Independent Singapore VCC guidance
Direct answer
Open a controlled offboarding case as soon as the departure or role change is confirmed. Map every VCC mandate, decision right, system account, provider portal, communication channel and open item connected to the person. Transfer unfinished work before removing authority, but block new instructions where risk requires it. Revoke access across the manager and all providers, update contact and approval records, then have an independent reviewer reconcile the completed actions to the original exposure map before the case is closed.
At a glance
- Treat departure as a mandate-control event, not only a human-resources task.
- Separate transfer of unfinished work from removal of future authority.
- Revoke provider and emergency access as well as the manager login.
- Close only after an independent reconciliation finds no unexplained access or ownership.
Who this is for
- Fund managers, VCC boards and providers handling a departure, internal transfer, suspension or material change in mandate authority.
Important exclusions
- Employment-law advice, dismissal procedure or a substitute for incident response where misconduct or data loss is suspected.
Open one case around the mandate exposure
Start with the person and work outward. Record the employing entity, role, effective change, VCCs and sub-funds covered, investment powers, cash or data authority, committee membership, delegated approvals, substitute arrangements and every system or provider used. Include shared accounts, emergency credentials, local files, mobile applications and informal distribution lists. A job title alone will miss rights accumulated through projects, provider onboarding and temporary cover. The case owner should distinguish confirmed access from access still being investigated so uncertainty remains visible.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of Singapore| Area | Evidence to locate | Closure question |
|---|---|---|
| Investment authority | Mandates, committee terms and approval matrices | Can the person still initiate, approve or influence a decision? |
| Operating access | Identity system, trading, research and document repositories | Are named, shared and emergency routes accounted for? |
| Provider access | Administrator, custodian, broker and data portals | Has each provider implemented and confirmed the change? |
| Work in progress | Orders, exceptions, reviews and investor deliverables | Does a named successor accept every open item? |
| Official status | Representative register and controlled contact records | Do applicable records reflect the current role? |
Choose the control state before the final day
The correct control state depends on the facts. An orderly planned departure may allow supervised handover while ordinary authority continues for a short, defined period. A suspension, conflict, investigation or unexpected absence may require an immediate targeted freeze. Decide separately for trading, portfolio changes, cash instructions, document edits, approvals, external communication and access to sensitive information. Record who made the decision and why. Avoid an all-or-nothing label that either disrupts safe operations unnecessarily or leaves a high-risk route open.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeControl-state decision tree
- Orderly role changePermit only defined handover activity, monitor use and set an unambiguous authority end point.
- Unexpected absenceActivate approved cover, pause unsupported decisions and preserve the person records without altering them.
- Conduct concernRestrict relevant authority and information promptly while preserving evidence and investigation independence.
- Unknown exposureUse a conservative temporary restriction until systems, providers and delegated rights have been reconciled.
Related guidance: fund-manager representative onboarding control
Transfer live work without rewriting history
Build a work-in-progress schedule from systems and provider records, not only from the departing person. Include open orders, investment proposals, pending settlements, valuation questions, investor requests, regulatory submissions, provider incidents, unresolved reconciliations, committee actions and calendar obligations. The successor should accept ownership item by item, confirm the next action and identify missing evidence. Preserve the original author, time and decision trail. A clean summary is useful, but it must link to the underlying record instead of replacing difficult context or unresolved disagreement.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeHandover acceptance checks
- Reconcile open orders and settlement items to the controlled books and provider status.
- Identify decisions that need fresh approval because the original authority has ended.
- Transfer deadlines, dependencies and named external contacts with their agreed communication route.
- Preserve draft, rejected and escalated work so the successor can reconstruct the chronology.
- Require the successor and an independent reviewer to record unresolved gaps explicitly.
