checks, ongoing monitoring and enhanced due diligence for higher‑risk customers. Recordkeeping and suspicious transaction reporting are mandatory under local rules.

How can firms use intelligence sharing to combat financial crime?

Collaborative models enable timely red‑flag sharing between banks, law enforcement and industry platforms. Proper legal frameworks, data protection safeguards and confidentiality protocols are essential to these arrangements.

What are MAS expectations on technology and cyber resilience?

MAS requires firms to adopt technology risk management principles covering governance, change management, patching, incident response and regular penetration testing to ensure operational resilience.

How should firms treat outsourcing and cloud arrangements?

Firms must assess materiality, perform due diligence on providers, retain audit rights and maintain business continuity plans. Self‑assessments and contractual controls should demonstrate effective oversight and exit readiness.

What data protection and encryption standards are expected?

Firms must protect customer data through encryption, access controls and retention policies, and notify regulators and affected parties promptly after material incidents, in line with personal data protection obligations.

Dean Cheong

Dean Cheong is a Singapore-based revenue growth leader and CEO of VOffice, specializing in helping B2B companies accelerate sales performance. With deep expertise in CRM systems, go-to-market execution, and commercial strategy, he combines practical experience with a solid background in business banking and finance from Nanyang Technological University to deliver scalable, long-term growth.

hub.com.sg