Country Guide, Singapore: Non-Face-to-Face Customer Due Diligence Under MAS Notice 626 and Notice PSN01

For information; not legal advice.

A bank or payment firm that wants to open an account for a customer in Singapore without meeting that person has to satisfy the Monetary Authority of Singapore, known as MAS. MAS does this through binding notices issued under statute, through guidelines that explain the notices, and through circulars and statements that say which technologies it is willing to see used. This guide reads those texts side by side, so that a reader can see which sentence is a duty, which is guidance, and which is an expectation stated in a circular.

The guide is a reading aid and not a compliance opinion. It does not say that any product meets the Singapore rules, and a firm should settle its approach with its own supervisor. Three limits of the sources are stated here, before the detail. First, MAS's own web pages for the notices returned a maintenance message to the fetch tool, so the notices were read as published PDF files and not from the web pages. Second, the guidelines to the bank notice could not be opened, because the file redirected to a login page; the guidance below therefore comes from the guidelines to the payment notice, and the guide says so each time it relies on them. Third, the payment notice was read in the tracked-changes document that MAS published for the June 2025 amendments, which contains the full text of the notice with the amendments marked.

For the wider picture, see the article on how risk sets the verification steps under the FATF standard and the guides to Germany and India, which set two other national regimes beside this one.

The instruments, in one table

Each row was read from the document itself, or from a government page that describes it, on 28 October 2026.

The Notice for banks says it is issued under section 16 of the Financial Services and Markets Act 2022 and that it applies to all banks in Singapore as defined in the Banking Act 1970. The Act's table of contents, on Singapore Statutes Online as at 28 October 2026, places section 16 in Part 4 of the Act under the title "Requirements for prevention of money laundering and terrorism financing". The payment notice is also issued under section 16 of that Act. The amendments of June 2025 took effect on 1 July 2025 for both notices.

The guide covers these two notices only, and a firm with another kind of licence should find the notice that names that licence before relying on anything below.

What the bank notice requires of every customer

The rules on non-face-to-face business sit inside a general customer due diligence regime, and they cannot be read without it.

When the checks must be done

A bank must perform the due diligence measures of paragraphs 6, 7 and 8 of the notice when it establishes business relations with any customer. Paragraph 6.3 lists the cases, and for a customer who has not otherwise established business relations with the bank it names these.

• A transaction of a value exceeding S$20,000, other than a digital token transaction.
• Any digital token transaction.
• Funds effected or received by domestic wire transfer, for which the paragraph states no amount threshold.
• Funds effected or received by cross-border wire transfer that exceeds S$1,500.
• Digital tokens effected or received by value transfer.

Paragraph 6.3 also applies where there is a suspicion of money laundering or terrorism financing, and where the bank has doubts about the veracity or adequacy of any information previously obtained. Under paragraph 6.4, where the bank suspects that transactions are related, linked or a deliberate restructuring of a single transaction to evade the measures, in relation to the cases of paragraphs 6.3(b) or (d), it treats them as a single transaction and aggregates their values. The notice does not use the English words "onboarding" or "know your customer"; the duty is expressed as customer due diligence.

What must be collected

For a customer who is a natural person, a bank must obtain at least the full name including any aliases, a unique identification number, the residential address, the date of birth and the nationality. The notice gives as examples of the unique identification number an identity card number, a birth certificate number or a passport number. Where a customer appoints a natural person to act on the customer's behalf, the bank must collect the same items for that person and must also verify the person's authority. The notice names obtaining the person's specimen signature or "electronic means of verification" among the methods for checking that authority.

How the identity is verified

The verification rule is one sentence. A bank must verify the identity of the customer using reliable, independent source data, documents or information. The same words appear in the first of the four customer due diligence measures of Recommendation 10 of the Financial Action Task Force, which speaks of reliable, independent source documents, data or information. So the Singapore rule is the international rule in nearly the same words, and the question for a product is what counts as a reliable, independent source in each case. The notice itself does not list the sources; it leaves that to the guidelines and to the bank's own policies.

