Start with the entity that owns the obligation
An administrator may hold the investor documents while a Singapore fund manager handles the relationship and a VCC issues the shares. That division of work can leave a practical question unanswered: who checks the file, who approves the investor, and who follows up when evidence is missing?
Map the legal entities before writing a single KYC checklist. The Monetary Authority of Singapore (MAS) issues sector-specific anti-money laundering and countering the financing of terrorism (AML/CFT) notices. For fund structures, two starting points are:
- Notice SFA04-N02, which covers capital markets intermediaries, including licensed fund management companies.
- Notice VCC-N01, which sets out the VCC’s own AML/CFT requirements.
A manager’s licence does not make its fund and the manager the same regulated person. Banks, payment institutions and other businesses need to check their own applicable framework. This guide focuses on investor KYC for fund managers and VCCs; it is not a survey of all MAS regulation.
If you already know the applicable standard and need help completing files, our Singapore KYC services cover onboarding, remediation and periodic reviews under your approved policy.
Read the notice and its guidelines together
An applicable notice imposes requirements. The accompanying guidelines explain MAS’ supervisory expectations. A practical checklist helps your team carry out the work, but it cannot replace either document.
The MAS publication pages reviewed for this guide list 30 June 2025 as the revision date for SFA04-N02, VCC-N01 and their guidelines. The replacement SFA04-N02 notice and the VCC-N01 amendments took effect on 1 July 2025. Check the linked MAS pages for later revisions before relying on a saved copy.
The Association of Independent Wealth Managers Singapore’s July 2025 update identifies changes concerning intermediate and beneficial owner information, trust-related parties and source-of-wealth corroboration. It also notes the inclusion of proliferation financing within the money-laundering definition. If your templates predate those changes, compare them with the current notice and guidelines before reusing them.
The workflow suggestions below are AgentKYZ’s practical recommendations. MAS has not issued or endorsed this checklist.
A VCC must appoint an eligible financial institution
MAS states that a VCC must appoint an eligible financial institution (EFI) to carry out the necessary AML/CFT checks and measures. The guidelines to VCC-N01 also explain that a VCC’s members are its customers and that the VCC must maintain a register of beneficial owners and nominee directors.
The VCC retains ultimate responsibility. Its board should ensure that the EFI understands the VCC’s money-laundering and terrorism-financing risks and properly performs the work. MAS identifies responsibilities that remain with the VCC and its board, including:
- approval of risk assessments, policies and procedures;
- appointment of an AML/CFT compliance officer;
- oversight of the EFI’s outsourcing and third-party reliance arrangements;
- senior management approval for establishing or continuing higher-risk customer relationships.
The board may appoint EFI staff to senior management roles for these decisions. Where it has not appointed senior management, the board takes that role itself. Ultimate board responsibility remains in either arrangement.
Before appointing a KYC provider, confirm where it fits in the EFI’s arrangements. A contract to process investor files does not by itself fulfil the VCC’s required EFI appointment.
Build CDD around the investor and its ownership
Customer due diligence (CDD) starts with identifying and knowing the customer, including beneficial owners. MAS lists CDD and risk assessment among the requirements in both notices. For an entity investor, the subscription form alone may leave ownership and control unexplained.
Translate the applicable notice and guidelines into evidence requirements for each investor type. A practical file should let a reviewer follow:
- The investor’s legal identity and the evidence used to verify it.
- The people authorised to act, their authority and the relevant connected parties.
- The ownership and control structure, including intermediate entities and the relevant natural persons.
- The purpose of the relationship and the risk assessment supporting the decision.
- The screening results, unresolved questions and approvals required under the policy.
Record the basis for any permitted exemption or simplified treatment. An accredited-investor classification addresses a different regulatory question; it should not become an undocumented shortcut in your CDD process.
For trusts or layered structures, use the requirements for that structure. A corporate shareholder template may omit parties relevant to a trust. Keep the ownership chart connected to source documents so the next reviewer can check how the conclusion was reached.
