Insurance & Insurtech Compliance in Singapore

Singapore is open to digital insurers, but there is no light-touch route: insurance, intermediation and life-policy advice are all licensed, and the online channel inherits the full anti-money laundering (AML) and conduct rulebook.

MAS is the single regulator for insurers, brokers and financial advisers. Suspicious transaction reports go to the Suspicious Transaction Reporting Office (STRO) of the Singapore Police Force.

For a new entrant the main hurdle is the licence; for a digital distributor, a remote onboarding and payout flow MAS accepts as equivalent to face-to-face.

1. Who regulates this sector

2. Licensing and authorisation

The Insurance Act 1966 splits insurance business into life business (life policies and long-term accident and health policies) and general business (section 3). "Insurance business in Singapore" means assuming risk under policies together with receiving proposals for, issuing, or collecting premiums on policies in Singapore (section 2). No one may carry on any class of insurance business in Singapore as an insurer without an MAS licence for that class (section 4(1)); licences are granted under section 11, and foreign insurers may also operate through a foreign insurer scheme under Part 2A. Applicants must be companies or co-operatives meeting prescribed financial requirements (section 11(3)); minimum paid-up capital is S$10 million for a direct insurer, S$5 million if it writes only investment-linked or only short-term accident and health business, and S$25 million for a reinsurer (Insurance (Valuation and Capital) Regulations 2004, regulation 3). Breaching section 4(1) is an offence carrying a fine of up to S$250,000 for a company, or up to S$125,000 and 3 years' imprisonment for an individual, plus daily fines for continuing offences (section 4(5)).

Section 2 defines an insurance agent as anyone who, for an insurer, receives proposals, issues policies, collects premiums or arranges insurance in Singapore; a broker does the same for insureds. Brokers register with MAS (section 76) and need paid-up capital of S$300,000 per type of broking business (MAS Guidelines IA/II-G04, paragraph 4.2).

Advice and life distribution add a second licence. Under the Financial Advisers Act 2001, a company that arranges life policies, or advises on investment products (which include life policies), must hold a financial adviser licence unless an exemption applies, and its individual sellers must be appointed representatives (MAS, Financial advisers). Licensed direct life insurers and registered brokers are exempt financial advisers. A new licensee needs base capital of S$500,000 (or S$300,000 with extra professional indemnity cover), a Singapore-resident CEO and at least one resident director (MAS, FA licence).

3. AML, KYC and customer due diligence

The AML regime for insurance depends on the product line and the type of firm:

Direct life insurers (life policies)

MAS Notice 314, issued under section 16 of the Financial Services and Markets Act 2022 (FSMA). It is legally binding and in force from 1 July 2025.

General insurers, reinsurers, accident and health

MAS Guidelines dated 1 July 2025. Breaching guidelines is not an offence, but observance affects MAS's risk assessment of the insurer.

Financial advisers and exempt brokers

Notice FAA-N06, in force from 1 July 2025. It covers licensed financial advisers and registered insurance brokers exempt under section 20(1)(c) of the Financial Advisers Act 2001.

There is no threshold for life business: due diligence applies on every new relationship, on suspicion, and when earlier information is in doubt (Notice 314, paragraph 6.3).

What life insurers must collect and verify

For individuals, paragraph 6.5 requires five data points: full name and any aliases, unique identification number (identity card, birth certificate or passport number), residential address, date of birth and nationality. Identity must then be verified "using reliable, independent source data, documents or information" (paragraph 6.8).

Corporate customers require extra steps:

• Identifying connected parties and beneficial owners (paragraphs 6.7 to 6.16D).
• Understanding the ownership and control structure (paragraph 6.18).
• Verifying the authority of anyone acting for the customer, which may be done by "electronic means of verification" (paragraph 6.12).

Enhanced due diligence is mandatory for politically exposed persons (PEPs), their family members and close associates. It requires senior management approval (including before paying a beneficiary), establishing source of wealth and source of funds, and enhanced monitoring (paragraph 8.3). Each beneficiary counts as a risk factor (paragraph 8.7A).

Reporting, sanctions and records

Life insurers must screen customers, representatives, connected parties and beneficial owners against ML/TF information sources and the lists provided by MAS and other Singapore authorities, at onboarding, periodically and when lists change (Notice 314, paragraphs 6.43 and 6.44). MAS maintains the designated persons lists. ACRA's register of registrable controllers helps with corporate beneficial ownership.