When the checks must be finished

A bank must complete verification before it establishes business relations, and before the transactions listed in the notice. It may establish business relations before completing verification only if two conditions hold: deferring the completion is essential in order not to interrupt the normal conduct of business operations, and the money laundering and terrorism financing risks can be effectively managed. A bank that does so must have internal risk management policies that set out the conditions, and must complete the verification as soon as is reasonably practicable. The guidelines to the payment notice give figures for the meaning of "reasonably practicable", and they are discussed below under timing.

When the checks fail

Where a bank cannot complete the measures, it must not commence or continue business relations with the customer or undertake any transaction for the customer. It must also consider whether the circumstances are suspicious enough to warrant a suspicious transaction report. The notice defines completion as the situation in which the bank has obtained, screened and verified all necessary information, and has received satisfactory answers to all inquiries about it. A verification flow that ends in an unclear result therefore has to end in a decision, and the decision has to be recorded.

The three short rules on non-face-to-face business

The notice addresses non-face-to-face business in three paragraphs. They are numbered 6.27, 6.28 and 6.29 in the bank notice. In the payment notice the same three rules appear as paragraphs 7.34, 7.35 and 7.36.

The first rule says that a bank must develop policies and procedures to address any specific risks associated with non-face-to-face business relations with a customer, or transactions for a customer. The second rule says that the bank must implement those policies and procedures when establishing business relations and when conducting ongoing due diligence. The third rule says that where there is no face-to-face contact, the bank must perform customer due diligence measures that are at least as robust as those that would be required if there were face-to-face contact.

Three points follow from the wording. The first is that the standard is relative: remote checks are not measured against a list of permitted technologies, but against what the bank would have done in person. The second is that the duty reaches past the opening of the account, because the policies must be applied also in ongoing due diligence. The third is that the notice names no technology at all. Everything about video, biometrics or document capture is left to guidance, and to the bank's own assessment of whether its method is as robust as a meeting.

The notice has one more paragraph that touches remote technology. A bank must identify and assess the money laundering and terrorism financing risks that may arise in relation to new products and business practices, including new delivery mechanisms, and in relation to new or developing technologies. It must do the assessment before the launch or use of the product, practice or technology, and must take appropriate measures to manage and mitigate the risks. A new verification method is a new technology in this sense, and the assessment belongs in the file before the method goes live.

The payment notice adds a duty of independent assessment

The payment notice covers the holders of a payment services licence who provide what the notice calls a specified payment service. The notice defines the term as an account issuance service, a domestic money transfer service, a cross-border money transfer service or a money-changing service. Its non-face-to-face paragraphs repeat the three rules above, and then add four more.

Where a payment firm conducts its first non-face-to-face business contact, it must, at its own expense, appoint an external auditor or an independent qualified consultant to assess the effectiveness of its policies and procedures, including the effectiveness of any technology solutions used to manage impersonation risks. It must submit a report of that assessment to MAS no later than one year after the first non-face-to-face business contact. Where there is a substantial change in the policies and procedures, it must appoint an assessor again, and must submit the report no later than one year after the change is implemented. The paragraphs do not apply to a specified money-changing transaction.

The bank notice, as read, contains no equivalent of these four paragraphs. A search of its text for an external auditor or an independent qualified consultant finds only the sentence that lets the bank's own auditors review the records. That does not mean a bank has no assessment duty at all. The circular of January 2018, described below, states an expectation of an independent assessment for new technology that applies to all financial institutions, and the bank's duty to assess new technologies before launch applies in any case.

What MAS names as suitable checks

The guidelines to the payment notice explain what a "specific risk" is. They say that it includes the risks of opening a relationship, or undertaking a transaction without an account, on instructions conveyed through any means of communication, for example the internet, post, fax or phone. They add that applications and transactions across the internet or phone may pose greater risks than other non-face-to-face business, and they give four reasons: the ease of unauthorised access to the facility across time zones and locations, the ease of making multiple fictitious applications without extra cost or risk of detection, the absence of physical documents, and the speed of electronic transactions.

