MAS Notice 626: requirements, guidelines and evidence checklist

Start with the official MAS Notice 626 and its accompanying Guidelines. Both MAS pages list June 30, 2025 as their last revision date, checked October 18, 2026. The Notice’s 2025 amendment took effect on July 1, 2025; the date of this guide is not a new regulatory effective date.

What is MAS Notice 626?

MAS Notice 626 is the Monetary Authority of Singapore’s notice on the prevention of money laundering and countering the financing of terrorism for banks. It applies to banks in Singapore as defined by the applicable Singapore banking legislation.

The Notice should be read with its accompanying Guidelines, relevant Singapore legislation, targeted financial-sanctions requirements, MAS guidance and applicable supervisory communications. The Notice establishes binding requirements; the Guidelines help explain MAS expectations and practical application.

Do not rely on a static summary alone. Always confirm the latest version on the MAS website and assess changes against the bank’s products, customers, delivery channels and risk profile.

Who is in scope?

Notice 626 applies to banks in Singapore. Other financial institutions—such as payment service providers, capital-markets intermediaries, insurers, financial advisers and trust companies—are generally subject to their own sector-specific AML/CFT notices.

A financial group should therefore determine scope legal entity by legal entity. A group policy may establish a common standard, but the Singapore bank must still evidence how the Notice’s requirements are satisfied in its local operations.

Which version of MAS Notice 626 should you use?

The current Notice was issued on March 28, 2024, effective April 1, 2024, and last revised June 30, 2025. MAS’s publication page also links older and cancelled versions. Save the version you assessed alongside your interpretation and record its effective date. Keep the Guidelines as a separate source: their explanatory role does not turn every checklist action into a standalone legal requirement.

Three July 2025 changes to check in your inventory

• Proliferation financing: the Notice expressly includes it within money laundering and the related risks. Paragraph 2.1, footnote 1; paragraph 4.1, footnote 3.
• Legal persons and arrangements: review the identification fields and beneficial-ownership provisions, including trust parties and ownership or control chains. Paragraphs 6.6(b), 6.14–6.14B.
• Third-party reliance: paragraph 9.1 excludes specified entities holding only payment-services or digital-token-service-provider licences, including foreign equivalents. Apply its definitions and the remaining reliance conditions. Paragraphs 9.1–9.5 and Appendix 2.

These are selected changes, not a complete amendment register. As a practical review, ask the risk-assessment owner, onboarding team and third-party relationship owner to show where each relevant change appears in their procedures and operating evidence. A revised policy with an unchanged form or data feed may leave an implementation gap.

MAS Notice 626 control checklist

The checks below combine regulatory themes with suggested implementation and evidence practices. Assess applicability against the cited sources; ticking a box does not establish compliance. For a regional comparison, use the MAS–HKMA clause crosswalk alongside this Singapore checklist.

1. Governance and enterprise-wide risk assessment

• The board and senior management have approved an AML/CFT framework appropriate to the bank’s risk profile.
• Roles, accountability, escalation and reporting are defined across the three lines of defence.
• The enterprise-wide ML/TF risk assessment covers customers, countries, products, services, transactions and delivery channels.
• The methodology, data sources, assumptions, results and approval are documented.
• Risk-assessment findings influence policies, customer-risk models, monitoring, staffing and control priorities.
• Material regulatory, business or risk changes trigger a documented review.

Evidence examples: approved framework, risk-assessment methodology, risk results, committee minutes, management information and action plans.

2. Customer due diligence

• Required customer-identification information is obtained before or during establishment of the relationship, subject to any permitted exceptions.
• Identity is verified using reliable and independent information, data or documentation.
• Persons acting on behalf of the customer are identified, verified and authorised.
• The bank understands the purpose and intended nature of the relationship.
• The nature of a non-individual customer’s business, ownership and control structure is understood.
• Beneficial owners are identified and verified under the applicable requirements.
• CDD records and risk decisions are reproducible from the retained evidence.
• Circumstances requiring renewed or refreshed CDD are defined and monitored.

Evidence examples: onboarding records, verification results, ownership chart, beneficial-owner evidence, customer-risk assessment, approvals and refresh history.

3. Customer risk and enhanced measures

• Customer-risk criteria reflect relevant country, customer, product, transaction and delivery-channel risks.
• Higher-risk relationships receive enhanced due diligence proportionate to the identified risk.
• Politically exposed persons, their family members and close associates are identified and handled under the applicable requirements.
• Source of wealth and source of funds are obtained and assessed when required by the risk and applicable rules.
• Senior-management approval is recorded where required.
• Simplified measures, where used, are supported by a documented risk assessment and are not applied where prohibited.

Evidence examples: risk-scoring methodology, PEP-screening result, source-of-wealth assessment, enhanced review, approval and periodic-review schedule.

4. Ongoing monitoring

• Transactions are monitored against the bank’s knowledge of the customer, business and risk profile.
• Monitoring covers unusual, complex or potentially suspicious activity using scenarios and thresholds appropriate to the risk.
• Alerts are investigated within defined service levels and escalated consistently.
• Monitoring coverage, data completeness, model or scenario changes and alert quality are periodically reviewed.
• Customer information and risk ratings are kept current through event-driven and periodic review.
• Decisions to close, continue or restrict a relationship are documented.

Evidence examples: monitoring methodology, scenario inventory, validation, alert cases, quality assurance, threshold changes and governance minutes.

Sia RegAI does not replace a transaction-monitoring system. It can help trace the applicable regulatory requirement to the policy, scenario governance, control owner, review and evidence that support it.

