What should an LFMC compliance officer do in Singapore?

A quieter firm still needs someone watching the controls

A firm with fewer than ten staff and a handful of existing investors may have very little new KYC work in a particular month. We understand why management might look at the compliance bill and wonder what there is to do.

The workload should reflect the business. There is little value in producing a thirty-page report to say that nothing has changed.

But a quieter month should still involve checking the controls that matter. Have investor reviews fallen due? Has a director taken on a new outside role? Are the funds operating within their mandates? Has an outsourced provider missed something? Is the management company’s capital position getting uncomfortable?

Finance should track the firm’s applicable base-capital and financial-resource requirements, with compliance checking the reporting and escalation arrangements. Those are the management company’s requirements; investor assets are not its operating budget.

The answer may be that everything is in order. That is a useful conclusion when somebody has actually checked.

Senior management should agree the scope with the compliance officer or adviser: what gets reviewed, how often, what evidence is retained and when an issue must be escalated. The CEO and directors retain responsibility even when an external provider supports the compliance function. MAS’s fund management guidelines, section 3.15

As investor numbers grow, the workflow needs to grow too

Take an LFMC with around 30 investors, for example. Keeping track of periodic reviews can start becoming a job in itself, especially when investors have different risk ratings and review dates.

The compliance officer may use a spreadsheet with macros or reminders to flag when reviews are coming up. It should also be clear who owns each review and which ones are overdue. A reminder is useful, but somebody still has to complete the work.

There is also new adverse news to watch for after onboarding. A regular batch-screening process can help identify those developments, with an appropriate screening frequency and a clear owner to assess alerts and record the follow-up.

As fund subscriptions and withdrawals increase, manual transaction monitoring can become harder to manage too. At that point, the firm should consider whether a digital transaction-monitoring solution would help the team identify unusual activity and keep track of its investigations.

More staff may still be needed. But it makes sense to look at the workflow first: where are the reminders, which checks can be automated and who reviews the exceptions? Otherwise, the firm may simply end up with more people chasing the same spreadsheet.

Policies your staff can actually follow

The requirements sit across the Securities and Futures Act, regulations, MAS notices, guidelines, circulars and the firm’s own licence conditions. They do not arrive as one neatly wrapped compliance manual.

As a practical starting point, an LFMC’s policies and procedures should cover:

• AML/CFT, investor onboarding, screening and ongoing due diligence.
• Investor eligibility and the firm’s permitted clientele.
• Employee conduct, personal account dealing and conflicts of interest.
• Investment restrictions, risk escalation and oversight of fund operations.
• Custody, valuation and investor reporting arrangements.
• Outsourcing and third-party oversight.
• Technology risk, information security and business continuity.
• Regulatory reporting, misconduct, complaints and incident escalation.
• Records, staff training and monitoring of fit and proper status.

These are areas to cover, rather than nine compulsory document titles. Related procedures can sit together if responsibilities and controls remain clear.

A policy explains the framework. A procedure tells the employee what to do: which documents to obtain, who can approve an exception, where the evidence goes and what happens if the answer is no.

A beautifully written manual will not help much if nobody can explain how to use it. If your procedure says every exception goes to the compliance manager, somebody also needs to know what happens when that manager is on leave.

We recommend an annual overall policy review, with earlier updates when the business or requirements change. The enterprise-wide AML/CFT risk assessment has its own timetable: at least every two years, or earlier on material triggers, with the review documented and approved by senior management even when no significant changes result. SFA04-N02 guidance, paragraph 4-18

For a smaller firm, a review may be straightforward. If there have been no significant regulatory or business changes, senior management may consider a two-year review cycle for selected documents where the applicable requirements and supervisory expectations allow it. Management should record that decision and why the existing controls remain suitable.