The guidelines then say that the measures a firm takes depend on the nature and characteristics of the product or service and on the customer's risk profile. Where verification is performed without face-to-face contact, for example electronically, the firm should apply additional checks to manage the risk of impersonation. The guidelines list nine examples of such checks and say that they may include robust anti-fraud checks that the firm routinely undertakes.

The nine examples are these. The first is phone contact with the customer at a personal, residential or business number that can be verified independently. The second is confirmation of the customer's address through an exchange of correspondence or another appropriate method. The third is phone confirmation of the customer's employment status with the employer's human resource department, subject to the customer's consent. The fourth is confirmation of salary details by recent bank statements, where applicable. The fifth is provision of identification documents attested as true copies by lawyers or notaries public. The sixth is an initial deposit into the account from funds the customer holds in an account with a bank in Singapore. The seventh is video conferencing held live that is comparable to face-to-face communication. The eighth is verification of identity through a document that the customer has signed with a secure digital signature using a set of PKI-based credentials issued by a Certificate Authority that holds, under the Electronic Transactions Act 2010, the formally conferred status which paragraph 7-12-3, point (h), requires of the authority. The ninth is the use of technology solutions to manage the impersonation risks, including biometric technologies such as fingerprint or iris scans and facial recognition, which should be linked incontrovertibly to the customer.

The guidelines add that a firm should regularly review the effectiveness of its checks to manage the risk of impersonation. They say that a firm may conduct the independent assessment as part of its annual audit, and that in appointing the assessor it should consider the assessor's competence, track record, and knowledge of technology solutions and regulatory requirements. They say that, in deciding whether a policy change is substantial, a firm should consider the likely impact on the specific risks, for example the adoption of a technology solution different from the one it used before.

The circular of January 2018, in paragraph 5, says that the examples are non-exhaustive and that a financial institution can apply any one of them, so long as it has assessed the measure to be appropriate to mitigate the risk. One measure can therefore suffice, once the institution has assessed it as appropriate to the risk. The guide adds a caution of its own: the assessment, and not the length of the list, decides whether one measure is enough or whether a higher impersonation risk calls for several, and the firm has to be able to show how it judged that. The same list says nothing about how a biometric match is to be tested, which is why the independent assessment matters in practice.

The circular of January 2018

Before the current notices were written, MAS issued a circular to the chief executives of all financial institutions. It is numbered AMLD 01/2018, is dated 8 January 2018, and is titled "Use of MyInfo and CDD Measures for Non Face-to-Face Business Relations". It does two separate things.

Myinfo as a verified source

Myinfo is a government service that enables residents to manage the use of their personal data for simpler online transactions, and MAS's page on digital ID and e-KYC says financial institutions can use it to streamline customer onboarding with the customer's explicit consent. The circular states that MAS considers Myinfo a reliable and independent source for verifying the customer's name, unique identification number, date of birth, nationality and residential address. Where Myinfo is used, MAS does not require a financial institution to obtain additional identification documents, for example the identity card or passport, and does not expect it to obtain a separate photograph of the customer. A financial institution that decides to retain the photograph requirement for other reasons, such as group compliance requirements, may continue to do so. The institution must still keep proper records of the data it obtained, including the Myinfo data, as the notices require. Customers who are not enrolled in Myinfo, for example non-residents, or who do not consent to its use, remain subject to the ordinary customer due diligence requirements.

MAS's page on digital identity and electronic know-your-customer checks repeats the point and extends it to the business side of the service: it says MAS considers Myinfo and Myinfo business to be reliable and independent sources for verifying a customer's personal and corporate data. The page also says that financial institutions can use Myinfo to streamline onboarding with the customer's explicit consent.

