What is ECDD? Why your Singapore company needs enhanced due diligence?

A PEP (Politically Exposed Person) is a natural person who holds or has held a prominent public function in Singapore, in a foreign country, or in an international organisation.

Definition of a politically exposed person (PEP) under Singapore's regulations

The group can include:

• Heads of state or heads of government;
• Senior ministers and officials;
• Members of the legislature;
• Senior judicial or military officials;
• Leaders of state-owned enterprises;
• Senior political-party officials;
• Senior management of international organisations.

Close family members and close associates of a PEP are assessed at a similar level. Mid-level and junior officials do not fall in this group.

Not every PEP connection is treated the same way:

• Foreign PEPs (including their immediate family and close associates): the CSP must always run ECDD and maintain enhanced monitoring;
• Singapore PEPs, international-organisation PEPs, or former PEPs: the CSP may use a risk-based approach to decide whether and how much ECDD to apply, taking into account the influence the person still holds after leaving office. This risk-based approach cannot be used when the transaction or service is high-risk; in that case the CSP must run ECDD regardless.

Being a PEP does not mean the person broke any law. It is a risk factor that the CSP must weigh during due diligence, based on the role, the level of influence, and the nature of the business relationship.

The Financial Action Task Force (FATF) publishes lists of countries and territories with identified gaps in their AML/CFT systems.

Two groups come up most often in practice:

• FATF "call for action" countries (the blacklist): these carry the most serious deficiencies and trigger a mandatory ECDD requirement;
• FATF "increased monitoring" countries (the grey list): these are under FATF follow-up to improve their financial-controls framework. The CSP weighs this factor during its risk assessment.

So when a customer is from, or resides in, a FATF "call for action" country, the CSP must run ECDD. For a country under enhanced monitoring, the CSP needs to factor the jurisdiction into its overall assessment and decide on the appropriate measures.

One important nuance: the assessment does not look only at where the customer lives. Nationality (including dual or multiple nationalities), the country where the company is incorporated, and other related factors can all come into play.

Because FATF lists change over time, you should check the latest status at the FATF's official site before preparing your file.

Under ACRA's ECDD guidance, the CSP must run enhanced due diligence when it cannot tell whether the company has a genuine business activity, or when it does not understand why the company is structured the way it is. Situations that can trigger extra document requests include:

• The company is owned through multiple layers of intermediate legal entities;
• Shareholders and actual controllers sit in different countries;
• A nominee shareholder or nominee director is used, but the commercial purpose has not been explained;
• The ultimate natural-person owner or controller cannot be identified;
• The reason for forming the company has not been explained satisfactorily.

For example, a Vietnamese investor incorporates a Singapore company, which in turn holds a subsidiary in a third country. If the CSP cannot trace the ultimate controller or does not understand the purpose behind the multi-tier structure, the company may be asked to provide an ownership chart, registration documents, and an explanation of the planned operations.

A multi-tier structure does not automatically equal high risk. What matters is whether you can clearly explain the ownership links, the control rights, and the commercial purpose of each entity.

The CSP must run ECDD on transactions that are unusually large, structurally complex, or lack a clear business rationale.

The CSP also needs to watch for significant changes in the transaction pattern or customer information during the service period. If new risk indicators appear, the CSP may need to re-assess the file and apply a proportionate level of due diligence.

Situations that require enhanced monitoring after a CSP begins serving a client

To reduce the chance of back-and-forth, you should be ready to document:

• The purpose of the transaction;
• The origin of the funds involved;
• The relationship between the parties;
• The economic or commercial basis for the transaction;
• The fit between the planned transaction and the company's stated business activity.

For instance, if you plan to fund your share subscription with proceeds from a share sale, the sale agreement and the receipt of payment can help show where the capital comes from.

Beyond the scenarios above, each CSP also defines additional categories of customers or transactions that warrant closer scrutiny, based on its internal risk-assessment process.

When conducting the assessment, ACRA requires the CSP to consider at least the following groups of factors:

• Customer-related: nationality, country of incorporation, PEP status, number of ownership layers, and industry;
• Country-related: the customer's home country or country of residence, and the country where the CSP operates - including the quality of financial controls, corruption levels, and political stability;
• Service and transaction-related: whether the onboarding is done remotely, whether the company has a clear business purpose, and whether a nominee is used without a stated reason;
• Singapore's overall risk landscape: Singapore publishes periodic risk assessments by country, sector, and entity type. CSPs use these as a baseline when reviewing files.

This is why the same customer can receive different document requests from different CSPs, depending on the service, the jurisdiction, and each provider's internal risk model.

A CSP supports activities such as company formation, provision of a registered address, and certain corporate-administration tasks. Because of the nature of those services, they can be exploited to conceal the true owner or the purpose behind a transaction.

