How MAS Notice 626 Makes Transaction Monitoring a Group-Wide Control for Singapore Banks

MAS Notice 626 transaction monitoring requirements sit in a short run of paragraphs, and they are easy to underestimate. Notice 626 is issued under section 16 of the Financial Services and Markets Act 2022 and applies to all banks in Singapore. It took effect on 1 April 2024 and was last revised with effect from 1 July 2025.

Ongoing monitoring is in paragraphs 6.19 to 6.26. Beyond them, the Notice reaches into COSMIC, wire transfers, reliance on third parties, group policy, record keeping and audit, which is where monitoring stops being a system and becomes a control that has to work across a bank group.

One note on citations. Some industry guides place ongoing monitoring in paragraph 11 of the Notice. Paragraph 11 covers wire transfers. Ongoing monitoring is paragraph 6, Part (VI).

Paragraphs 6.19 to 6.26 set the monitoring duties; COSMIC, group policy, records and audit then determine whether they hold across a group.

What paragraphs 6.19 to 6.26 require

Paragraph 6.19 requires a bank to monitor its business relations with customers on an ongoing basis. Paragraph 6.20 asks it to observe the conduct of the customer’s account and scrutinise transactions so that they stay consistent with the bank’s knowledge of the customer, its business and risk profile and, where appropriate, the source of funds. Paragraph 6.21 requires special attention to complex, unusually large or unusual patterns of transactions that have no apparent or visible economic or lawful purpose.

Paragraph 6.22 sets the system requirement: adequate systems and processes, commensurate with the size and complexity of the bank, to monitor business relations and to detect and report suspicious, complex, unusually large or unusual patterns. Paragraph 6.23 requires the bank, to the extent possible, to inquire into the background and purpose of those transactions and document its findings. Paragraph 6.24 requires CDD information to be kept up to date through reviews, particularly for higher-risk customers. Paragraphs 6.25 and 6.26 cover customers a bank retains despite reasonable grounds for suspicion: the bank must document its reasons, apply commensurate risk mitigation including enhanced ongoing monitoring and, where it assesses higher risk, obtain senior management approval.

How COSMIC enters the monitoring decisions

Notice 626 builds COSMIC into monitoring. A bank participating in COSMIC that receives information about a customer, its business, risk profile or source of funds must treat that information as part of its knowledge of the customer (paragraph 6.20). It must take information received through COSMIC into account when deciding whether transactions are complex, unusually large or part of an unusual pattern (6.21), when determining whether a customer is a politically exposed person or a family member or close associate of one (8.2), and when assessing whether a customer presents a higher risk (8.5).

The Notice also keeps the COSMIC platform screening list separate. Paragraph 6.43(b) excludes it from the lists and information provided by MAS and other authorities for screening purposes. In practice, a bank needs to be able to show where COSMIC information entered each of those four decisions, and where it did not.

Reliance on third parties and group policy

Paragraph 9.3 states that no bank shall rely on a third party to conduct ongoing monitoring of business relations with customers, and paragraph 9.5 confirms that a bank remains responsible for its AML/CFT obligations even where reliance is permitted for other measures. Banks that run alert review from a regional hub should be clear which accountability stays with the bank.

For a bank incorporated in Singapore, paragraph 15.4 requires a group AML/CFT policy that meets all requirements of the Notice and extends to branches and subsidiaries in its financial group. Paragraph 15.7 requires group-level compliance, audit and AML/CFT functions to receive customer, account and transaction information from branches and subsidiaries when needed for risk management, and paragraph 15.7A adds that the information to be shared includes any information and analysis of transactions or activities that appear unusual. Where host-country requirements differ, paragraph 15.8 requires overseas branches and subsidiaries to apply the higher of the two standards, to the extent local law permits.

Records, audit and wire transfers

Paragraph 12.2 requires records to be kept so that any individual transaction can be reconstructed, so that MAS and the bank’s internal and external auditors can review business relations, transactions and CDD information and assess compliance, and so that enquiries from authorities can be answered within a reasonable time. Paragraph 12.3 sets a minimum retention of five years following termination of the business relations or completion of the transaction. Paragraph 15.12 requires an adequately resourced, independent audit function able to assess regularly the effectiveness of the bank’s internal policies, procedures and controls.

For wire transfers, paragraph 11.10 asks beneficiary institutions to take reasonable measures, including post-event monitoring or real-time monitoring where feasible, to identify cross-border wire transfers that lack the required originator or beneficiary information. Paragraph 11A.12 says the same for value transfers.

Four checks before the next audit or MAS inspection

The Notice rewards banks that can show how a signal moved through the programme. Four checks help.

How Nexiant supports group-wide monitoring

FraudShield, Nexiant’s specialist transaction-monitoring brand, is built around real-time detection, configurable rule logic and case-management workflows. For a Singapore bank group reading paragraphs 6.22, 12.2 and 15.7A together, the tests for any monitoring capability are whether findings under paragraph 6.23 are documented in one place, whether COSMIC information can be traced into the decisions in paragraphs 6.20 to 8.5, and whether unusual-activity analysis can reach group functions without manual reconstruction.

Frequently Asked Questions

This article was accurate at the time of publication in October 2026 and is intended for general informational purposes only. It does not constitute legal, regulatory or compliance advice. Organisations should seek qualified professional guidance in relation to their specific obligations.