The Singpass developer portal describes how an organisation reaches the service. It says that Myinfo lets users pre-fill selected personal or corporate data fields with verified data from government sources, upon consent through Singpass. It sets out a three-step path: read the developer documents, configure the digital service in a staging environment and test it, and obtain approval from the administrator before the service goes live, when Singpass evaluates whether the user journey and details accord with its guidelines. The portal also describes a signing service, whose signatures are regarded as secure electronic signatures under the Electronic Transactions Act 2010.

For a verification provider the practical point is the order of the two routes. Where the customer can and will use Myinfo, the regulator has said the source is reliable and independent and that no further document is expected. Where the customer cannot or will not, the document-and-selfie route and the other checks described above remain the way to meet the notice.

Other non-face-to-face means and the independent assessment

The second part of the circular addresses identity obtained electronically by other means, including the transmission of scanned or copied documents. It says that a financial institution should apply additional checks to mitigate the risk of impersonation, that the examples in the guidelines are not exhaustive, and that an institution can apply any one of them so long as it has assessed the measure as appropriate to mitigate the risk. It adds three examples to those in the guidelines: a live video conference comparable to face-to-face communication, in addition to electronic copies of identification documents; verification through a document signed with a secure digital signature using PKI-based credentials; and new technology solutions, including biometric technologies, which should be linked incontrovertibly to the customer.

The circular then states an expectation for any institution that relies on a new technology solution for remote due diligence. The institution should ensure that the solution continues to facilitate measures at least as robust as those performed with face-to-face contact. This should include a once-off independent assessment from a suitably qualified professional, at the first year mark after implementation, of the effectiveness of the solution in managing impersonation risk. The assessor may be the institution's internal audit function, if it has the necessary expertise, or an external auditor or independent qualified consultant. The assessment should be kept for as long as the technology solution is in use, and for a minimum of five years after it ceases to be in use, and MAS may ask to review it. The circular defines a technology as new if it is new to, or has yet to be widely adopted by, financial institutions in Singapore for onboarding.

The circular is older than the current notices, which were reissued under the Financial Services and Markets Act 2022. The guide found nothing in the notices that cancels it, and MAS's current page on digital ID and e-KYC still links to it. The payment notice has since turned the idea of an independent assessment into a binding duty with a report to MAS, and the guide treats the circular as the statement of expectation for banks, to be confirmed with the supervisor.

Quality of documents and of evidence

The guidelines to the payment notice contain several passages that a document verification step has to be able to support. Where the customer is a natural person, the firm should obtain identification documents that contain a clear photograph of the customer. The firm may verify name, unique identification number, date of birth and nationality from a valid passport or national identity card that bears a photograph, and the residential address from the identity card, a recent utility or phone bill, a bank statement or correspondence from a government agency. Where it obtains data, documents or information from the customer or a third party, it should ensure that they are current at the time they are provided. It should also ensure that staff have adequate guidance on how to identify indicators of fraudulent or tampered data, documents or information, and that such indicators are escalated and the appropriate risk mitigation measures applied in a timely manner. The documents obtained should be clear and legible, which the guidelines call important for establishing the customer's identity.

Where the customer cannot produce an original document, the firm may consider accepting a copy that has been attested as a true copy by a suitably qualified person such as a notary public, a lawyer or an accountant, or one that an employee independent of the dealing has confirmed against the original. A document in a foreign language must be dealt with by appropriate steps, and any document that is critical for the measures should be translated into English by a suitably qualified translator. For an electronic flow, the practical consequences are that image quality is a compliance matter, that the system must be able to show what was captured and when, and that tamper indicators need an owner.

Timing, delay and the clock

The notices say that verification may be deferred only in narrow conditions. The guidelines to the payment notice give examples and figures for the deferral. They say that one way to manage the risk of a deferral is to set limits on the services available to the customer, such as limits on the number, type and value of transactions, with closer monitoring until verification is complete. They say that the completion of verification should not exceed 30 business days after the establishment of business relations. They say that the firm should suspend the relationship and refrain from further transactions, except to return funds to their sources where possible, if verification is still incomplete after 30 business days. They say that the firm should terminate the relationship if verification is still incomplete 120 business days after it was established. And they say that delayed verification should not be applied to transactions undertaken without an account being opened.