That is why a CSP registered with ACRA must comply with the current rules on customer identification, risk assessment, and enhanced due diligence.

The request for additional documents is not one provider's internal policy. It is a legal requirement that applies to every high-risk file, regardless of which CSP is handling it.

On top of the standard checks, the CSP must take additional measures proportionate to the risk level:

1. Understand the purpose of the service. The CSP needs to know what business you plan to run, why you chose Singapore, and who truly owns or controls the entity;
2. Obtain senior-management approval. Under ACRA's guidance, an ECDD file must be approved by the CSP's senior management before the service starts or continues. This is an internal approval step, not a government licence application;
3. Verify source of wealth and source of funds. The CSP can request documents that evidence income, assets, and the origin of the funds used for the subscription or transaction;
4. Document the assessment in writing. The verification results and the risk-assessment rationale must be recorded for compliance purposes.

After the service begins, the CSP continues to monitor the client. For high-risk files, that monitoring is typically more frequent, and you may be asked to update information when a significant change occurs.

When you do not meet the CSP in person, the provider must apply additional verification measures under ACRA's guidance (ACRA, Guidance for CSPs, para 6.47, 2025).

Under that guidance, for a new company formation or a shelf-company purchase, the CSP must conduct a live video call with at least one of the following:

• At least one proposed director (excluding a nominee director);
• At least one proposed shareholder holding 50% or more of the shares;
• The authorised representative of that shareholder (when the shareholder is a company).

Video-call verification requirement for company formation or shelf-company transfers in Singapore

For foreign clients with a higher risk profile, the CSP may also request certified copies of identification documents.

This is why investors in Vietnam forming a Singapore company remotely may be asked to:

• Join a video call for identity verification;
• Provide a copy of the passport or identification document;
• Submit a certified copy if requested;
• Explain the shareholding structure and the actual controller;
• Provide documents on the planned business activity and the source of capital.

You should confirm the exact document list with the CSP handling your file, because the specific requirements can vary from case to case.

The CSP must finish the required due-diligence steps before it can start the service. For an ECDD file, the processing stage also includes collecting extra documents, verifying information, and obtaining management approval.

So, when the documents are not yet in, the service typically cannot begin until the file is complete.

In addition, if you are unable to provide the required information, the CSP will note the gap and follow up under its internal process.

To avoid delaying your timeline, have a direct conversation with the CSP: which documents are missing, why they are missing, and when you expect to have them. Explaining clearly from the start helps the file move faster.

Under ACRA's guidance, the CSP must retain customer-due-diligence records for 5 years from the date it stops providing the service. The file must be detailed enough to reconstruct the entire service history if a regulator asks to review it.

How long a CSP must retain customer due-diligence records in Singapore

The records can include identification documents, beneficial-owner information, source-of-funds evidence, risk-assessment results, and all notes made during the due-diligence process.

The retention requirement serves the compliance obligation and may respond to requests from a competent authority. At GLAC, your information and documents are managed in line with our Privacy and Data-Protection Policy.

The two terms are often requested together, but they do not mean the same thing:

• Source of Wealth refers to how you built your overall net worth and the origin of the capital you are subscribing. It can include business income, salary, investment gains, a property or asset sale, or an inheritance;
• Source of Funds refers to the origin of the specific sum tied to the service relationship with the CSP. For example, when forming a company or changing shareholders, it is the share-subscription amount or the share-transfer payment.

Example. An investor uses SGD 200,000 from the sale of an apartment to subscribe to a Singapore company.

In that case:

• Source of funds: the SGD 200,000 received from the apartment sale;
• Source of wealth: how the investor originally accumulated and owned the apartment - for example, from business income or savings built up over several years.

To explain this clearly, the investor may need the property sale agreement, the receipt of payment, and documents that evidence how the asset was built, depending on what the CSP asks for.

The key point: the documents must show a link between the declared financial source and the actual funds used in the transaction.

To help you prepare the right set of documents and avoid multiple rounds of follow-up, GLAC's corporate advisory experts compiled the table below, based on ACRA's guidance and our hands-on experience supporting real files:

The table above is for reference. You do not need to prepare every item if the CSP has not asked for it or if a document is irrelevant to your case.

So, rather than sending a large batch of scattered papers at once, prioritise the documents that directly answer: where the funds come from, how the wealth was built, and what the company is for.

Drawing on our experience supporting clients, GLAC's specialists recommend running through the following six points before you submit:

• Names, addresses, and document numbers match across every document;
• Non-English documents come with a certified translation;
• A short written note explains where the subscription capital or transaction funds came from;
• A clear ownership chart shows who owns the company, all the way down to the ultimate natural person;
• Documents are still valid and the scans are sharp and legible;
• You notify the CSP immediately when a shareholder or ultimate owner changes.