• Suspicious transactions. Anyone who knows or has reasonable grounds to suspect that property is connected to crime must file an STR under section 45 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 (CDSA). An STR also meets the terrorism financing disclosure duty in sections 8 and 10 of the Terrorism (Suppression of Financing) Act 2002 (TSOFA) (STRO).
• Life insurer STRs. Report suspicious and attempted transactions regardless of amount (Notice 314, paragraph 12.2), within 5 business days of suspicion, or 1 business day where sanctioned parties are involved (Guidelines, paragraph 12-1).
• Sanctions hits. General insurers that get a positive sanctions hit must freeze the assets without delay, report the freeze to MAS and file an STR no later than one business day (non-life Guidelines, paragraph 5.8).
• Record retention. Due diligence and transaction records must be kept for at least 5 years after the relationship ends or the transaction completes (Notice 314, paragraph 10.3).

4. Identity verification and onboarding

Notice 314 sets a standard (reliable, independent source data) but lists no approved documents, digital methods, or liveness standards. The Guidelines add:

• Documents must be current and legible, especially without face-to-face contact (paragraphs 6-5-5 and 6-5-8).

Verification must be completed before the policy is issued (paragraph 6.35). It may be deferred only where deferral is essential to normal business and the risk is managed (paragraph 6.36). MAS expects limits on what the customer can do meanwhile. The relationship should be suspended if verification is still incomplete after 30 business days and ended after 120 business days (Guidelines, paragraphs 6-13-1 and 6-13-2).

Life policies have a second verification point at payout:

• Beneficiaries are named or described when designated, but verified, with their beneficial owners, at the time of payout (paragraphs 6.9, 6.10 and 6.38).
• A payee who is not the customer must be identified and verified when a claim, surrender value or premium refund is paid (paragraph 6.21).
• Payees and beneficiaries must be screened at payout (paragraph 6.45).
• If due diligence cannot be completed, the insurer must not commence or continue the relationship, including making any payment, and must consider an STR (paragraph 6.39).

An insurer may rely on another regulated financial institution's due diligence, but not for ongoing monitoring, and it remains responsible (paragraphs 9.2 to 9.5). This reliance framework does not cover sales through the insurer's own agents or outsourcing (Guidelines, paragraph 9-1).

5. Digital channels: what's different

Bottom line: online life sales are permitted, even without advice, but MAS requires remote due diligence to be at least as robust as face-to-face, adds anti-impersonation checks, and attaches specific disclosure and security safeguards to the online channel.

Non-face-to-face due diligence

Notice 314 requires policies for the specific risks of non-face-to-face business and due diligence "at least as robust" as face-to-face (paragraphs 6.31 to 6.33). The Guidelines treat internet applications as potentially higher risk than other remote business because of:

• easy unauthorised access across time zones and locations;
• cheap, hard-to-detect multiple fictitious applications;
• the absence of physical documents; and
• the speed of electronic transactions.

Where identity is verified electronically, MAS expects additional anti-impersonation checks, such as contacting the customer on an independently verifiable number, confirming the address, or requiring the first premium from the customer's own Singapore bank account (paragraphs 6-11-1 to 6-11-3). New channels and technologies must be risk-assessed before launch (paragraphs 5.1 to 5.3).

Selling without advice

MAS Guideline ID 01/17 (last revised 26 March 2024) lets direct life insurers offer all types of life policies on their own online channel without advice. Before purchase, the insurer should:

• provide product documents and full policy wording;
• offer the equivalent direct purchase insurance product where one exists;
• obtain acknowledgement of any conditional acceptance; and
• show prompts, including that a life policy is not a savings account and that there is a 14-day free-look period.

Financial advisers follow the parallel FAA-G15.

Embedded and platform distribution

A platform that receives proposals, collects premiums or arranges insurance on an insurer's behalf is likely to fall within the Insurance Act definition of an insurance agent (section 2), so the partnership model should be checked with counsel. Insurance agents other than individuals and certain exempt persons are covered by the MAS cyber hygiene Notice.

Security of the online channel

ID 01/17 expects strong authentication to protect customer data, transactions and systems, plus business continuity for the online channel (paragraph 15). Notice FSM-N04 (in force 10 May 2024) makes multi-factor authentication mandatory for critical-system administrator accounts and for all accounts on systems used to access customer information through the internet (paragraph 4.6).

6. Data protection and biometrics

The Personal Data Protection Act 2012 (PDPA) is the general regime. Notice 314 adapts it for AML purposes:

• A life insurer may collect, use and disclose the personal data of customers, beneficiaries, beneficial owners and payees without their consent, directly or through a third party, to comply with the Notice (paragraph 11.4).
• Individuals' access and correction rights are narrowed to their core identification data and data they themselves provided (paragraphs 11.2 and 11.3).

No MAS insurance instrument sets rules for biometric data captured during onboarding. The PDPC's biometric data guide (May 2022) treats facial images linked to an individual as personal data and recommends liveness detection, encryption and deletion once the purpose ends. It targets security applications, so treat it as best practice.

The NRIC (National Registration Identity Card) number is an identifier, not proof of identity. A joint PDPC and CSA advisory (issued June 2025, updated May 2026) tells organisations to stop using full or partial NRIC numbers to authenticate people, including as default passwords. It also warns that someone who can state an NRIC number may not be that person. Customer portals and claims journeys should authenticate by other means.