Investment-related P&Ps should still be reviewed at least annually and when relevant changes arise, in line with MAS’s supervisory observations. Other specific annual reviews, including business continuity and material outsourcing arrangements, also remain on the calendar. MAS’s risk management observations on policy reviews, section B

A missed reporting deadline that exposed a bigger problem

An LFMC licence is not a stamp of approval on every policy and procedure the firm uses. The firm remains responsible for putting proper compliance and risk management arrangements into practice. MAS’s fund management guidelines, sections 3.15-3.16

In one client engagement, the firm had taken a rather optimistic view of that responsibility. It had received its licence and continued onboarding investors without putting a proper suite of policies and procedures in place. For a while, everything seemed fine.

Then it missed the deadline for its quarterly Forms 1 and 2. The MAS officer asked about the firm’s reporting procedures. Once the lack of proper procedures came to light, MAS called for a thorough audit review of the company’s controls. Management went into full panic mode.

We had to help with damage control: set up the policies and procedures, train the staff and work with management on resolving the audit findings. Management committed to MAS that all the audit points would be resolved within six months. In that case, the firm’s licence was at risk if it failed to follow through.

The firm completed the remediation within six months and retained its licence. But getting there was far more disruptive than putting the basic controls in place before the business got going.

A missed return can open the door to questions about how the whole firm is being run. That is why the reporting calendar and the procedures behind it both matter.

Investor onboarding is more than a completed KYC file

An A/I LFMC needs to establish that an investor falls within its permitted clientele. Where the accredited-investor opt-in requirements apply, the relevant disclosures and consent need to be in place before accepting the subscription. Keep the supporting evidence, rather than relying on somebody’s recollection that the investor is wealthy. MAS’s accredited-investor FAQs, question 15

Eligibility and financial-crime risk are separate questions. An investor may qualify as accredited and still have a complicated ownership structure, unexplained funding or sanctions exposure.

Customer due diligence should establish identity, beneficial ownership and control, assess risk and apply the appropriate screening and monitoring. Higher-risk relationships require enhanced measures, including the relevant senior management approval and source-of-wealth and source-of-funds checks. MAS Notice SFA04-N02, sections 6 and 8

Take an illustrative example. An existing investor makes another subscription, but this time the money arrives from an unfamiliar company’s bank account.

“We already know the investor” does not explain who paid. The team should establish the payer’s relationship to the investor, the reason for the arrangement and the supporting funding trail before deciding how to proceed. The explanation may be perfectly legitimate. The point is to obtain it and document the decision, rather than wave the money through because the name on the subscription form looks familiar.

Periodic reviews also need a workable schedule. Higher-risk customers should be reviewed more frequently, with annual review an example in MAS’s guidance. Relevant changes can call for an earlier review. Follow the firm’s documented schedule and investigate new information instead of waiting for the next anniversary. SFA04-N02 guidance on ongoing monitoring

If suspicion arises, the internal assessment should happen without delay and an STR should be filed promptly with STRO where required. MAS’s guidance says filing should generally not exceed five business days after suspicion is first established, except in exceptional or extraordinary circumstances. MAS’s AML/CFT guidance, paragraph 13-1

Sanctions cases are more urgent. MAS expects a sanctions-related STR as soon as possible, no later than one business day after suspicion is first established. That means the point when the firm concludes an STR is warranted, rather than when an initial screening alert appears. Applicable asset-freezing duties require action without delay and without prior notice. MAS’s AML/CFT guidance, paragraphs 6-15-2 and 13-1

A copy of an STR goes to MAS upon request; separate regulatory notifications may also apply. MAS Notice SFA04-N02, section 13

Check what happens inside the funds

The compliance programme should also examine whether the fund is operating within its investment restrictions and agreed controls. KYC can be immaculate while a fund repeatedly exceeds its mandate.

Portfolio management, risk, operations and compliance need clear responsibilities. Compliance does not become the portfolio manager, valuer or fund administrator simply because it checks whether the arrangements work. The firm still needs appropriate risk oversight, independent valuation and custody arrangements, with applicable exceptions assessed properly. An annual audit alone does not satisfy the independent valuation requirement. MAS’s fund management guidelines, sections 3.16 and 4.1

For another illustrative example, suppose a fund’s documents set a 20% limit on exposure to one issuer. A monitoring check shows 24%.