Related guidance: fund-manager key-person readiness test
Remove access across the full service chain
Use the exposure map to issue coordinated removal requests to technology, operations and every relevant provider. Disable named accounts, invalidate active sessions and tokens, recover devices and physical access, rotate shared secrets where the person knew them, update approval groups, remove delegated mailbox and collaboration access, and review forwarding or automated rules. Ask providers for implementation evidence rather than treating the request email as completion. Where an application cannot remove the person immediately, document the compensating block, owner and verification route until permanent removal is proven.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeAccess-removal sequence
- Freeze authorityApply the agreed control state and prevent new unsupported instructions from entering the mandate workflow.
- Revoke identitiesRemove manager, device, physical and provider access while preserving lawful audit and investigation records.
- Update workflowsReplace approvers, owners, notification lists and emergency contacts without copying excess rights to successors.
- Test the resultAttempt approved negative checks and reconcile provider confirmations to the original access population.
Related guidance: service-chain access recertification guide
Update governance and external records
Review whether the role change affects the manager organisation chart, key-person coverage, committee terms, board reporting, provider instructions, representative status, VCC contact records or the assumptions behind an approved continuity plan. Do not assume every personnel departure triggers the same external action. The compliance owner should determine the applicable notification or record update for the actual role and preserve the basis. VCC directors need decision-relevant information where the departure changes oversight, safe operation or the manager ability to perform the mandate.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Accounting and Corporate Regulatory AuthorityCommunications should separate fact from speculation. Tell providers exactly which authority has ended, which replacement is effective and how urgent questions should be routed. Avoid disclosing confidential employment or investigation information that is not required for the provider to act. If the departing person was a named relationship owner, verify that critical alerts now reach an active monitored route. A change entered in one directory is not closure when deal, cash, document and incident workflows still use the old contact.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeRelated guidance: VCC directors and provider responsibility matrix
Close with an independent residual-rights review
A reviewer who did not execute the removals should compare the completed evidence with the original exposure map and system populations. Search for dormant accounts, shared credentials, personal devices, pending approvals, scheduled jobs, delegated mailboxes, provider user lists and documents still checked out to the old identity. Confirm that successors received only the rights required for their new duties. Record unresolved items and keep the case open until a controlled workaround and owner exist. Later alerts linked to the former identity should reopen the case rather than being dismissed as technical noise.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Monetary Authority of SingaporeFrequently asked questions
Should all access be removed before handover starts?
Not in every orderly departure. The case owner should choose a controlled handover state for each activity and set a clear authority end point. Where there is a conduct, data or conflict concern, immediate targeted restrictions may be necessary while records are preserved.
Who owns access held through an administrator or custodian?
The provider operates its platform, but the manager and VCC governance process should still identify the user, request the change, confirm implementation and reconcile the result. Responsibility should not disappear merely because the account is outside the manager technology environment.
Is a completed human-resources checklist enough?
No. It may prove employment steps, but mandate closure also needs investment authority, provider access, open work, data, external records and successor ownership to be tested. One coordinated case can link these workstreams without exposing unnecessary personnel information.
What should happen to the departing person records?
Preserve records according to the manager retention, privacy, legal and investigation requirements. Do not delete, rewrite or transfer authorship merely to tidy the repository. Access to sensitive records should be limited to people with a legitimate role.
When should the offboarding case be reopened?
Reopen it when a residual login, provider alert, unowned instruction, returned communication, missing record or unexplained approval appears. Treat the event as evidence that the original exposure map or implementation was incomplete and reassess related systems.
Official sources and further reading
- Technology Risk Management Guidelines (Monetary Authority of Singapore)
- Risk Management Practices for Fund Management Companies (Monetary Authority of Singapore)
- Guidelines on Individual Accountability and Conduct (Monetary Authority of Singapore)
- Guidelines on Fit and Proper Criteria (Monetary Authority of Singapore)
- Guideline on Licensing and Conduct of Business for Fund Managers (Monetary Authority of Singapore)
- Financial Institution Representatives Register (Monetary Authority of Singapore)
- Legal Obligations of a VCC Director (Accounting and Corporate Regulatory Authority)
Discuss a Singapore VCC structure
For help coordinating a Singapore VCC setup or corporate administration, contact Raffles Corporate Services.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.