These figures come from the guidelines to the payment notice. The guidelines to the bank notice could not be opened for this guide, so a bank should check whether its own guidelines say the same. For a product, the figures can be tracked as three states per customer, namely verified, deferred within limits, and expired. Paragraph 7-14-2, point (b), says that the firm should suspend the relationship once the time limit passes, and it does not prescribe how. Suspending automatically when the expired state is reached is therefore an implementation option for a product team, and a manual step with a recorded owner is equally consistent with the text. The distinction between the payment-notice guidelines and the bank notice stays in force: for a bank, the question is what its own notice and guidelines say.

A verification provider is not a "third party" under the notice

Both notices contain a section on reliance on third parties, and a reader may assume that a verification provider falls under it. On a plain reading it does not.

In the bank notice, a third party is a financial institution listed in an appendix, a financial institution supervised by a foreign authority for compliance with AML and CFT requirements consistent with FATF standards, or a member of the bank's own group. A bank may rely on such a party to perform the customer due diligence measures only if it is satisfied that the party is supervised and has adequate measures, assesses the risks of the jurisdictions the party operates in, has not been barred by MAS, and can supply the underlying data without delay. A bank may not rely on a third party for ongoing monitoring, and it remains responsible for its obligations in any case.

The guidelines to the payment notice separate this from outsourcing. They say that the reliance section does not apply to outsourcing. In a reliance case, the third party typically already has a relationship with the customer and performs the measures under its own policies. In an outsourcing case, the service provider performs the measures on behalf of the firm, in accordance with the firm's policies, procedures and standards, and under the firm's control measures. A verification provider that runs a bank's own checks to the bank's own rules looks like the second case. This is the guide's reading and not a statement of MAS, and a firm should confirm it with its supervisor when it designs a contract.

The reading has three consequences for a provider's contract with a regulated customer. The bank, not the provider, remains responsible for compliance with the notice. The bank must therefore be able to see what was checked, with which result, and when, and to retrieve it for the supervisor. And the records the notice requires must exist somewhere the bank can reach for the whole retention period.

Records and personal data

The bank notice requires a bank to prepare, maintain and retain records of all data, documents and information it is required to obtain or produce under the notice. It sets the retention at a period of at least five years following the termination of the business relations or the completion of the transaction, for the due diligence information, and at least five years following the completion of the transaction for the transaction data. The records may be kept as originals or copies, on paper, electronically or on microfilm, provided they are admissible as evidence in a Singapore court of law. Where a matter is under investigation or has been the subject of a suspicious transaction report, the records must be kept in accordance with any request or order from the reporting office or other relevant authorities.

On personal data, the bank notice has a paragraph that matters for the design of an electronic flow. It says that, for the purposes of complying with the notice, a bank may, whether directly or through a third party, collect, use and disclose personal data of the individual customer, an individual appointed to act for the customer, a connected party or a beneficial owner, without that individual's consent. The phrase "through a third party" is the one that a provider's data processing sits under. The notice also limits the access and correction rights of the individual: a bank need not provide access to the personal data it holds for the purposes of the notice, or the ways it has been used, or a right of correction, except for the types of data listed in the notice, which it must provide on request.

The Personal Data Protection Commission has issued separate guidelines on the national identity card number. They say that organisations are generally not allowed to collect, use or disclose identity card numbers or copies of the card, and that they may do so only where it is required under the law or where it is necessary to accurately establish or verify the identity of the individual to a high degree of fidelity. They treat other national identification numbers in the same way, and they ask organisations to accord passports similar treatment, which means refraining from collecting passport numbers or limiting collection to partial numbers. They say that organisations should generally not retain a person's physical identity card unless the law requires it. They list financial matters among the transactions where PDPC would generally consider high-fidelity verification necessary. A header on the document says that, in light of a ministry statement of 13 December 2024, the guidelines will be updated, and that in the meantime they remain valid.

