Independent Singapore VCC guidance
Direct answer
Choose one critical administrator output and simulate a realistic, contained disruption without affecting live investors or cash. Freeze the scenario, input set, authorised contacts, recovery route, expected output and acceptance criteria in advance. Trace source data from the VCC, manager, bank or custodian through the alternate process, then verify review, approval, delivery and archive. Record timing, manual work, errors, access gaps and decisions. A plan is not proven merely because the provider reports that its recovery system started.
At a glance
- Test an output and decision chain, not a policy document.
- Use a safe scenario with explicit boundaries and stop conditions.
- Reconcile source data, recovered output and downstream records.
- Measure manual work, access, communication and evidence gaps.
- Retest material failures before accepting closure.
Who this is for
- VCC operating teams and managers that depend on an external administrator for accounting, valuation, investor, reporting or recordkeeping outputs.
Important exclusions
- A live disaster declaration, unannounced penetration test, instruction to move real investor cash or a substitute for the provider's contractual continuity obligations.
Choose one decision-critical output
Do not begin with a broad claim that the whole administrator will be tested. Select an output that supports a real VCC decision, such as a valuation pack, dealing file, cash or position reconciliation, investor register extract, financial reporting deliverable or board report. The board's oversight remains meaningful only when it can see the source, review, exception and release path for that output. Record the VCC and sub-funds in scope and why the output matters.
Sources: Monetary Authority of Singapore · Accounting and Corporate Regulatory Authority| Candidate output | Decision supported | Useful acceptance focus |
|---|---|---|
| Valuation pack | Price release, dealing or oversight | Complete inputs, exception visibility, reviewer evidence and controlled release |
| Investor dealing file | Accept, reject or process investor activity | Cut-off evidence, eligibility status, cash match and authorised instruction |
| Cash and position reconciliation | Trading, liquidity and financial control | Source completeness, aged breaks, ownership and escalation |
| Register extract | Investor servicing, reporting or corporate record | Current records, controlled access, change history and usable format |
| Board reporting pack | Director challenge and decision | Accurate scope, open issues, source links and timely delivery |
Related guidance: VCC provider directory
Design a bounded disruption scenario
A useful scenario removes one dependency while keeping the exercise interpretable. Examples include the primary administrator contact being unavailable, the normal file-transfer route failing, a production report being inaccessible, a subcontractor missing an input or the VCC losing access to the provider portal. Define what remains available, when the clock starts, who knows it is an exercise and which events terminate the test. Avoid stacking so many failures that no single control can be assessed.
Sources: Monetary Authority of Singapore · Accounting and Corporate Regulatory Authority- State the disruptionName the unavailable person, system, data route or location and the period covered by the exercise.
- Freeze the input setList approved source files, timestamps, balances, versions and expected exceptions for later reconciliation.
- Define authorised participantsIdentify exercise controllers, provider responders, VCC reviewers, escalation owners and independent observers for the test.
- Set acceptance criteriaSpecify accuracy, completeness, review evidence, delivery point, access control and maximum tolerated manual intervention.
- Set safety boundariesProhibit live cash, investor, filing and official-book changes and define immediate stop conditions.
| Stage | Test action | Evidence captured |
|---|---|---|
| Input | Provider requests the approved alternate transfer route | Authenticated contact, channel approval and file manifest |
| Processing | Recovery team loads the frozen input set | System log, version record and exception output |
| Review | VCC reviewer compares output with control totals | Reconciliation, questions and resolved differences |
| Delivery | Provider sends the pack through the approved alternate route | Timestamp, recipient and access evidence |
| Closure | Teams restore the normal route and confirm no live data changed | Restoration check, archive and signed test outcome |
Related guidance: VCC provider exit and handover plan
Run the exercise from source to decision
Start the clock only after the controller confirms the scenario and input manifest. Let the provider follow its recovery path without coaching, while observers record contacts, approvals, handoffs, system access, manual steps and exceptions. The VCC team must also perform its side of continuity: receiving the output, authenticating the sender, reconciling control totals, reviewing exceptions and deciding whether the result is usable. Provider recovery without VCC acceptance is an incomplete test.
Sources: Monetary Authority of Singapore · Accounting and Corporate Regulatory Authority- Capture the first alert, acknowledgement, escalation and recovery-contact activation in sequence.
- Verify that alternate users have only the access needed for the exercise and that their actions are logged.
- Compare every input file and control total with the frozen manifest before accepting processing results.
- Record calculations, transformations, assumptions and manual work that differ from the normal workflow.
- Require the ordinary VCC reviewer to challenge exceptions and determine whether the output is decision-usable.
- Confirm where the recovered output, review evidence and communications are archived and who can retrieve them.
