Independent Singapore VCC guidance
Direct answer
Treat a family-office departure as an authority change, not just an email closure. Build an inventory of the person’s bank, custody, trust, investment, accounting, cloud, messaging, premises, device, vendor and emergency access. Freeze high-risk authority at the agreed time, preserve evidence, recover family and trust property, rotate shared secrets, notify providers through verified channels and assign replacement owners. Then test that the former worker cannot transact, retrieve sensitive data or remain an accepted contact, while critical services continue.
At a glance
- Inventory internal and external authority before the exit time.
- Revoke transaction and sensitive-data access first.
- Rotate shared secrets and replace provider contacts.
- Test both removal and business continuity.
Who this is for
- Family offices, trustees and private-wealth teams offboarding staff or contractors
Important exclusions
- Employment-law advice, covert monitoring or access outside authorised systems
Build the authority and access inventory
List access by capability, not by application name. Include creating or approving payments, viewing portfolios, downloading identity records, instructing trustees or advisers, entering residences or storage, opening physical files, contacting family members, resetting accounts and acting during emergencies. Ask banks, custodians, administrators, trustees, accountants, lawyers, insurers and technology vendors whether the person is an authorised signatory, approver, administrator, recognised caller, copied recipient or recovery contact. MinLaw explains that trustees must safeguard trust assets and maintain proper records. The exit map should distinguish employer systems from trust, company and personal-family authority so the correct legal owner approves each removal.
Sources: Ministry of Law · Monetary Authority of Singapore · Monetary Authority of Singapore| Domain | Examples | Removal evidence |
|---|---|---|
| Money | Bank, custody, cards and payment approval | Provider confirmation and transaction test |
| Trust and entities | Trustee portal, registers and board materials | Owner approval and access log |
| Data | Cloud, email, devices, backups and exports | Identity-system record and device check |
| Physical | Office, residence, vault, keys and passes | Asset return and access-system record |
| External authority | Vendors, advisers and emergency contacts | Verified contact update and readback |
Related guidance: VCC for family offices
Sequence high-risk revocation and preservation
Set an authorised exit time and coordinate the identity, finance, physical-security, legal and provider owners. Preserve records needed for lawful business, investigation and continuity before disabling access; do not copy personal material outside the approved process. Remove payment, administrator, remote-access, data-export and account-recovery capability at the planned time. Collect devices, cards, keys, seals, tokens and original documents using an inventory. Rotate shared credentials because disabling one user does not change a password known to that user. The PDPC guidance emphasises organisational responsibility for personal data under its control, while MAS operational-resilience material highlights governance, external dependencies and recovery. Apply those principles proportionately to the family office.
Sources: Personal Data Protection Commission Singapore · Monetary Authority of Singapore- AuthoriseConfirm the exit time, legal owner and approver for every access domain.
- PreserveRetain required business records and logs through the approved process before removal.
- RevokeDisable transaction, administrator, remote and sensitive-data rights at the agreed time. Record the evidence, accountable owner and approval before moving to the next stage.
- RecoverCollect devices, keys, tokens, documents and family or trust property against an inventory.
- RotateChange shared secrets, recovery contacts and physical combinations that may remain known.
Related guidance: VCC compliance checklist
Replace external contacts and delegated authority
External authority often survives after internal accounts close. Send provider changes from a known authorised person through established channels. State which authority ends, which replacement starts and when, without disclosing unnecessary employment details. Obtain provider confirmation that signatory lists, call-back records, portal administrators, distribution lists and emergency contacts are updated. For trusts, companies and funds, use the valid trustee, board, manager or account-holder process rather than a family-office memo alone. If no replacement is ready, install a controlled interim owner with narrow rights and a review date. Do not transfer the leaver account or mailbox wholesale to a successor without privacy, privilege and data-owner review.
Sources: Ministry of Law · Monetary Authority of Singapore · Monetary Authority of Singapore- Bank and custodian mandates no longer recognise the leaver.
- Trustees, advisers and vendors acknowledge the replacement contact.
- Portal and recovery administrators are current.
- Distribution lists and standing reports exclude the former worker.
- Interim authority is narrow, approved and time-bound.
Related guidance: VCC provider directory
Test removal and operating continuity
Test from both sides. Confirm the former identity cannot authenticate, reset access, approve a payment, download a report, enter a controlled location or obtain information through a provider call. Then confirm the replacement team can complete critical tasks without resorting to the old account. Review recent exports, forwarding rules, shared links, delegated mailboxes, API tokens, mobile sessions and personal-device arrangements within authorised scope. Reconcile returned property and unresolved exceptions. Keep a completion record by system and provider, not one global done checkbox. A later alert, message or provider contact addressed to the leaver should reopen the relevant control and prompt wider sampling.
Sources: Personal Data Protection Commission Singapore · Monetary Authority of Singapore- Authentication and recovery tests fail for the former identity.
- Critical payments and reporting work for authorised replacements.
- Shared links, sessions, tokens and forwarding rules are reviewed.
- All family, trust and company property is reconciled.
- Exceptions have owners, deadlines and independent closure evidence.
Related guidance: VCC manager and director roles
Frequently asked questions
Should email be disabled before business records are preserved?
Coordinate preservation and revocation through the authorised legal, security and data process. Keep required business records without copying personal material indiscriminately, then disable access at the approved time.
Is changing the family-office password enough?
No. Access may survive through provider mandates, recovery contacts, API tokens, mobile sessions, shared links, physical keys and informal recognition. Test each capability and obtain external confirmation.
Who should notify trustees and banks?
Use the person authorised by the relevant trust, company or account-holder process and the provider’s established channel. An internal manager may coordinate, but the valid legal owner should approve the authority change.
Can a successor use the former employee account?
Avoid transferring identity accounts because that obscures accountability and may expose unrelated records. Create or confirm the successor’s own authorised identity and permissions, then preserve necessary business records through the approved legal and data process.
How is offboarding proved complete?
Retain system records, provider readback, returned-property reconciliation, secret rotation and live tests showing that former access fails and replacement operations work. Open exceptions should remain visible until independently closed.
Official sources and further reading
- Express trusts (Ministry of Law)
- FAQs on Trust Companies Act and Trust Companies Regulations (Monetary Authority of Singapore)
- Advisory Guidelines on the PDPA for Selected Topics (Personal Data Protection Commission Singapore)
- Operational resilience (Monetary Authority of Singapore)
Discuss your fund, family office or trust structure
Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.
- Email: hello@rafflescorporateservices.com
- WhatsApp: +65 8501 7133
- WhatsApp: +65 9018 0072
Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.