Document higher-risk cases and the evidence behind them
Your risk methodology should determine when enhanced due diligence is needed and who can approve the relationship. Politically exposed person (PEP) status, ownership complexity, geography and adverse information can affect that assessment. Apply the notice’s specific treatment of different PEP categories rather than treating every screening result alike.
For source-of-wealth work, explain how the customer or beneficial owner accumulated the wealth. Source of funds concerns the money used in the relationship or transaction. The SFA04-N02 guidelines and the July 2025 industry update address source-of-wealth corroboration.
As an operating practice, separate the investor’s explanation from the evidence supporting it. Record inconsistencies and missing information for the authorised decision-maker. A bank statement can show a transfer without explaining how the wealth was earned.
Keep reviews and ongoing monitoring connected
MAS requires regular account reviews and monitoring for suspicious transactions. VCC-N01 also requires CDD information to remain relevant and up to date, with particular attention to higher-risk customers.
Set your review schedule under the applicable framework and document it in your policy. Avoid treating a standard annual, three-year or five-year cycle as a universal MAS rule for every investor. Changes in ownership or control, new adverse information and unusual activity may warrant attention before a scheduled refresh.
For a backlog, our suggested tracker records the last review date, the reason the case is due, the current risk rating and the evidence gaps. Assign an owner to each unresolved issue. Closing a document-refresh task does not mean ongoing transaction monitoring is complete.
Make outsourced work visible to the responsible team
Distinguish a provider doing work under your procedures from reliance on another party’s CDD. Have compliance or counsel confirm the permitted arrangement and its conditions under the relevant notice. Naming a provider in an agreement does not establish that the conditions are met.
For VCCs, MAS expressly places oversight of the EFI’s outsourcing and third-party reliance arrangements with the VCC and its board. A useful operating record should show who performs each check, where the evidence sits and who resolves exceptions.
We recommend testing access to actual files before you need them for an inspection. Ask for the supporting documents and review notes behind a completed case. If all you can retrieve is a “KYC complete” status, you cannot assess how the provider reached that conclusion.
Agree reporting that identifies overdue cases and unresolved evidence. Record the actions taken in response, including escalations and follow-up dates. Shadow KYC is our separately scoped file-review service for this purpose. MAS does not mandate a service by that name, and file testing does not replace a programme-wide AML audit.
Preserve records and escalate suspicion
Record keeping and suspicious transaction reporting are separate requirements in both notices. Retention arrangements must preserve the evidence and analysis for the applicable period and allow retrieval when required. For example, VCC-N01 paragraph 11.4 specifies at least five years, with the starting point tied to the relevant relationship ending or transaction completing. Do not start the retention clock merely because a reviewer closed a KYC task.
Keep suspicious activity out of an ordinary missing-document queue. Escalate it through the designated AML/CFT reporting route promptly and apply the relevant reporting requirements. Staff handling investor follow-up should follow the firm’s controls against tipping off.
A KYC engagement should state which activities it covers. Ongoing transaction monitoring, regulatory reporting, training and independent audit need their own allocation of responsibility even when one provider processes the investor files.
Turn the gaps into a remediation plan
For your next review meeting, assemble an entity-and-responsibility map alongside the open-case list. Confirm the applicable notice for the manager and each fund vehicle, the VCC’s EFI appointment where relevant, and the policy version used for the files.
Then agree the population to review, the evidence standard and the escalation route. Track each gap through to a documented resolution or an authorised decision. Keep the file-testing exercise distinct from any wider independent AML audit.
Singapore managers of Cayman funds should also assess the fund’s Cayman obligations. Our CIMA AML Rule guide explains that framework; a Singapore review does not automatically establish the Cayman fund’s compliance.
If you need a team to perform the agreed work, see our Singapore investor KYC, remediation and periodic-review services. Bring the entity type, case count and target date so we can scope the engagement around your existing AML arrangements.