Compliance functions and the external compliance officer

Read the PDF edition (3 pages)

Responsibility at the top

MAS expects every manager to have compliance arrangements that match the nature, scale and complexity of its business. It states clearly where responsibility lies: “Ultimate responsibility for compliance with applicable laws and regulations rests with the FMC’s CEO and directors, even though compliance support may be provided by a foreign related entity and/or third-party service providers.” An in-house compliance officer should have relevant experience, for example in compliance, audit or risk management, and should be regularly trained on the rules that apply to the firm. MAS also expects managers to consult their compliance officer or service provider before turning to MAS with questions. Where they do seek clarification, they should present their own detailed assessment of the issue.¹

This allocation of responsibility is the counterpart of the individual accountability regime described in Chapter E.I. A chief executive who delegates compliance to a service provider remains answerable for its quality. The prohibition order against the former chief executive of China Capital Impetus Asset Management was based on his failure to take reasonable steps to secure the firm’s compliance with its obligations.²

Minimum arrangements by category

The minimum compliance arrangements differ by category and size. A retail manager must have an independent and dedicated compliance function in Singapore, staffed by suitably qualified people independent of the front office. Its compliance staff may also perform compatible roles, such as that of in-house legal counsel. The same applies to an A/I manager with assets under management of S$1 billion or more, with a concession for firms that only provide research and advice, which may rely on a dedicated compliance team at a holding company or overseas affiliate.

An A/I manager with less than S$1 billion must also have an independent compliance function. Depending on its size, it may designate a senior employee independent of the front office, such as the chief operating officer or the chief financial officer, as responsible for compliance. Alternatively, it may show that it receives adequate compliance oversight and support from a dedicated team at its holding company or an overseas affiliate.³ Most external asset managers fall into this category. For them, the chief executive cannot simply act as his own compliance officer, since the person responsible must be independent of the front office.

The external compliance service provider

A small manager without a group compliance team may engage an external service provider to support its compliance arrangements. MAS expects the manager to ensure that the provider is competent and familiar with the requirements of the Securities and Futures Act and other Singapore regulations. It encourages managers to use providers who belong to relevant professional bodies in Singapore and who can provide a meaningful presence on site.⁴ A market of compliance consultancies has grown up in Singapore to serve this demand. They prepare manuals, perform periodic testing, file regulatory returns, train staff and keep their clients informed of new rules.

The use of an external provider is an outsourcing arrangement. Before entering into it, the manager must consider the MAS Guidelines on Outsourcing. MAS lists compliance, risk management, internal audit and IT support among the activities that managers of segregated accounts typically outsource. Where the compliance function is outsourced, the manager should understand how the provider screens its own employees.⁵ The external provider is thus a support, never a substitute. The designated person inside the firm must still own the compliance programme, review the provider’s work and act on its findings.

Risk management, audit and anti-money laundering

Compliance in the narrow sense is only one of the control functions. Each manager must maintain a risk management framework to identify, address and monitor the risks of the client assets it manages, as required by regulation 13B(1)(a) of the Licensing and Conduct of Business Regulations. The risk function should be independent of portfolio management and subject to oversight by senior management. The firm’s activities must be subject to internal audit, which may be performed by an internal team, the head office or an external provider.⁶

The manager must also comply with MAS Notice SFA 04-N02 on the prevention of money laundering and the financing of terrorism, and with the notice on reporting misconduct of representatives.⁷ For an external asset manager, the anti-money laundering obligations overlap with those of the custodian bank. Both must know the client and the source of his wealth. Both must report suspicions. The overlap is intentional, because the two institutions see different parts of the relationship. Chapter H.III describes the general framework of anti-money laundering law in Singapore.

Oversight of people

The Guidelines require each manager to monitor the conduct of everyone who acts on its behalf, including its chief executive, directors and representatives. It must keep documented systems and controls showing that it has supervised their activities and addressed conflicts arising from outside business interests. It must also maintain a disciplinary framework that holds individuals accountable. Representatives must meet the minimum entry and examination requirements of the MAS notice on competency.⁸ For a firm of five people, these obligations can appear disproportionate. They nevertheless address the main risk of small managers, which is the absence of anyone able to challenge the founder.

Notes

1. MAS Guidelines SFA 04-G05, para. 3.15: in-house compliance officers are expected to have relevant experience “in regulatory compliance, audit or risk management” and to be regularly trained; FMCs should consult their compliance officer or third-party service provider and, when seeking clarification from MAS, “set out its detailed assessment”; “Ultimate responsibility for compliance with applicable laws and regulations rests with the FMC’s CEO and directors”. ↩
2. Monetary Authority of Singapore, release of 31 July 2024 on China Capital Impetus Asset Management (cited above): two-year prohibition order against the former CEO “for his failure to take reasonable steps to secure compliance by CCIAM with the SFR”. ↩
3. MAS Guidelines SFA 04-G05, Appendix 2, Table A2: A/I LFMCs with AUM below S$1 billion should either “designate a senior staff independent from the front office (e.g., COO or CFO) to be responsible for compliance” or demonstrate adequate compliance oversight and support from a dedicated team at the holding company or an overseas related entity; for Retail LFMCs and A/I LFMCs with AUM of S$1 billion or more, “an independent and dedicated compliance function in Singapore with staff who are suitably qualified and independent from the front office”, whose staff may perform non-conflicting roles such as in-house legal counsel. ↩
4. MAS Guidelines SFA 04-G05, Appendix 2, Table A2: an FMC without a dedicated compliance function at group level “may engage an external service provider to support its compliance arrangements”; the provider should be “competent and familiar with the requirements for FMCs under the SFA”; FMCs “are encouraged to use service providers who are members of relevant professional bodies in Singapore and who are able to provide meaningful onsite presence at the FMC”. ↩
5. MAS, FAQs on the Licensing of Fund Management Companies, last updated June 2026, Scenario C and Q34: compliance listed among examples of outsourced activities; FMCs should satisfy themselves that service providers have suitable hiring and screening policies, for example “if the compliance function is outsourced”; MAS Guidelines SFA 04-G05, para. 4.4: before entering into arrangements with service providers “(such as a compliance service provider or a fund administrator)”, an FMC should take into account the MAS Guidelines on Outsourcing. ↩
6. MAS Guidelines SFA 04-G05, paras 3.16–3.17: a risk management framework “as required by regulation 13B(1)(a) of the SF(LCB)R”; the risk management function “should also be segregated from and independent of the portfolio management function”; internal audit by an internal team, the head office or a third-party provider. ↩
7. MAS Guidelines SFA 04-G05, paras 4.2–4.3: compliance with Notice SFA 04-N02 on AML/CFT and Notice SFA 04-N11 on reporting of misconduct. ↩
8. MAS Guidelines SFA 04-G05, Appendix 1: representatives must meet the requirements of the “Notice on Competency Requirements for Representatives of Holders of Capital Markets Services Licence and Exempt Financial Institutions [SFA04-N22]”; para. 4.1.7: an FMC “shall put in place documented systems and controls to demonstrate that it has exercised oversight of these individuals’ activities” and “establish and implement a disciplinary action framework”. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.