Lessons for onboarding and source-of-wealth checks

Read the PDF edition (4 pages)

Red flags that were seen and not pursued

The common thread of both cases is that the warning signs were visible. In the 1MDB case they lay in the transactions: very large payments from a state entity to private companies with no apparent business. In the case of 2023 they lay in the clients: individuals of recent arrival, holding passports of convenience, whose declared businesses could not plausibly explain their fortunes. MAS found in 2025 that every one of the nine institutions it penalised had failed on source of wealth.

A red flag is useless if the institution does not follow it up. In many of the failures the relationship manager or the compliance officer had noticed an inconsistency, recorded it and then allowed the relationship to continue on the basis of an explanation from the client that no one verified. The paper trail showed diligence. The substance was missing.

Corroboration and plausibility

The Inter-Ministerial Committee set out three principles for checks on the source of wealth and the source of funds. Gatekeepers should obtain corroborative evidence or conduct independent checks without relying solely on the client’s declaration. They should make a reasonable assessment of the plausibility of the client’s source of wealth and document that assessment. The extent of the checks should follow a risk-based approach and should not unduly hinder legitimate businesses and individuals.¹

Plausibility is the decisive test. A banker who is told that a client of thirty-five has accumulated two hundred million dollars from a gaming technology business in Southeast Asia must ask whether such a business can generate such a fortune in such a time, and whether public sources confirm that it exists. The answer will rarely be certain. What matters is that it is reasoned and recorded. In May 2026, according to an address by its General Counsel, MAS issued further guidance on the onboarding of private banking clients that asks institutions to focus their corroboration on material or higher-risk sources of wealth.² The aim is to concentrate effort where the risk lies, which protects ordinary clients from excessive demands while subjecting unusual fortunes to proper scrutiny.

Forged documents and the limits of paper

The case of 2023 began, in part, with reports on forged documents submitted to banks to substantiate the source of funds. Documents are the currency of onboarding. A well-funded criminal can buy convincing ones: contracts, invoices, tax returns, audited accounts, letters from lawyers. An institution that treats documents as proof without testing them against independent information will be deceived.

The practical remedy combines several techniques. Documents from foreign jurisdictions can be checked against public registers where they exist. Claims about a business can be compared with its visible footprint, from its website and its employees to its regulatory licences and its press coverage. Transfers into the account can be compared with the declared source. The point is that each piece of information should confirm the others, and that inconsistencies should lead to further questions before the account is opened or the funds accepted.

Information sharing: COSMIC

The case also showed the limits of what any one institution can see. Members of the network held accounts at several banks, each of which saw only part of their activity. On 1 April 2024 MAS launched COSMIC, the Collaborative Sharing of Money Laundering/Terrorism Financing Information and Cases platform, with six commercial banks: DBS, OCBC, UOB, Standard Chartered, Citibank and HSBC. The platform allows the participating banks to share information securely on customers who show multiple red flags once defined thresholds are met.³ It focuses on three risks: the misuse of legal persons, the misuse of trade finance and proliferation financing. Its legal basis is the Financial Services and Markets (Amendment) Act 2023, whose Bill was read a second time on 9 May 2023, three months before the raids.⁴

COSMIC addresses precisely the fragmentation that the network exploited. A customer who is refused by one bank because his source of wealth is implausible can no longer simply walk to another bank and start again without his history following him, at least among the participating banks and within the risks the platform covers. Private banking was not among the first areas, which explains why the guidance on onboarding remains the main instrument in that segment.

Governance and the relationship manager

Both cases also revealed a problem of incentives. In private banking the relationship manager brings in the client, earns the revenue and is often rewarded according to the assets he or she attracts. The same person is usually the first line of defence against money laundering, responsible for collecting the documents, explaining the client’s wealth and noticing unusual transactions. When the client is large and the explanations are thin, the banker’s commercial interest and duty of vigilance pull in opposite directions.

The responses of MAS addressed this conflict from two sides. The prohibition orders of 2016 and 2017 showed relationship managers that they personally risk their careers if they close their eyes. The actions of 2025 went further up the hierarchy, reaching team heads, chief executives and chief operating officers who had allowed the control environment to fall behind the growth of the business. A bank that wishes to avoid the fate of BSI must therefore design its remuneration, its escalation procedures and its committee structures so that a compliance officer can refuse a profitable client and be supported by management when he or she does so.

The question of culture runs through the Geneva volume as well. Its chapter on money laundering concludes that the cases which marked the Geneva centre almost all revealed a culture in which revenue prevailed over doubt.⁵ The Singapore record supports the same conclusion. Policies existed in almost every institution that MAS penalised. What failed was the willingness to apply them against the commercial interest of the moment.

Checklist for practitioners

• Establish the source of wealth of every higher-risk client from independent information, without relying solely on the client’s declaration and documents.
• Test plausibility explicitly: can the declared business, inheritance or investment have produced this fortune in this time, and do public sources confirm it?
• Treat passports of convenience, recent relocation, company structures with no visible operations and work passes tied to such companies as cumulative red flags.
• Verify documents from foreign jurisdictions against registers and other independent sources wherever possible, since forged documents were a central technique of the case of 2023.
• Follow up every alert generated by transaction monitoring and document the outcome, because eight of the nine institutions penalised in 2025 failed to review alerts adequately.
• After filing a suspicious transaction report, reassess the relationship promptly and apply risk mitigation measures, up to termination.
• Record the reasoning together with the result. A file that shows why a risk was accepted protects the institution and its managers.
• Ensure that senior management supports compliance refusals, including for profitable clients, since the prohibition orders of 2025 reached the chief executive and the chief operating officer of a firm.

Notes

1. Inter-Ministerial Committee on Anti-Money Laundering, Report, October 2024, “Proactive Prevention”: gatekeepers “should obtain corroborative evidence or conduct independent checks (i.e. not rely solely on the client’s declaration)”, should make “a reasonable assessment on the plausibility of clients’ SOW, with proper documentation”, and the extent of checks “should be guided by a risk-based approach, and not unduly hinder legitimate businesses and individuals”. ↩
2. Paul Yuen, General Counsel, Monetary Authority of Singapore, “The Singapore Story: Attracting Capital, Enabling Enterprise, Sustaining Trust”, keynote address, 28 October 2026 (mas.gov.sg), as cited in Chapter E.I; the guidance of May 2026 itself not consulted for this chapter. ↩
3. Monetary Authority of Singapore, “COSMIC” (mas.gov.sg/regulation/anti-money-laundering/cosmic, accessed November 2026): COSMIC launched “On 1st April 2024” with six commercial banks, DBS, OCBC, UOB, SCB, Citibank and HSBC, enabling secure sharing of information on customers who exhibit multiple red flags when set thresholds are met. ↩
4. Monetary Authority of Singapore, “COSMIC” (accessed November 2026): focus on “Misuse of legal persons”, “Misuse of trade finance for illicit purposes” and “Proliferation financing”; legal basis in the Financial Services and Markets (Amendment) Act 2023, Second Reading of the Bill on 9 May 2023. ↩
5. Ressos, Genève, place financière internationale, partie H, chapitre IV, section « La formation et la culture de conformité »: the affairs described “ont presque toutes révélé une culture où le chiffre d’affaires l’emportait sur le doute”; the sanctions of FINMA now target governance and senior management. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.