The guidelines do not mention the MAS notices, and the guide found no passage that connects the two. The natural reading is that a bank collects the identity number because the notice requires a unique identification number, and that the guidelines' first limb, collection required under the law, then applies; but that is a reading and not a finding. The guidelines also say that when an organisation collects a copy of the card, it collects all the personal data on the card, and should assess whether that is excessive. A verification flow that stores a full image of a document needs a stated reason for each field it keeps.

The international baseline

The Financial Action Task Force's Recommendation 10 is the standard that the notices implement. Its first measure is identifying the customer and verifying that customer's identity using reliable, independent source documents, data or information. The rest of the baseline, including the timing of verification and the duty to stop when it cannot be completed, is explained in the article on the risk-based approach, and it is not repeated here. The interpretive note to the recommendation lists non-face-to-face business relationships or transactions among the product, service, transaction or delivery channel risk factors that may indicate higher risk, where appropriate risk mitigation measures have not been implemented.

The Singapore text is more specific than the international one in two places. It states the non-face-to-face duty as its own paragraph, with the standard "at least as robust", and in the payment notice it adds a duty of independent assessment with a report to the supervisor. In the rest, it follows the international text closely.

What a firm can decide now

The texts leave room, and a firm has to use it with a reason. Five decisions follow from the reading above.

1. Decide which customers go through Myinfo, and treat the Myinfo path as a separate flow with its own records, since the regulator has accepted it as a reliable, independent source and has said no further document is expected.
2. Decide which other checks are the "additional checks" for the document route, and write down why they address impersonation for the product in question.
3. Decide who will perform the independent assessment of any new technology, when, and where the report will be kept, and note that for a payment firm this is a duty with a report to MAS within one year.
4. Decide how the flow represents a deferred verification, with limits on the customer's use of the account, a clock, and an automatic suspension.
5. Decide which provider records the bank can retrieve, for how long, and in which jurisdiction they are stored, since the bank carries the retention duty.

Questions to put to a provider

• Which of the checks in the guidelines does the product perform, and which does it leave to the customer's own policies?
• How does the product handle a customer who is not enrolled in Myinfo or does not consent to its use?
• Has the technology been through an independent assessment, who performed it, and can the bank see the scope?
• What evidence does the product keep per verification, and can the bank retrieve it for a supervisor on request?
• What happens to a verification that is not completed, and does the result reach the bank as a decision or as a silence?
• Where are the images stored, who can open them, and how long are they kept?

Where this sits in a verification flow

A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The individual steps are described on the document verification page. This article does not state that these steps meet the Singapore notices, that they count as the technology solutions the guidelines name, or that they replace an independent assessment.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 28 October 2026, except the FATF text, which was fetched on 27 October 2026.

• MAS Notice 626, Prevention of Money Laundering and Countering the Financing of Terrorism - Banks, 28 March 2024, last revised 30 June 2025, Monetary Authority of Singapore.
• MAS Notice 626 amendment document, 30 June 2025, Monetary Authority of Singapore.
• MAS Notice PSN01, Holders of Payment Services Licence (Specified Payment Services), amendment document of 30 June 2025, Monetary Authority of Singapore.
• Guidelines to MAS Notice PSN01, last revised 1 July 2025, Monetary Authority of Singapore.
• Circular AMLD 01/2018: Use of MyInfo and CDD Measures for Non Face-to-Face Business Relations, Monetary Authority of Singapore, 8 January 2018.
• Digital ID and e-KYC, Monetary Authority of Singapore.
• Financial Services and Markets Act 2022, Singapore Statutes Online, Attorney-General's Chambers, table of contents as at 28 October 2026.
• Singpass Developer Portal, Government Technology Agency.
• Advisory Guidelines on the Personal Data Protection Act for NRIC and Other National Identification Numbers, Personal Data Protection Commission, issued 31 August 2018.
• The FATF Recommendations, consolidated text 2012-2026, Financial Action Task Force, as hosted by the Eurasian Group, Recommendation 10 and its interpretive note.