Independent Singapore VCC guidance
Direct answer
After a trading or compliance system release, do not prove readiness with one successful order. Freeze the approved mandate and rule inventory, map every changed component, then test permitted, blocked and boundary cases using controlled data. Verify instrument classification, exposure calculations, user permissions, override routing and evidence capture. Release only when expected and actual results agree, unresolved defects have an authorised treatment, and production monitoring can identify drift from the tested configuration.
At a glance
- Test the mandate meaning, not only whether the software runs.
- Include allowed, prohibited, boundary and incomplete-data scenarios.
- Treat reference data, permissions and overrides as part of the rule.
- Compare production behaviour with the approved test baseline.
Who this is for
- VCC managers changing an order-management, portfolio, risk or investment-compliance system that enforces mandate controls.
Important exclusions
- This checklist does not replace the manager’s technology-risk framework, vendor assurance or legal interpretation of investment terms.
Freeze the rule and release perimeter
Start with a versioned list of what is changing: code, configuration, market data, security master, portfolio feed, user role, interface or report. Link each affected rule to the governing investment term and the person who approved its interpretation. A broad release note such as improved compliance logic is not enough. The test owner needs to know which VCC, sub-fund, share class and strategy uses the rule, which orders it can affect, and which downstream decisions depend on its result. Keep unchanged high-risk rules in the regression set because shared components can alter them unexpectedly.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Accounting and Corporate Regulatory AuthorityRelease perimeter
- Identify the exact code, configuration, data and permission changes included in the release.
- Map each affected rule to its mandate source and approved interpretation.
- List every VCC mandate, sub-fund, market and instrument population using the changed component.
- Name the test owner, independent reviewer, defect decision-maker and production release owner.
- Preserve the prior configuration and a workable rollback route.
Design cases around decision boundaries
A reliable test pack proves both outcomes around each decision boundary. For a concentration rule, use a case below the limit, at the boundary, above the limit, and with a missing denominator or stale holding. For an eligibility rule, include an allowed security, a prohibited security, a misclassified security and an instrument whose status changed. Keep expected results independent of the system being tested. If the same rule engine creates both the result and the expected answer, the test can repeat the defect without exposing it.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore| Case type | Purpose | Evidence |
|---|---|---|
| Permitted case | Shows valid orders remain usable | Input, expected pass and actual result |
| Blocked case | Shows a clear breach is prevented or escalated | Input, expected block and message |
| Boundary case | Tests rounding, timing and exact threshold behaviour | Calculation and precision settings |
| Incomplete-data case | Tests safe treatment when a dependency is absent | Missing field and resulting control action |
| Changed-status case | Tests refreshed classifications and effective dates | Old value, new value and source timing |
Related guidance: designated-investment pre-trade gate
Test data lineage and calculation inputs
Many apparent rule failures begin outside the rule engine. Trace positions, cash, prices, ratings, issuer groups, currency rates, derivative exposure and mandate attributes from source to test result. Check effective times and cut-offs, not merely field values. A correct rule applied to yesterday’s holdings can still create a wrong decision. Reconcile totals before testing individual orders, and prove that umbrella VCC sub-funds remain separately identified throughout every interface. Where an external provider supplies data, retain the file, receipt time, validation result and exception treatment used in the test.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Accounting and Corporate Regulatory AuthorityInput assurance sequence
- IdentifyList every source field and transformation used by the changed or regression-tested rule.
- ReconcileCompare holdings, classifications and totals with an independent source before running orders.
- DisturbIntroduce stale, missing, duplicated and misclassified inputs to confirm the safe response.
- RestoreReload approved data and prove that the corrected input produces the expected outcome.