7. Sector-specific obligations

General insurance screening

For general and reinsurance business, the screening population is defined by the non-life Guidelines:

• Who is screened. Policy owners, insured persons and claimants; for higher-risk customers, also shareholders, beneficial owners, directors and representatives (paragraph 5.2).
• When. Before onboarding, before renewal, when lists change, and before claim payments (paragraph 5.4).
• How often. At least every six months for these mostly annual policies (paragraph 5.4, footnote 13).
• Matching logic. Fuzzy, not exact, matching (paragraph 5.7).
• Third-party claimants. Where the claimant is not the customer, the payee must be identified and verified before payment (footnote 15).

Agents, advisers and brokers

Life insurers must screen agents and officers when hiring and train them (Notice 314, paragraph 13.13; Guidelines, section 13-5). General insurers should run background, credit, bankruptcy and ML/TF (money laundering and terrorism financing) checks on agents and offshore intermediaries (non-life Guidelines, paragraph 5.9).

Direct purchase insurance

MAS Notice 321 requires most direct life insurers to offer direct purchase insurance (DPI): simple term and whole life products priced without distribution costs and named with the prefix "DIRECT" (paragraphs 4 to 9). Its latest amendments took effect on 1 October 2025.

8. Risk indicators and red flags

Insurance typologies flagged by MAS

• Early surrender at a loss: redemption when the surrender value is below premiums paid.
• Free-look abuse: abnormal use of cancellation or cooling-off rights to recover funds.
• Unexplained single premiums: a large single-premium purchase out of line with the customer's means or history.
• Third-party funding: premiums paid by unconnected third parties, or overpayments refunded to a third party or abroad.
• Agent anomalies: outsized single-premium volumes, or agents' addresses on customer documents.
• Quick surrenders by young or charity-funded buyers: a possible terrorism financing sign.

Sources: Guidelines to Notice 314, Appendix B; non-life Guidelines, paragraph 2.4. In September 2026 MAS barred a former insurance sales representative who forged customers' bank statements to pass eligibility checks (MAS, 25 September 2026).

9. Enforcement and penalties

A financial institution that fails to comply with an applicable MAS AML Notice commits an offence under the FSMA. The maximum fine is S$1 million per offence, plus up to S$100,000 for every day a continuing offence continues after conviction (MAS, Anti-Money Laundering).

MAS also uses prohibition orders against individuals. In 2026 these included a 10-year order against a former insurance representative convicted of cheating (6 July 2026) and a 6-year order against a former financial adviser representative convicted of forgery and computer misuse offences (3 August 2026) (MAS, Q3 2026 enforcement summary).

The most relevant AML case against an insurer is from June 2023, when MAS imposed a S$200,000 composition penalty on Swiss Life (Singapore). The breaches concerned an investment-linked policy: the insurer failed to understand why a higher-risk customer had a complex ownership structure and did not adequately corroborate the beneficial owner's source of wealth (MAS, 21 June 2023).

The May 2026 FATF mutual evaluation notes Singapore rates its 25 life and composite insurers low risk; their 6,393 STRs (2020 to 2024) may partly be defensive.

10. Recent changes and what to watch

• 30 September 2026 [Proposed, comments close 9 Dec 2026] MAS consultation P016-2026 on corporate governance regulations for banks and insurers (board composition, independence, key appointments).
• 7 July 2026 [Proposed, consultation closed 7 Aug 2026] Proposed protected cell company framework for captives, insurance-linked securities and risk pools.
• June 2026 [Proposed, comments closed 31 Jul 2026] Amendments to MAS technology risk management Notices, including the insurers' Notice.
• May 2026 [Published] FATF and Asia/Pacific Group mutual evaluation of Singapore.
• 1 October 2025 [In force] Amendments to MAS Notice 321 on direct purchase insurance products.
• 1 July 2025 [In force] Reissued MAS Notice 314 with new Guidelines, reissued Notice FAA-N06, and revised non-life AML Guidelines. Firms should re-map their controls, including source of wealth, screening and STR timelines.

11. What this means for identity verification

• Capture all five data points. Collect name, identification number, residential address, date of birth and nationality for every individual policy owner and anyone acting for them.
• Layer anti-impersonation controls on remote journeys. MAS lists no approved methods, so document why yours is at least as robust as face-to-face.
• Re-verify at payout. Verify and screen beneficiaries, their beneficial owners and third-party payees, and hold payment until done.
• Build deferral limits into the product. If verification is deferred, enforce transaction limits and the 30 and 120 business day cut-offs.
• Screen on a schedule. Onboarding, renewal, list updates and claims.
• Authenticate properly. Use multi-factor authentication, not NRIC numbers, and keep evidence for at least 5 years.