Independent Singapore VCC guidance
Direct answer
Quarantine every standing settlement instruction change until it is independently authenticated against a trusted contact and approved authority record. Identify the exact VCC, sub-fund, account, market, currency, asset type and effective date, then review pending trades and cash movements that could be affected. Use maker and checker separation to update the manager, broker, custodian and administrator records, compare the final values across systems, and place heightened review on the first transaction. Close only when settlement, cash, position and accounting records reconcile.
At a glance
- Treat a static-data change as a high-impact transaction, not routine maintenance.
- Authenticate through a trusted route that does not rely on the incoming request.
- Map the change to the exact VCC and sub-fund before touching downstream systems.
- Reconcile the first use through settlement, cash, positions and the fund books.
Who this is for
- VCC managers and providers changing broker, custodian, bank or administrator settlement details for a mandate or sub-fund.
Important exclusions
- A substitute for the governing account agreement, provider procedure, fraud response or legal advice on disputed ownership.
Scenario: an urgent instruction arrives by email
Assume operations receives an email appearing to come from a familiar provider contact. It asks that future foreign-currency settlements for one sub-fund use a different correspondent account and says the next trade is urgent. The message contains plausible names and references, but the change is not visible in the provider portal. The safe response is to open a static-data case, stop the email from becoming an operational instruction, preserve the original message and identify every pending transaction that could use the disputed route.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of Singapore| Field | Worked-scenario entry | Why it matters |
|---|---|---|
| Affected entity | Named VCC, sub-fund and account remain unconfirmed | Prevents an umbrella-level change being copied to unrelated funds |
| Requested change | Correspondent and beneficiary details differ from current master | Shows exactly which fields carry diversion risk |
| Timing | Requester links change to an approaching settlement | Separates real urgency from pressure that bypasses control |
| Pending activity | Open currency settlement may call the standing record | Supports a targeted hold before money moves |
| Evidence state | Email preserved; independent confirmation outstanding | Keeps suspicion and confirmed fact separate |
Authenticate outside the incoming message
Use contact details already held in an approved master, executed agreement or independently controlled provider directory. Do not reply to the email, call a number in the attachment or use a link supplied by the requester as the sole verification route. Confirm the identity and authority of the requestor, the reason for change, complete field values, affected accounts, effective date and whether any parallel communication exists. Where the provider has an authenticated portal or formal change document, reconcile that evidence with the verbal confirmation rather than treating one signal as sufficient.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeIndependent authentication checks
- Use a trusted contact route established before the change request was received.
- Confirm the requestor role and authority for the exact account and instruction type.
- Read back changed values without inviting a simple confirmation of attacker-supplied data.
- Match the change with provider portal, signed document or other controlled evidence where available.
- Record the verifier, time, route, responses and any inconsistency that remains unresolved.
Related guidance: VCC payment approval control
Map scope before editing static data
Create a field-level comparison between the current and proposed records. Include legal account name, VCC and sub-fund identifier, custodian or broker entity, account number, beneficiary, bank and correspondent details, currency, market, asset type, settlement location, message format, effective date and termination of the old route. Determine whether the same record is reused across mandates or copied by an interface. A narrowly worded change can propagate widely when a shared template or account alias sits above several sub-funds.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Accounting and Corporate Regulatory AuthorityReview pending trades, subscriptions, redemptions, distributions, margin, collateral and fee payments for the affected record. Decide whether each item should remain on the old route, move after approval or be held. Communicate a targeted hold to relevant operators and providers without exposing sensitive details more widely than necessary. Document the decision for transactions near cut-off. A static master should not be updated simply because the next settlement would otherwise fail; the failure risk is visible and governable, while misdirection may be harder to recover.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeRelated guidance: investor payout instruction change control
Approve and implement with separated roles
The preparer should assemble authenticated evidence and proposed field changes. A checker should compare them with the trusted source, confirm scope, examine pending activity and approve the implementation route. The person editing static data should not be able to create the request, authenticate it and release the first payment alone. Where small teams require combined duties, add an external or senior independent verification and system hold. Record exact values and system timestamps; screenshots without readable context are weaker than an export or audit log tied to the case identifier.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeCoordinated implementation
- Lock the approved recordFreeze the authenticated values, scope, effective date, pending-item treatment and authorised approvers.
- Update controlled mastersChange manager and provider systems through named users while retaining the prior version and audit trail.
- Compare downstream valuesExport and reconcile broker, custodian, administrator and accounting mappings before first operational use.
- Release targeted holdsRemove only the holds supported by completed evidence and communicate the effective route clearly.
Reconcile the first use end to end
Select the first transaction using the changed record for heightened review. Before release, compare the populated instruction with the approved case and confirm the VCC, sub-fund, account, amount, currency, beneficiary and settlement path. After completion, obtain broker or custodian status, bank or cash evidence, position movement, administrator booking and general-ledger result. Check fees, foreign-exchange effects and any manual repair. A successful external settlement is not enough if it was booked to the wrong sub-fund or left an unreconciled cash balance.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeFirst-use assurance
- Pre-releaseCompare the generated instruction with the locked approved fields and active mandate authority.
- Provider acceptanceConfirm the intended legal entity and account accepted the message without repair or substitution.
- Value movementVerify cash or assets reached the authorised destination and match the expected value date.
- Books closureReconcile position, cash, fees and accounting entries for the correct VCC and sub-fund.
Related guidance: VCC cash exception reconciliation
Escalate mismatches and preserve the old record
Any failed authentication, unexplained beneficiary, last-minute value change, provider disagreement, unsupported urgency or transaction on the wrong route should stop ordinary implementation and enter the incident path. Preserve the email, headers, call notes, portal evidence, system logs, approvals and transaction status. Notify the relevant security, compliance, operations and governance owners according to the facts. Do not repair by overwriting the record again. Retain the prior version and every attempted change so the chronology can support recovery, investigation and wider control testing.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeRelated guidance: VCC service-provider incident response
Frequently asked questions
Can a trusted email address approve the change?
Email origin alone should not be the sole control. Use a trusted route and authority record established independently of the incoming request, then reconcile complete changed values with controlled provider evidence and the approved account scope.
Should every pending trade be cancelled?
Not automatically. Identify each affected transaction and choose a controlled treatment based on its instruction route, status, cut-off, settlement risk and the unresolved change. A targeted hold is usually clearer than an unanalysed blanket action.
Who should perform the callback?
Use a trained person who is independent of the request creation and who can access the trusted contact record. The verifier should understand the fields being confirmed and record the route, identity, authority, responses and inconsistencies.
When can the old instruction be deleted?
Do not erase it merely because the new record is active. Retain the prior version, effective history, change evidence and transaction linkage according to applicable retention and system-control requirements so later settlements and disputes can be reconstructed.
What closes the instruction-change case?
Closure needs authenticated authority, approved scope, reconciled system masters, resolved pending items, verified first use, correct cash and position booking, retained history and no unexplained mismatch. A provider confirmation without fund-book reconciliation is incomplete.
Official sources and further reading
- Technology Risk Management Guidelines (Monetary Authority of Singapore)
- Risk Management Practices for Fund Management Companies (Monetary Authority of Singapore)
- Guideline on Licensing and Conduct of Business for Fund Managers (Monetary Authority of Singapore)
- Guidelines on Individual Accountability and Conduct (Monetary Authority of Singapore)
- VCC Features, Eligibility and Requirements (Accounting and Corporate Regulatory Authority)
Discuss a Singapore VCC structure
For help coordinating a Singapore VCC setup or corporate administration, contact Raffles Corporate Services.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.