Challenge overrides and user permissions
A release can leave the blocking rule intact while weakening who can override it. Test the real user roles that propose, approve, reject and release an exception. Confirm that the investment decision-maker cannot silently approve their own deviation when independent challenge is intended. Use an expired user, an unauthorised desk, a cross-mandate user and an emergency account as negative cases. The evidence should show the warning presented, rationale captured, approver identity, time, affected order and downstream reporting. Temporary access should expire in the test exactly as designed.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeOverride evidence
- The user can access only the mandates and functions assigned to the approved role.
- A blocked rule cannot be bypassed through an alternate screen, interface or batch upload.
- The exception captures rationale, owner, approval and the exact affected order.
- Independent approval works for the intended scenarios and rejects self-approval.
- Temporary or emergency permissions expire and appear in the review record.
Related guidance: investment mandate breach response
Approve release with explicit defect treatment
Classify each defect by decision impact, affected mandates, likelihood, detectability and workaround reliability. A cosmetic label issue is different from a calculation or entitlement error, but low-volume exposure is not a reason to ignore a control defect. The release owner should see the failed case, root cause, temporary treatment, monitoring owner and repair commitment. If the workaround depends on a manual check, test the check with the same care as the automated rule. Do not close a defect because a vendor plans to fix it later.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeRelease decision
- All critical cases passApprove the release with recorded evidence and enhanced observation of the first production cycle.
- A safe workaround existsDocument its scope, owner, operating capacity, independent check, evidence and expiry before granting conditional approval.
- The defect can misstate or permit a decisionHold the affected component or mandate and use the tested rollback route.
- The impact is uncertainTreat the uncertainty as unresolved until additional testing establishes a reliable and reviewable impact perimeter.
Related guidance: VCC compliance monitoring plan
Reconcile the first production cycle
Production approval is not the final control point. Compare the first live orders, alerts, overrides and reports with the tested baseline. Confirm that the deployed version, rule inventory, data feeds and permissions match what was approved. Review near-boundary cases, because they expose precision and timing differences faster than obvious breaches. Track unexpected changes in alert volume or override use and investigate them before tuning. Close the release only when production evidence is stable, defects are resolved or governed, and the support team can reproduce the deployed configuration.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeRelated guidance: trade amendment and cancellation review
Frequently asked questions
Should every rule be retested after every release?
Use the change map to select affected rules and maintain a risk-based regression set for shared components. High-impact rules can fail even when their own configuration did not change, because reference data, interfaces, calculation libraries or permissions may have changed underneath them.
Is one blocked order enough to prove a rule works?
No. Test permitted, prohibited, boundary and incomplete-data cases. A rule can block the obvious breach yet mishandle rounding, stale holdings, changed classifications or a valid order. Expected results should be calculated independently from the system under test.
Who should approve a rule interpretation?
Use the authority defined by the manager’s governance model, with compliance, investment, operations or legal input appropriate to the question. The person coding a rule should not silently decide ambiguous mandate meaning. Retain the approved interpretation with the test evidence.
Can a manual workaround support release?
Only when its scope, capacity, owner, evidence and expiry are clear and it has been tested. A vague promise to watch orders is not a control. If the workaround cannot reliably prevent or detect the affected decision, hold the release or affected mandate.
When is post-release monitoring complete?
After enough production activity has demonstrated that the deployed version, data, permissions, alerts and overrides behave as approved. Closure should also show that defects and temporary controls have an authorised disposition, not merely that the system remained available.
Official sources and further reading
- Risk Management Practices for Fund Management Companies (Monetary Authority of Singapore)
- Frequently Asked Questions on the Notice on Technology Risk Management (Monetary Authority of Singapore)
- Guideline on Licensing and Conduct of Business for Fund Managers (Monetary Authority of Singapore)
- Choosing Directors and Key Officers for a VCC (Accounting and Corporate Regulatory Authority)
- Understanding VCC Features, Eligibility and Requirements (Accounting and Corporate Regulatory Authority)
Discuss a Singapore VCC structure
For help coordinating a Singapore VCC setup or corporate administration, contact Raffles Corporate Services.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.