How Singapore banks verify customers: KYC and CDD under Notice 626

Customer due diligence (CDD) is the set of checks a Singapore bank must complete before and after opening an account: identifying the customer, verifying that identity against independent sources, finding the people who own or control the customer, and understanding what the account is for. "Know your customer" (KYC) is the everyday name for the same process. The rules come from MAS Notice 626, which sets minimum requirements; each bank then designs its own forms, which is why document lists differ from bank to bank.

What KYC and customer due diligence mean in Singapore

MAS Notice 626 on Prevention of Money Laundering and Countering the Financing of Terrorism – Banks is issued under section 16 of the Financial Services and Markets Act 2022 and applies to all banks in Singapore. The version dated 28 March 2024 took effect on 1 April 2024, with a further amendment effective 1 July 2025; MAS Guidelines to Notice 626 explain how banks may meet each requirement. Paragraph numbers here refer to the 2024 version; check the current text on the MAS website before relying on one.

Three features explain most of what applicants experience:

1. It is risk-based. The depth of checks scales with the risk a customer presents, so a salaried resident and a holding company with overseas shareholders will not be asked the same questions.
2. It continues after opening. CDD is repeated on a periodic basis and whenever the bank's information looks out of date or inconsistent.
3. It is enforced. On 4 July 2025 MAS announced composition penalties totalling S$27.45 million on nine financial institutions for AML-related breaches, and found that all nine did not detect or adequately follow up on significant discrepancies or red flags that should have cast doubt on some customers' stated sources of wealth (MAS enforcement release, 4 July 2025).

What a bank must collect and verify

Paragraph 6.6 lists the minimum identification data for every customer, whether a person or an entity. Paragraph 6.9 requires the bank to verify that information "using reliable, independent source data, documents or information". For legal persons, paragraphs 6.7 to 6.9 add legal form, constitution, powers and the people who run the entity.

In practice, individuals usually provide a passport or NRIC or authorise Singpass Myinfo; Singapore companies are verified through ACRA records and Myinfo Business, and overseas companies through certified registry documents. See the corporate account checklist.

People acting for the customer and beneficial owners

Two further groups of individuals are checked alongside the customer itself.

People acting on behalf of the customer. Under paragraphs 6.10 and 6.11, the bank must identify and verify each natural person appointed to act for the customer, typically authorised signatories, and "verify the due authority" of each one, usually through a board resolution or mandate and a specimen signature or electronic verification.

Beneficial owners. Paragraph 6.13 requires the bank to inquire whether any beneficial owner exists, and paragraph 6.14 sets out a cascade for legal persons:

1. The natural persons, acting alone or together, who ultimately own the legal person.
2. If there is doubt, or no one ultimately owns it, the natural persons who ultimately control it.
3. If no one is identified, the natural persons with executive authority.

For trusts, the bank identifies the settlors, trustees, protector (if any) and beneficiaries. Paragraph 6.15 also requires the bank to understand the nature of the customer's business and its ownership and control structure.

The Guidelines (paragraph 6-8-2) say identification "may be based on a threshold (e.g. any person owning more than 25% of the legal person …)", taking aggregated cross-shareholdings into account. The 25% figure is an example, not a safe harbour: banks may look below it and at control exercised by other means. Paragraph 6.16 exempts certain customers, such as SGX-listed entities, from this inquiry.

Purpose of the account and ongoing monitoring

Paragraph 6.18 requires a bank to "understand and as appropriate, obtain from the customer information as to the purpose and intended nature of business relations". That is why forms ask about expected inflows, counterparties, countries and the initial deposit. Paragraphs 6.19 and 6.20 then require ongoing monitoring against "the bank's knowledge of the customer, its business and risk profile", and paragraph 6.3(d) adds periodic CDD.

Since 1 April 2024, monitoring at six banks (DBS, OCBC, UOB, Citibank, HSBC and Standard Chartered) has been supported by COSMIC, a platform for sharing information on customers. MAS states that COSMIC initially covers misuse of legal persons, misuse of trade finance and proliferation financing, and that information may be shared only when a customer shows "certain objectively-defined indicators of suspicion" (MAS media release, 1 April 2024). Notice 626 requires participating banks to include information received through COSMIC in their monitoring.

What this means for account holders:

Non-face-to-face onboarding and joint accounts

Paragraph 6.1 prohibits anonymous or fictitious-name accounts, online or offline. Under paragraphs 6.27 to 6.29, where there is no face-to-face contact the bank must perform CDD measures "at least as robust as" those it would apply in person. Remote channels therefore change how verification happens, not how much is verified.

Online applicants are usually verified through Singpass Myinfo; applicants without Singpass, including most non-residents, generally use a branch or a bank-specific remote programme (see personal accounts).

For joint accounts, paragraph 6.37 requires the bank to perform CDD "on all of the joint account holders as if each of them were individual customers". A gap for one holder holds up the whole application.

Enhanced due diligence: when banks ask for more

Paragraph 8 of Notice 626 lists situations that call for enhanced CDD. They mean more information and closer oversight, not automatic refusal.

See source of funds and wealth for definitions.

When due diligence cannot be completed

Paragraph 6.35 is the rule behind most declined applications: where a bank is unable to complete CDD, "it shall not commence or continue business relations with any customer or undertake any transaction for any customer", and it must consider whether the circumstances warrant filing a suspicious transaction report. Notice 626 does not require banks to give reasons for declining an application.

MAS has also addressed how far banks should go. Circular AMLD 05/2026 (25 May 2026), addressed to chief executives of financial institutions, aims to ensure that Singapore's AML/CFT regime "does not create undue burden on legitimate businesses and investors". It asks institutions to focus on material or higher-risk source-of-wealth elements and to avoid unnecessary or repeated requests (details on the source of funds and wealth page). The circular sets supervisory expectations for financial institutions; it does not give customers a right to decline information requests.

The practical lesson is to give complete, consistent information in the first submission. The red flags checklist lists common causes of delay.