Do not hide pauses caused by exercise administration. Separate time spent on safety controls from genuine recovery delay, then report both. A provider may deliver on time by using extensive manual work, privileged access or one knowledgeable employee. Those facts are not automatic failures, but they are dependencies the VCC should understand before relying on the route during a real disruption.
Sources: Monetary Authority of Singapore · Accounting and Corporate Regulatory AuthorityRelated guidance: VCC first dealing-day rehearsal
Score evidence against acceptance criteria
Assess the exercise against the criteria fixed in advance. Separate accuracy, completeness, timeliness, access, review, communication, archive and restoration. A single overall pass can conceal a usable calculation that arrived through an insecure channel or a timely report that omitted an exception. State the consequence of each gap for the affected VCC or sub-fund and the decision the board or manager must make.
Sources: Monetary Authority of Singapore · Accounting and Corporate Regulatory Authority| Dimension | Pass evidence | Material gap example |
|---|---|---|
| Source completeness | All manifest items and versions reconcile | One custody file is missing or stale |
| Output accuracy | Control totals and expected exceptions match | Manual transformation creates an unexplained difference |
| Access control | Alternate users and channels are approved and logged | Shared credentials or uncontrolled email transfer is used |
| Review and release | Ordinary reviewer challenges and accepts the pack | Provider self-certifies without VCC review |
| Restoration | Normal route returns and test data is contained | Temporary access or parallel records remain open |
- All critical criteria passAccept the bounded scenario result, retain the evidence and set the next test based on risk and change.
- Output is usable with a controlled gapRecord the dependency, owner, remediation and retest scope before relying on the route broadly.
- Accuracy or authority failsTreat the route as unproven, contain any affected records and retest from authoritative source data.
- The scenario was not interpretableRedesign a narrower exercise rather than declaring success or failure from ambiguous evidence.
Related guidance: VCC provider service-level escalations
Close remediation and preserve the test pack
Create one indexed test pack containing the approved scenario, participants, input manifest, safety controls, communications, system logs, outputs, reconciliations, reviewer decisions, restoration evidence, gaps and remediation. Link each action to an owner and retest criterion. The pack should allow a director or successor operator to understand what was proven without relying on the people who ran the exercise.
Sources: Monetary Authority of Singapore · Accounting and Corporate Regulatory Authority- Remove temporary credentials, test files, alternate channels and exceptional access after restoration checks.
- Correct procedure, contract, contact, system or training gaps through their normal change owners.
- Retest every issue that affected accuracy, authority, access, release or restoration before closing it.
- Report accepted dependencies and residual risks to the appropriate manager and board forum.
- Feed proven recovery contacts and steps into the VCC outsourcing inventory and provider oversight plan.
Distinguish a successful bounded test from a promise that every disruption will be handled. The evidence supports only the output, scenario, systems, people and data route actually exercised. Repeat testing when material processes, platforms, subcontractors, VCC scope or provider teams change, and rotate scenarios so continuity does not depend on rehearsing the same comfortable path.
Sources: Monetary Authority of Singapore · Accounting and Corporate Regulatory AuthorityRelated guidance: administrator transition checklist
Frequently asked questions
Should the provider know that the event is a test?
For most operational exercises, yes. A controlled scenario protects live investors, cash and books and makes evidence interpretable. Surprise testing may be appropriate only within an authorised specialist programme with clear legal, security and safety controls.
Does a recovered system mean the test passed?
No. The VCC must also receive the correct source data, review the recovered output, resolve exceptions, authenticate the delivery, make the intended decision and confirm restoration without unauthorised changes or residual access.
Can one exercise test every administrator service?
That usually produces ambiguous results. Choose one decision-critical output and one primary disruption, then test it end to end. Rotate later exercises across valuation, dealing, reconciliations, registers, reporting and other important dependencies.
What is the strongest continuity evidence?
Use a complete pack showing the approved scenario, source manifest, safety controls, communications, system actions, recovered output, independent reconciliation, reviewer decision, restoration, gaps, remediation owners and the results of any required retest.
When should a failed item be closed?
Close it only after the underlying procedure, access, system, contract or training issue is corrected and the relevant acceptance criterion is successfully retested. A provider assurance or future target date is not evidence that the route now works.
Official sources and further reading
- Legal obligations of a VCC director (Accounting and Corporate Regulatory Authority)
- Overview of managing a variable capital company (Accounting and Corporate Regulatory Authority)
- Post-registration guide for variable capital companies (Accounting and Corporate Regulatory Authority)
- Governance and Management of Variable Capital Companies (Monetary Authority of Singapore)
Discuss a Singapore VCC structure
For help coordinating a Singapore VCC setup or corporate administration, contact Raffles Corporate Services.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.