1B.7 Prevention of financial crimes

The AML/CFT framework that applies to both modules — the offences, the laws, the risk-based approach, CDD/KYC and reporting. The examination tests the money-laundering stages, which statute applies, the CDD thresholds and the STR reporting duty.

7.1 Financial crime, ML, TF, sanctions and fraud

Financial crime includes money laundering, terrorism financing, embargoes/sanctions and fraud. CMIs must exercise due diligence on customers, persons acting for them, connected parties and beneficial owners; maintain high ethical standards; avoid business or transactions connected with ML/TF; and cooperate with law enforcement.

Money laundering disguises criminal proceeds as legitimate. The stages are placement (introducing benefits into the financial system), layering (creating transactions and asset conversions that obscure the trail) and integration (returning funds as apparently legitimate wealth). The stages may overlap or occur in a different order. Capital markets attract layering because assets are liquid, transferable and easily converted.

Terrorism financing may use illegal or legitimate sources — robbery, donations, publications, businesses or self-funding — and may involve small amounts, so third-party payments and transfers require care.

Embargoes and sanctions may target countries, named persons/entities, sectors or products. Shell companies, opaque ownership, bearer shares and multiple layers can conceal designated ultimate owners. CMIs must trace ownership/control to natural persons, screen lists, freeze and report designated assets and avoid prohibited transactions/services. Singapore implements UN sanctions through MAS regulations under FSMA 2022.

Fraud involves deception or dishonesty to gain an advantage at another’s expense. Internal fraud can involve an employee selling client assets and diverting proceeds; external fraud can involve hacking or impersonation. Controls include independent verification, call-backs, dual controls, clean-desk and audit.

7.2 Singapore AML/CFT regime

Singapore follows FATF standards. MAS Notices and Guidelines place prevention responsibility on financial institutions and their staff. A risk-based approach requires controls commensurate with customer, country, product, service, transaction and delivery-channel risk.

7.3 Main laws

• Penal Code: general criminal offences.
• CDSA: criminalises dealing with, concealing, transferring, acquiring, possessing or using benefits of drug dealing/criminal conduct; covers assisting retention, reporting, production/search powers, tipping-off and record retention.
• MACMA: enables mutual assistance in cross-border investigations/proceedings.
• TSOFA: criminalises providing/collecting property for terrorist acts, providing property/services for terrorist purposes, using/possessing property for terrorist purposes and dealing with terrorist property; imposes reporting duties.

The CDSA framework also includes STR filing, statutory protection for good-faith reporting, five-year retention of financial transaction documents and compliance with production, restraint, charging and confiscation orders.

7.4 MAS notices and sanctions guidance

MAS Notice SFA 04-N02 and its Guidelines set CMI obligations for CDD, risk management, controls, reporting and governance. Sanctions guidance requires enhanced attention to sanctioned countries/persons, correspondent banking and front companies, freezing/reporting, strong board oversight and effective detection.

7.5 Targeted financial sanctions

Financial institutions must immediately freeze designated funds/assets/economic resources, avoid financial transactions or assistance involving designated persons/items or sanctioned proliferation/nuclear activities, and notify MAS. Screen clients, connected parties and beneficial owners before onboarding and periodically. Current sanction lists must be checked rather than relying on an old list.

7.6 Tax crimes as predicate offences

Since 1 July 2013, specified direct and GST tax crimes are ML predicate offences. Direct-tax offences include false information or records to obtain PIC cash payouts/bonuses (Income Tax Act sections 37M(3), 37M(4)), tax evasion (section 96) and serious fraudulent tax evasion (section 96A). GST offences include tax evasion (section 62) and improperly obtaining refunds (section 63). CMIs must identify tax-related risk, conduct CDD/monitoring and file STRs where warranted.

7.7 Three lines of defence

1. First line — business units: identify, assess and control risk in onboarding, front office and operations.
2. Second line — compliance/AML-CFT and support functions: monitor, sample-test, review exceptions, advise and escalate to senior management/board, and liaise with authorities.
3. Third line — independent internal audit: periodically evaluate the framework, controls, alert parameters, training and remediation and report independently to the audit committee/board.

Board and senior management retain final accountability.

7.8 Governance

The board and senior management set risk appetite and tone, receive meaningful information about current/emerging risk, assess control effectiveness, understand legal developments, resource compliance, escalate weaknesses, monitor remediation and integrate AML/CFT effectiveness into performance and disciplinary decisions.

7.9 Client onboarding and KYC

Do not open anonymous or fictitious-name accounts. Collect identity, address/residency, age, employment, education, family/lifestyle, business, incorporation, financials, organisation, directors, shareholders, authorised persons, connected parties and UBO details. Investigate source of wealth/funds, business/income, political links, experience, objectives and risk appetite.

Use official identity documents, reliable databases, company records, financial statements, bank statements, trust deeds, board/trustee resolutions and certificates of incumbency/good standing. Internet, news and intermediaries may be leads but need corroboration. Where originals cannot be retained, record what was verified, the original’s description, why no copy was possible, who verified it and the date.

Identify beneficial owners: generally individuals owning more than 25%; if unclear, persons exercising ultimate control; if none, natural persons with executive authority. For trusts/legal arrangements, identify settlor, trustee, protector, beneficiaries and persons with ultimate ownership/control. Certain listed/supervised institutions may qualify for a documented BO-identification exemption, but doubts or suspicion require full diligence.

Source-of-funds review asks whether funds are legitimate, unexpected, owned by the customer, consistent with wealth/profile, consistent with the business and linked to higher-risk jurisdictions. Risk scoring may consider PEP status, country, activity, wealth, flow-through, client visits, complexity, unusual services and origin/destination of funds. Higher-risk examples include personal holding companies, trusts, gambling, remittance, precious metals/diamonds and cash-intensive businesses. Complex structures need a business rationale, financial statements, site visits, screenings and periodic review.

