MAS Notice 626 Requirements (2026): AML/CFT Obligations + Downloadable Checklist.

What is MAS Notice 626?

MAS Notice 626 is the Monetary Authority of Singapore’s notice on the prevention of money laundering and countering the financing of terrorism for banks. It applies to banks in Singapore as defined by the applicable Singapore banking legislation.

The Notice should be read with its accompanying Guidelines, relevant Singapore legislation, targeted financial-sanctions requirements, MAS guidance and applicable supervisory communications. The Notice establishes binding requirements; the Guidelines help explain MAS expectations and practical application.

Do not rely on a static summary alone. Always confirm the latest version on the MAS website and assess changes against the bank’s products, customers, delivery channels and risk profile.

Who is in scope?

Notice 626 applies to banks in Singapore. Other financial institutions—such as payment service providers, capital-markets intermediaries, insurers, financial advisers and trust companies—are generally subject to their own sector-specific AML/CFT notices.

A financial group should therefore determine scope legal entity by legal entity. A group policy may establish a common standard, but the Singapore bank must still evidence how the Notice’s requirements are satisfied in its local operations.

MAS Notice 626 control checklist

1. Governance and enterprise-wide risk assessment

• The board and senior management have approved an AML/CFT framework appropriate to the bank’s risk profile.
• Roles, accountability, escalation and reporting are defined across the three lines of defence.
• The enterprise-wide ML/TF risk assessment covers customers, countries, products, services, transactions and delivery channels.
• The methodology, data sources, assumptions, results and approval are documented.
• Risk-assessment findings influence policies, customer-risk models, monitoring, staffing and control priorities.
• Material regulatory, business or risk changes trigger a documented review.

Evidence examples: approved framework, risk-assessment methodology, risk results, committee minutes, management information and action plans.

2. Customer due diligence

• Required customer-identification information is obtained before or during establishment of the relationship, subject to any permitted exceptions.
• Identity is verified using reliable and independent information, data or documentation.
• Persons acting on behalf of the customer are identified, verified and authorised.
• The bank understands the purpose and intended nature of the relationship.
• The nature of a non-individual customer’s business, ownership and control structure is understood.
• Beneficial owners are identified and verified under the applicable requirements.
• CDD records and risk decisions are reproducible from the retained evidence.
• Circumstances requiring renewed or refreshed CDD are defined and monitored.

Evidence examples: onboarding records, verification results, ownership chart, beneficial-owner evidence, customer-risk assessment, approvals and refresh history.

3. Customer risk and enhanced measures

• Customer-risk criteria reflect relevant country, customer, product, transaction and delivery-channel risks.
• Higher-risk relationships receive enhanced due diligence proportionate to the identified risk.
• Politically exposed persons, their family members and close associates are identified and handled under the applicable requirements.
• Source of wealth and source of funds are obtained and assessed when required by the risk and applicable rules.
• Senior-management approval is recorded where required.
• Simplified measures, where used, are supported by a documented risk assessment and are not applied where prohibited.

Evidence examples: risk-scoring methodology, PEP-screening result, source-of-wealth assessment, enhanced review, approval and periodic-review schedule.

4. Ongoing monitoring

• Transactions are monitored against the bank’s knowledge of the customer, business and risk profile.
• Monitoring covers unusual, complex or potentially suspicious activity using scenarios and thresholds appropriate to the risk.
• Alerts are investigated within defined service levels and escalated consistently.
• Monitoring coverage, data completeness, model or scenario changes and alert quality are periodically reviewed.
• Customer information and risk ratings are kept current through event-driven and periodic review.
• Decisions to close, continue or restrict a relationship are documented.

Evidence examples: monitoring methodology, scenario inventory, validation, alert cases, quality assurance, threshold changes and governance minutes.

Sia RegAI does not replace a transaction-monitoring system. It can help trace the applicable regulatory requirement to the policy, scenario governance, control owner, review and evidence that support it.

5. Correspondent banking and intermediary reliance

• Correspondent relationships are subject to documented due diligence and risk assessment.
• The respondent institution’s business, reputation, supervision and AML/CFT controls are understood.
• Required approvals are obtained before establishing the relationship.
• Responsibilities between the institutions are clearly understood and documented.
• Payable-through-account risk is identified and addressed where relevant.
• Reliance on an intermediary is permitted, assessed and documented under the applicable conditions.
• The bank can obtain required CDD information and documents without delay.
• The bank retains responsibility for its own compliance obligations.

Evidence examples: respondent questionnaire, independent research, risk assessment, approval, agreement, review record and intermediary document-retrieval test.

6. Wire transfers and screening

• Required originator and beneficiary information is captured and transmitted with wire transfers.
• Controls identify transfers with missing or incomplete information.
• Rejection, suspension, investigation and escalation rules are documented.
• Screening controls reflect applicable sanctions and targeted financial-sanctions obligations.
• List updates, screening configuration, alert handling and escalation have retained evidence.

Evidence examples: payment-field controls, exception queue, screening configuration, list-update record, alert case and quality testing.

Confirm which requirements arise directly from Notice 626 and which arise from associated Singapore legislation, MAS notices or guidance; preserve that distinction in the requirements inventory.

7. Suspicious transaction reporting

• Staff and systems can escalate knowledge, suspicion or reasonable grounds for suspicion to the designated function.
• Internal escalation and investigation procedures are documented.
• Decisions to file or not file are reasoned and retained.
• Suspicious transaction reports are submitted to the appropriate Singapore authority within the applicable legal framework and without improper disclosure.
• Post-reporting monitoring, relationship decisions and restrictions are governed.

Evidence examples: internal referral, investigation file, decision record, submission confirmation, confidentiality controls and subsequent monitoring.

8. Records, training and independent assurance

• CDD, transaction, investigation, approval and reporting records are retained for the required period.
• Records can be retrieved promptly and show the basis for the bank’s decision.
• Employee screening and role-based AML/CFT training are implemented and evidenced.
• Compliance monitoring tests the design and operation of key controls.
• Independent audit coverage reflects the bank’s risk profile and material systems.
• Findings are assigned, tracked, validated and reported to the appropriate governance forum.

Evidence examples: retention schedule, retrieval test, training records, monitoring plan, audit report, remediation tracker and closure validation.

Turn the Notice into an operational requirements map

A traditional control spreadsheet often records one row per paragraph but loses the relationship between the source, interpretation, control and evidence. A stronger inventory includes:

How Sia RegAI supports MAS 626 change management

Review source changes

Use RegReview to compare a new MAS publication or revised internal source against the controlled version. Record the relevant change, interpretation, applicability and reviewer decision.

Match obligations to controls

Use RegMatcher to connect the requirement to policies, onboarding procedures, monitoring governance, screening, reporting, training and assurance controls. Surface missing or weak mappings for expert review.

Route remediation

Assign affected requirements to the correct owners across AML compliance, operations, technology, data, legal, risk and audit. Preserve deadlines, dependencies, approval and implementation evidence.

Maintain supervisory traceability

Show how the bank moved from MAS source to obligation, control, evidence and decision. Export the record required for internal review, audit preparation or supervisory engagement.

Frequently asked questions

Build a current, evidence-backed MAS 626 inventory

Use the checklist above as a baseline, or see how Sia RegAI connects the current MAS source to obligations, controls, owners, evidence and remediation.

Primary sources

• MAS anti-money laundering and countering the financing of terrorism
• Singapore Statutes Online
• FATF Recommendations

Informational content only; it is not legal, financial-crime or supervisory advice.