5. Correspondent banking and intermediary reliance

• Correspondent relationships are subject to documented due diligence and risk assessment.
• The respondent institution’s business, reputation, supervision and AML/CFT controls are understood.
• Required approvals are obtained before establishing the relationship.
• Responsibilities between the institutions are clearly understood and documented.
• Payable-through-account risk is identified and addressed where relevant.
• Reliance on an intermediary is permitted, assessed and documented under the applicable conditions.
• The bank can obtain required CDD information and documents without delay.
• The bank retains responsibility for its own compliance obligations.

Evidence examples: respondent questionnaire, independent research, risk assessment, approval, agreement, review record and intermediary document-retrieval test.

6. Wire transfers and screening

• Required originator and beneficiary information is captured and transmitted with wire transfers.
• Controls identify transfers with missing or incomplete information.
• Rejection, suspension, investigation and escalation rules are documented.
• Screening controls reflect applicable sanctions and targeted financial-sanctions obligations.
• List updates, screening configuration, alert handling and escalation have retained evidence.

Evidence examples: payment-field controls, exception queue, screening configuration, list-update record, alert case and quality testing.

Confirm which requirements arise directly from Notice 626 and which arise from associated Singapore legislation, MAS notices or guidance; preserve that distinction in the requirements inventory.

7. Suspicious transaction reporting

Notice 626 paragraph 14.2 requires prompt reporting to STRO, including attempted transactions, regardless of amount. Paragraph 14.3 requires a documented decision on whether circumstances warrant an STR. Notice, paragraphs 14.1–14.4.

For operational review, keep referral, assessment, decision and submission timestamps together. Reviewers should be able to distinguish an unresolved case from a reasoned decision not to file, and identify who owns the next action. Apply the bank’s confidentiality and access controls to the case record.

• Staff and systems can escalate knowledge, suspicion or reasonable grounds for suspicion to the designated function.
• Internal escalation and investigation procedures are documented.
• Decisions to file or not file are reasoned and retained.
• Suspicious transaction reports are submitted to the appropriate Singapore authority within the applicable legal framework and without improper disclosure.
• Post-reporting monitoring, relationship decisions and restrictions are governed.

Evidence examples: internal referral, investigation file, decision record, submission confirmation, confidentiality controls and subsequent monitoring.

8. Records, training and independent assurance

• CDD, transaction, investigation, approval and reporting records are retained for the required period.
• Records can be retrieved promptly and show the basis for the bank’s decision.
• Employee screening and role-based AML/CFT training are implemented and evidenced.
• Compliance monitoring tests the design and operation of key controls.
• Independent audit coverage reflects the bank’s risk profile and material systems.
• Findings are assigned, tracked, validated and reported to the appropriate governance forum.

Evidence examples: retention schedule, retrieval test, training records, monitoring plan, audit report, remediation tracker and closure validation.

Worked example: a missing connected-party identifier

Consider a fictional corporate customer whose director’s identification number is missing from an onboarding file. The form contains a date of birth and nationality. Under paragraphs 6.8–6.8B, that substitution depends on a non-high-risk assessment and unsuccessful reasonable measures to obtain the identifier; both must be documented.

The following is an illustrative review method, not a MAS-prescribed form or an assessment of a real customer.

1. Define the question. Is the person correctly classified as a connected party, and does the file support use of the alternative fields? Record the customer, party role, source paragraph and source version in the review record.
2. Inspect the evidence. Ask the onboarding owner for the risk assessment, dated attempts to obtain the identifier and the actual fields retained. A procedure that permits an exception is only design evidence; it does not show what happened in this case.
3. Record the gap precisely. If the supporting assessment or attempts are absent, record “exception basis not evidenced” and assign an owner. Avoid marking the item complete merely because the substitute fields are populated.
4. Review closure. The accountable reviewer records the outcome, rationale and supporting references under the bank’s procedures. Preserve unresolved questions and escalation decisions rather than filling missing evidence with assumptions.

Use the existing evidence workbook as a starting point for the inventory. Keep sensitive customer records in the bank’s approved systems and use controlled references in the checklist. The RegMatcher workflow can support requirement-to-control mapping; the reviewer still decides whether the evidence supports the conclusion.

Turn the Notice into an operational requirements map

A traditional control spreadsheet often records one row per paragraph but loses the relationship between the source, interpretation, control and evidence. A stronger inventory includes:

How Sia RegAI supports MAS 626 change management

Review source changes

Use RegReview to compare a new MAS publication or revised internal source against the controlled version. Record the relevant change, interpretation, applicability and reviewer decision.

Match obligations to controls

Use RegMatcher to connect the requirement to policies, onboarding procedures, monitoring governance, screening, reporting, training and assurance controls. Surface missing or weak mappings for expert review.

Route remediation

Assign affected requirements to the correct owners across AML compliance, operations, technology, data, legal, risk and audit. Preserve deadlines, dependencies, approval and implementation evidence.

Maintain supervisory traceability

Show how the bank moved from MAS source to obligation, control, evidence and decision. Export the record required for internal review, audit preparation or supervisory engagement.

Frequently asked questions

Build a current, evidence-backed MAS 626 inventory

Use the checklist above as a baseline, or see how Sia RegAI connects the current MAS source to obligations, controls, owners, evidence and remediation.

Primary sources

Notice and Guidelines publication pages checked October 18, 2026. The linked primary sources govern; the worked review and evidence suggestions are editorial implementation examples.

• MAS Notice 626 publication and amendment history — revised June 30, 2025; amendment effective July 1, 2025.
• MAS Notice 626, consolidated text (PDF) — issued March 28, 2024; revised June 30, 2025. The paragraph links above refer to this version.
• MAS Guidelines to Notice 626 — publication page lists June 30, 2025 as the last revision date.
• MAS AML/CFT overview — related regulatory context.
• Singapore Statutes Online
• FATF Recommendations

Informational content only; it is not legal, financial-crime or supervisory advice.