Someone needs to establish what caused it, how the mandate and procedures treat the situation, what action is required and who owns the response. Was it a new trade, a price movement or a data error? Recording the breach in a register is only the beginning. It should remain open until the agreed action has been completed and checked.

There is a real example of the timing problem in MAS’s May 2026 risk management paper. MAS observed a weekly-dealing fund that was monitored only monthly, including checks on investment restrictions. That gap could delay identification and remediation of breaches. MAS’s risk management observations, section E

The practical lesson is simple: choose a monitoring frequency that gives the firm time to act. A very tidy monthly report cannot recover the weeks in which nobody noticed a problem.

Conflicts deserve the same attention. Related-party investments, allocations between funds, personal trading and outside business interests should have an assessment, appropriate approval and a record of how the conflict is managed. “Everyone knows each other” is precisely why an independent check can be useful.

Keep the regulatory calendar accurate

The calendar should cover the firm’s actual obligations, internal preparation dates and named owners. Finance may prepare the financial returns, but compliance should ensure the deadline and approval process do not disappear between departments.

Obligation	What the calendar should capture
Quarterly Forms 1 and 2	Within 14 days after each reporting quarter ends: 14 April (Q1), 14 July (Q2), 14 October (Q3) and 14 January (Q4), for calendar-quarter reporting.
Annual financial submissions	Forms 1-6 and the required audited financial statements, auditor’s report and management letter, if any, within five months after financial year-end.
Quarterly Income and Expenditure return	Quarterly, where assigned to the firm. Follow MAS’s specified submission deadline and channel.
Surveys and MAS requests	Track their specified deadline and submission channel separately.
Qualifying cross-border arrangements	Applicable commencement/change notifications and annual Form FR assurance; the annual submission is due within five months after financial year-end.

The MAS LFMC Compliance Toolkit sets out the relevant approvals and submissions. A 31 December financial year-end gives a 31 May deadline for the annual financial package. Form FR applies to qualifying foreign-related-corporation or foreign-office arrangements; overseas investors alone do not trigger it.

The Quarterly Income and Expenditure return is a separate submission. Its deadline should be checked against the firm’s assigned return, rather than assumed to be the same as Forms 1 and 2. MAS’s return-submission channels

For the fuller calendar, forms and register reviews, see our fund management compliance monitoring guide.

Misconduct reporting needs particular attention during the current transition. The old annual nil-misconduct declaration, where applicable, was due within 14 days after calendar year-end, ordinarily 14 January. MAS has waived the declaration for the year ending 31 December 2026, and annual nil declarations are no longer required from 1 January 2027. MAS’s LFMC Compliance Toolkit, MAS’s misconduct reporting FAQs, question 13

Actual reportable misconduct cannot wait for an annual submission. Through 2026, the existing notice requires reporting upon discovery, no later than 14 days after discovery. From 1 January 2027, the revised notice uses a 21-calendar-day deadline from first having reasonable grounds to believe reportable misconduct occurred. The scope and trigger change too. Existing SFA04-N11, revised SFA04-N24

Outsourced work still needs an owner

Using a fund administrator, screening provider, technology vendor or outsourced compliance adviser can make good sense. It also creates work for somebody inside the firm: checking whether the service is being delivered properly.

Know what the provider is responsible for, what information the firm receives, who investigates errors and what happens if the service becomes unavailable. An invoice marked “paid” is not evidence that the controls worked.

Material outsourcing arrangements should be reviewed at least annually. The outsourcing register should be updated promptly and submitted to MAS at least annually or upon request. MAS’s outsourcing guidelines, paragraphs 4.1.1 and 5.8.2

Business continuity should also be usable. Critical services, recovery objectives and dependencies need annual review and earlier review on material changes, supported by meaningful tests. Senior management provides an annual attestation to the Board. MAS’s business continuity guidelines, sections 6, 7 and 10

For example, if the fund administrator’s portal becomes unavailable just before a dealing deadline, staff should know who to contact, which records remain accessible and how investors will be informed. Discovering that the backup procedure depends on the same unavailable portal is a useful finding in a test. It is less amusing during the actual disruption.

