Data, systems and the compliance stack

Read the PDF edition (1 page)

A dual-hub group runs one technology stack and must satisfy two data-protection laws and two sets of regulatory technology requirements. The Swiss Federal Act on Data Protection of 2023 and Singapore's Personal Data Protection Act 2012 are compatible enough that a single policy satisfies both. Switzerland recognises Singapore as a jurisdiction with adequate protection for transfers. Singapore permits transfers to Switzerland under the transfer limitation obligation on the basis of contractual safeguards.¹ The regulatory technology requirements are heavier in Singapore. MAS's Technology Risk Management Guidelines and the Notice on Cyber Hygiene apply to every licensee. They require board-level accountability, penetration testing, incident reporting within one hour of discovery of a relevant incident and controls over privileged access, which for a custodian means controls over key management.² Switzerland's FINMA Circular 2023/1 on operational risks and resilience applies to banks and FinIA institutions and imposes comparable duties with less prescriptive detail.³

The economical answer is to build the compliance stack once to the Singapore standard and apply it group-wide. A group that meets MAS TRM meets FINMA's expectations for a non-bank institution with margin to spare. The same holds for anti-money-laundering controls. A group programme built to MAS Notice PSN02 satisfies the Swiss SRO regulations in all material respects. Part L, Chapter VIII, and Part F, Chapter VIII, explain the few points where the Swiss rules are stricter, chiefly the CHF 1,000 identification threshold for exchange transactions and the treatment of unhosted wallets under the travel rule.

Notes

Federal Act on Data Protection of 25 September 2020 (FADP; DSG), SR 235.1, Art. 16 and Annex 1 to the Data Protection Ordinance of 31 August 2022 (DSV), SR 235.11 (list of states with adequate protection, including Singapore); Personal Data Protection Act 2012 (2020 Rev. Ed.), s. 26 and Personal Data Protection Regulations 2021, reg. 10 to 12 (transfer limitation obligation). Part D, Chapter X, and Part J, Chapter IX. ↩
MAS, Technology Risk Management Guidelines, January 2021; MAS Notice PSN05 on Technology Risk Management and Notice PSN06 on Cyber Hygiene for payment service providers (incident notification within one hour). Part L, Chapter VII. ↩
FINMA Circular 2023/1, "Operational risks and resilience – banks", of 7 December 2022, in force 1 January 2024, margin nos 50 ff. (ICT risks) and 98 ff. (critical data). Part F, Chapter VIII. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.

English

Contact

Dr Alexander Ressos, TEP

Of Counsel, KGP Legal LLC

I am Of Counsel with KGP Legal LLC in Singapore, where I work with a global client base of successful entrepreneurs and their families, independent asset managers, commodity trading houses and other commercial clients. I am a German and Swiss attorney-at-law, also admitted as a solicitor in England & Wales and in Hong Kong. I divide my time between Zug in Switzerland, Singapore and Hong Kong. Since 2017 I have advised international clients on more than 700 crypto and digital asset projects. I also have extensive experience in cross-border litigation and arbitration in Singapore, Hong Kong and other markets in South-East Asia and Greater China.

I operate across the key financial centres in South-East Asia, the Middle East and Switzerland, with a particular focus on asset protection, international tax and estate planning, as well as trusts, company administration and other fiduciary services. My philosophy is to serve as a trusted advisor working closely with my clients and to help them achieve their commercial objectives.

All Singapore law advice is provided through KGP Legal LLC, an established and duly licensed firm of Singapore advocates and solicitors.

KGP Legal LLC is a medium-sized law firm in Singapore that is capable of providing the full range of legal services and corporate administration work. Please contact me if you need any further information.

Get in touch →

Articles and Insights

Setting up or expanding in Singapore?

SingaporeIQ is edited by Dr Alexander Ressos, an international business lawyer with more than 15 years of local experience in Singapore as a permanent resident, a Singapore registered foreign lawyer and managing partner of a Singapore foreign law practice. In addition to significant experience in cross-border investments and transactions, UHNWI private client work and sanctions/export controls, Dr Ressos has extensive experience in cross-border business and in crypto and digital-asset projects in Singapore, drawn from more than 700 projects since 2017.

If you are planning a company incorporation, an investment, a holding structure or a market entry through Singapore, you can reach Dr Ressos directly at [email protected]. Singapore law advice is provided by KGP Legal LLC, a licensed firm of Singapore advocates and solicitors. Dr Ressos and his team facilitate the full range of Singapore legal, compliance and company administration services, including company incorporation, corporate transactions, commercial contracts, crypto and digital assets, financial regulatory work and dispute resolution, including litigation in the Singapore courts. For Hong Kong, our parallel site HongkongIQ.com offers the same practical guidance. For crypto and digital assets, dltreg.com covers legal, tax and fiduciary services. For legal, tax and fiduciary services in Switzerland, see helveticaregister.com.