Record-keeping and personal data

Read the PDF edition (2 pages)

Records of CDD, account files, business correspondence and transaction data must be kept for at least five years after the end of the business relationship or the completion of the occasional transaction.¹ The period is shorter than the Swiss ten years under Art. 7 AMLA, a point that matters in Chapter VIII for groups that must set one retention rule. The records must be sufficient to reconstruct individual transactions and to be produced promptly to MAS and to the authorities. For DPT firms "transaction data" includes the on-chain identifiers: transaction hashes, addresses, timestamps and the travel-rule information exchanged. Firms should store this data in a form that remains readable even if the analytics vendor changes.

The notice also addresses the interaction with the Personal Data Protection Act 2012 (PDPA). A customer's consent is not required for the collection, use and disclosure of personal data for the purpose of complying with the notice, since the PDPA permits processing required by law and MAS notices are law for this purpose.² The firm must nevertheless comply with the PDPA's protection and retention-limitation obligations, which in practice means secure storage, access controls and deletion at the end of the five-year period unless another law requires longer retention. Part J, Chapter IX treats the PDPA in full.

Checklist

Before onboarding any DPT customer in Singapore, the file should contain the following. - Identification data meeting the PSN02 minimum for the customer, every beneficial owner and every person authorised to act. - Verification evidence from reliable independent sources, with the technology used for remote verification recorded. - A documented ownership and control structure for legal persons, reaching the natural persons at the top or recording why the search stopped. - The stated purpose of the relationship and expected activity, in terms specific enough to test later transactions against. - Screening results against sanctions, PEP and adverse-media lists for every identified person, with hits resolved. - A risk rating with reasons, consistent with the enterprise-wide risk assessment. - For higher-risk customers, source-of-wealth and source-of-funds evidence and senior management approval. - The wallet addresses the customer has declared, with a signed-message proof of control for each and a blockchain-analytics screening result.

Notes

MAS Notice PSN02, para. 11 (record keeping), requiring retention of CDD and transaction records for a period of at least 5 years following termination of business relations or completion of the transaction. ↩
MAS Notice PSN02, para. 12 (personal data), confirming that the collection, use and disclosure of personal data for the purposes of the notice does not require consent under the Personal Data Protection Act 2012, and that the firm must nonetheless comply with PDPA obligations in other respects. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.

English

Contact

Dr Alexander Ressos, TEP

Of Counsel, KGP Legal LLC

I am Of Counsel with KGP Legal LLC in Singapore, where I work with a global client base of successful entrepreneurs and their families, independent asset managers, commodity trading houses and other commercial clients. I am a German and Swiss attorney-at-law, also admitted as a solicitor in England & Wales and in Hong Kong. I divide my time between Zug in Switzerland, Singapore and Hong Kong. Since 2017 I have advised international clients on more than 700 crypto and digital asset projects. I also have extensive experience in cross-border litigation and arbitration in Singapore, Hong Kong and other markets in South-East Asia and Greater China.

I operate across the key financial centres in South-East Asia, the Middle East and Switzerland, with a particular focus on asset protection, international tax and estate planning, as well as trusts, company administration and other fiduciary services. My philosophy is to serve as a trusted advisor working closely with my clients and to help them achieve their commercial objectives.

All Singapore law advice is provided through KGP Legal LLC, an established and duly licensed firm of Singapore advocates and solicitors.

KGP Legal LLC is a medium-sized law firm in Singapore that is capable of providing the full range of legal services and corporate administration work. Please contact me if you need any further information.

Get in touch →

Articles and Insights

Setting up or expanding in Singapore?

SingaporeIQ is edited by Dr Alexander Ressos, an international business lawyer with more than 15 years of local experience in Singapore as a permanent resident, a Singapore registered foreign lawyer and managing partner of a Singapore foreign law practice. In addition to significant experience in cross-border investments and transactions, UHNWI private client work and sanctions/export controls, Dr Ressos has extensive experience in cross-border business and in crypto and digital-asset projects in Singapore, drawn from more than 700 projects since 2017.

If you are planning a company incorporation, an investment, a holding structure or a market entry through Singapore, you can reach Dr Ressos directly at [email protected]. Singapore law advice is provided by KGP Legal LLC, a licensed firm of Singapore advocates and solicitors. Dr Ressos and his team facilitate the full range of Singapore legal, compliance and company administration services, including company incorporation, corporate transactions, commercial contracts, crypto and digital assets, financial regulatory work and dispute resolution, including litigation in the Singapore courts. For Hong Kong, our parallel site HongkongIQ.com offers the same practical guidance. For crypto and digital assets, dltreg.com covers legal, tax and fiduciary services. For legal, tax and fiduciary services in Switzerland, see helveticaregister.com.