Independent audit is another part of the programme. The LFMC needs an independent annual external audit, distinct from any separate fund audit arrangements, and adequate internal audit arrangements proportionate to its business. An annual internal-audit cycle can be sensible, but the guidelines do not prescribe it universally for every firm. MAS’s fund management guidelines, sections 3.17-3.18

Compliance should track the findings, agreed actions and evidence of closure. The person operating a control should not also be treated as its independent auditor. MAS’s fund management FAQs, questions 10-11

Our guide to internal audit for fund managers explains the audit scope, evidence testing and independence considerations in more detail.

Bring compliance in before the next fund launch

A new fund or investment strategy can change the risks, documents, systems and expertise the firm needs. Compliance should be involved while those decisions are being made. MAS expects governance over new fund launches and investment changes, alongside due diligence and ongoing monitoring. MAS’s risk management paper, section C

Consider an illustrative private-credit fund launch. The offer documents look good, and the first investors are ready. But who will monitor loan covenants, verify collateral arrangements and challenge the valuations? What happens when a borrower misses a payment?

Those questions need answers before launch, with the relevant investment, risk and operations owners involved. Compliance should identify the gaps, check the proposed arrangements against the firm’s licence and obligations, and ensure approvals and actions are documented.

“Could you sign this off by Friday?” is a difficult starting point when the unresolved issue is how the fund will operate on Monday.

The same applies to marketing. Investor presentations and performance claims should reflect the actual strategy, risks and applicable offering requirements. The sales deck should not promise something the fund documents or operating team cannot deliver.

Give senior management a report they can use

For many smaller LFMCs, a concise monthly update and a fuller quarterly discussion can work well. The frequency should reflect the business; urgent matters need escalation when they arise.

Management should be able to see:

• Overdue investor reviews and significant onboarding issues.
• Screening escalations, suspicious activity and material incidents.
• Investment-limit breaches and unresolved fund-operation issues.
• Conflicts, personal trading exceptions and changes in outside interests.
• Upcoming submissions, capital concerns and regulatory changes.
• Outsourcing problems and overdue audit actions.
• Decisions, resources or approvals required from management.

Each material issue should have an owner, a proposed action and a target date. If the same problem appears in every report, somebody needs to ask why it is still there. “Noted” in the minutes is not much of a solution.

Some matters cannot wait for that report. If a regulatory reporting deadline has been missed, or the firm discovers that a required MAS notification or approval has been overlooked, the CEO should be alerted immediately. A director change is one example where the team needs to check the applicable requirements before proceeding.

Management needs a clear account of what happened, what must be filed or corrected, and how the firm will prevent it happening again. Compliance should establish the right reporting or approval route and contact MAS promptly where required. An unresolved breach becomes harder to explain with each passing day.

Suspicious activity and sanctions concerns also need prompt escalation to the compliance officer or MLRO, with senior management involved as appropriate. The escalation process must support timely action and reporting, without holding up an STR while someone waits for the next committee meeting.

Compliance is a little like visiting the dentist

A chief compliance officer I worked with at Standard Chartered once compared compliance to visiting the dentist. Nobody particularly looks forward to it. But regular checks on your teeth and gums tend to pay off in the long run, and deep down, you know they are necessary.

That comparison has stayed with me. A good dentist schedules the check-ups, spots problems early and tells you what needs attention. You can then get on with your life between visits.

A good compliance officer should work much the same way: keep the regular checks on schedule, raise problems when they need attention and give management useful updates. The business should be able to get on with serving investors without being buried in unnecessary reminders and paperwork.

“No news is good news” only means something when the checks are being done. Much of our job is to prevent the sort of news nobody wants: a missed obligation, an avoidable breach or an unpleasant surprise from the regulator.

If your team needs support reviewing the programme, clearing a backlog or preparing for independent audit, explore Advisors Assemble’s fund manager compliance support or contact [email protected].