Non-face-to-face relationships need controls as stringent as face-to-face: MyInfo where applicable, secure video/signatures/biometrics, independent call-backs, fraud controls and assessment of technology. Identity should be verified before onboarding or a transaction exceeding S$20,000; limited deferral may be used only for essential business continuity with close controls, completion as soon as practicable and the 30-business-day suspension and 120-business-day termination milestones.

Screen clients, agents, connected parties and UBOs before onboarding, after onboarding, periodically, after a transaction over S$20,000 for a non-account client and when sanction lists or party information changes. Document results and use four-eyes review of alerts. A positive sanctions hit requires freezing/reporting, not merely monitoring.

Simplified CDD is limited to documented low-risk cases such as transparent listed companies, qualifying supervised financial institutions and Singapore government entities. It is unavailable where suspicion exists or high-risk jurisdiction/conditions apply. Reliance on another regulated institution does not remove the CMI’s responsibility; third-party reliance is distinct from outsourcing, and ongoing monitoring cannot simply be delegated away.

For joint accounts, perform CDD on each holder. Aggregate linked/structured transactions where a customer appears to split a transaction to stay under S$20,000. Existing clients, non-account holders and related transactions require proportionate CDD and reconstruction records. EDD applies to high-risk customers, PEPs, opaque/bearer-share structures, high-risk countries, unusual distance, cash-intensive businesses, anonymous products and unexplained third-party payments.

PEP controls include identification of Singapore and foreign PEPs, immediate family and close associates; senior-management approval; source-of-wealth/funds establishment; and enhanced ongoing monitoring. PDPA generally requires consent, but the Notice may permit collection/use/disclosure for AML/CFT purposes within the prescribed exceptions.

Retain client information for five years after termination and transaction records for five years after completion, in admissible paper/electronic/microfilm form. Preserve records longer or as directed where an investigation or STR exists.

Report suspicious transactions, including attempts, regardless of amount, to STRO/CAD with a copy to MAS. The CMI need not prove the crime; reasonable grounds for suspicion are enough. The internal process should refer cases to a single compliance point, investigate and file as soon as practicable and generally no later than 15 business days after referral. Material suspicious activities/fraud may trigger the separate MAS reporting requirement, and fraud may also require a police report. Never tip off a client or other person.

Ongoing monitoring tests consistency with the client profile, business, source of funds and risk. Aggregate related accounts/positions, investigate unusual/complex/large transactions without an apparent lawful purpose and document findings. Higher-risk clients need more frequent reviews; triggers include significant transactions, material changes in account operation, major policy changes and insufficient information. Tax-related review considers tax-residency changes, information-exchange arrangements, CRS/AEOI and tax-amnesty participation.

7.10 Enterprise-wide risk assessment

Assess clients, countries, products, services, transactions, delivery channels and business lines across the firm, using qualitative and quantitative analysis. Weight risk factors in a calibrated manner. Review at least every two years or on material triggers such as new client segments, products or delivery channels; document and obtain senior-management approval. Implement controls and enhanced measures for higher risks.

7.11 New products, practices and technologies

Before launch, assess ML/TF risk separately from credit, market and operational risk, especially where anonymity is increased. Senior management and heads of business, risk and compliance should approve mitigation.

7.12 Operational controls

Control premises, systems, data integrity, passwords and privileged access on a need-to-know basis; change passwords; prohibit sharing; use clean-desk, dual payment control, hold-mail controls, IT/fraud training and audit. The “FRAUD” reminder is: Follow policy, Report concerns, Act on suspicion, Unite with management/enforcement and expect Disciplinary/criminal consequences.

7.13 Reporting and records

Maintain a central reporting point, STR register and supporting records. Group policies should extend across branches/subsidiaries, share necessary CDD/transaction information and apply the higher standard where local law permits.

7.14 Penalties

Non-compliance creates legal, regulatory, financial, civil/commercial and reputation risk; tipping-off is itself an offence.

7.15 Policy, audit and training

Compliance needs a qualified, resourced AML/CFT officer with access to records; internal audit must be independent and adequately resourced. Training must be tailored, recorded, effective and refreshed at least every two years. Hiring checks should cover past employers, AML/TF information, bankruptcy and risk-based credit history.

7.16 Effectiveness

MAS’s three-pillar view is:

• Governance: board/senior-management tone, oversight, resources, reporting and remediation.
• Risk awareness: ownership, accountability, tailored guidance, red flags, escalation and continuous learning.
• Execution: effective policies, calibrated monitoring, enhanced CDD, timely escalation, STRs and closure of past issues.

Exam cues

• ML stages: placement → layering → integration, in order. Capital markets suit layering.
• Which statute: CDSA (money laundering), TSOFA (terrorism financing), MACMA (cross-border assistance), Penal Code (general). Know the fit.
• Numbers: CDD/verification threshold S$20,000; retain client and transaction records five years; STR as soon as practicable and generally within 15 business days of referral; training refreshed at least every two years; enterprise-wide risk assessment reviewed at least every two years.
• Beneficial owner: generally >25% ownership; if unclear, ultimate control; if none, executive authority. Trusts: settlor, trustee, protector, beneficiaries.
• Three lines of defence: business (1st) → compliance/AML-CFT (2nd) → independent internal audit (3rd); the board and senior management retain final accountability.
• Reporting: STR to STRO/CAD with a copy to MAS; reasonable grounds suffice — do not need to prove the crime. Tipping off is itself an offence.
• Trap: a positive sanctions hit requires freezing and reporting, not merely monitoring; reliance on another institution does not remove the CMI’s responsibility.

---

Practise this chapter →