Information sharing and its limits

Read the PDF edition (2 pages)

A group programme depends on the two entities knowing what each other knows about shared customers. Four legal constraints shape what may be shared.

The first is tipping-off. Singapore's s. 57 CDSA has no express exception for intra-group disclosure. Sharing the fact that an STR has been filed is therefore lawful only if it does not disclose information likely to prejudice an investigation and is made to persons who themselves will not disclose it onwards. Swiss law is more explicit. Art. 10a AMLA prohibits the reporting intermediary from informing the affected persons or third parties of a report, but permits information to another financial intermediary subject to the AMLA where necessary for AML purposes and the two belong to the same group.¹ The group protocol should therefore permit the Swiss entity to inform the Singapore entity of a Swiss report in the terms Art. 10a allows. The Singapore entity should inform the Swiss entity of a Singapore report only in the limited form of a risk-event notification and risk-rating change, confined to the compliance officers and documented.

The second is Swiss criminal law on business secrets. Art. 273 of the Swiss Criminal Code (SCC; StGB) criminalises making a manufacturing or business secret available to a foreign official body or foreign private organisation. Swiss banks have long treated customer data as within it.² An SRO-affiliated custodian is not bound by banking secrecy under Art. 47 BankA, but Art. 273 SCC applies to it. Transferring Swiss customer data to the Singapore affiliate for group AML purposes is widely regarded as lawful where the customer has consented in the account terms and the transfer is necessary for the group's compliance. The consent must be express and the purpose documented. Part F, Chapter IX treats the point in full.

The third is data protection. Switzerland's Federal Act on Data Protection permits cross-border transfer to countries with adequate protection as listed by the Federal Council, and otherwise requires safeguards such as standard contractual clauses. Singapore does not appear on the Swiss adequacy list, so the group needs an intra-group data-transfer agreement incorporating the Swiss or EU standard clauses.³ In the other direction, the PDPA's transfer-limitation obligation requires the Singapore entity to ensure that the Swiss recipient is bound to a comparable standard, which the same intra-group agreement achieves (Chapter III, Section 8).⁴ The agreement should cover the compliance data specifically, including analytics outputs and STR-related risk notifications, since these are the most sensitive categories.

The fourth is the regulators' own cooperation. MAS and FINMA signed a cooperation agreement on fintech in September 2016 and both are parties to the IOSCO and other multilateral memoranda that permit exchange of supervisory information.⁵ A group should assume that what one regulator learns about a shared customer or a shared control failure can reach the other. The practical consequence is that remediation of a finding in one entity should be applied in the other before the second regulator asks.

Notes

1. AMLA, Art. 10a paras 1–3 (prohibition on informing, with exceptions for financial intermediaries within the same group and for intermediaries involved in the same transaction). ↩
2. Swiss Criminal Code (SCC; StGB, SR 311.0), Art. 273 (economic intelligence service); Art. 47 Banking Act applies only to banks and securities firms and does not reach an SRO-affiliated custodian, but Art. 273 SCC applies to all. ↩
3. Federal Act on Data Protection (FADP; DSG, SR 235.1), Art. 16 (transfer abroad) and Annex 1 to the Data Protection Ordinance (DPO; DSV, SR 235.11) listing the states with adequate protection; Singapore is not listed. ↩
4. Personal Data Protection Act 2012, s. 26 and Personal Data Protection Regulations 2021, reg. 10. ↩
5. MAS and FINMA, Cooperation Agreement on FinTech, 12 September 2016; Financial Market Supervision Act (FINMASA; FINMAG, SR 956.1), Art. 42 (administrative assistance); Monetary Authority of Singapore Act 1970, Part on assistance to foreign regulatory authorities. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.