Independent Singapore VCC guidance
Direct answer
Review key-person access by tracing every critical family-office action from authority to credential, device, record and backup person. Identify systems where one individual can either block the family or act without challenge, then redesign mandates, privileged access, recovery methods and document custody. Emergency access should be sealed, independently controlled and tested, not shared casually. Finish by running a realistic absence scenario that proves the right people can continue essential payments, protect assets and reach trustees without exposing unnecessary confidential information.
At a glance
- Map authority and technical access together.
- Remove both single-person blockage and unchecked unilateral power.
- Keep emergency credentials controlled, current and testable.
- Test absence with real evidence, not verbal assurance.
Who this is for
- Single family offices, family investment companies and trust-linked offices with concentrated access
Important exclusions
- Changing trustee powers, bank mandates or legal ownership without the relevant provider and professional advice
Inventory critical actions and dependencies
List the actions whose interruption could harm the family: authorising bank and custody transactions, meeting payroll and property obligations, obtaining original documents, contacting trustees, viewing portfolios, responding to incidents and proving authority. For each action, identify the legal decision-maker, system user, device, authentication method, record source and backup. A second person who knows a password is not a proper backup if the bank mandate or trust process does not authorise that person.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Ministry of Law| Critical action | Single-person risk | Safer control design |
|---|---|---|
| Bank or custody instruction | Only one authorised or technically enabled user. | Approved alternate authority with dual control and tested device access. |
| Trustee communication | Relationship and records sit in one mailbox. | Shared controlled record, named alternates and authenticated provider contacts. |
| Original document retrieval | One custodian knows the location or release route. | Document register, dual release and succession instructions. |
| Password and recovery administration | One user controls resets for everyone. | Separated privileged roles and sealed emergency recovery. |
Related guidance: original trust document custody checklist
Separate authority, access and knowledge
Three different dependencies can exist. Legal authority answers who may decide. Technical access answers who can operate a system. Institutional knowledge answers who understands the asset, relationship and process. Record all three, because adding a second login does not create decision authority, and appointing an alternate does not ensure the person can find the documents or complete authentication. Trustees and licensed service providers should remain within their separate roles and engagement boundaries.
Sources: Ministry of Law · Monetary Authority of Singapore · Monetary Authority of Singapore- Verify each mandate and delegation against the current signed record.
- Use named individual access instead of shared accounts wherever supported.
- Separate transaction preparation, approval and privileged administration.
- Document trusted provider contacts and independent call-back routes.
- Give backups enough information to act, but not blanket access to unrelated family data.
Related guidance: VCC for family offices
Design controlled emergency access
Emergency access should cover incapacity, travel, device loss, sudden departure and a cyber incident. Use a sealed process with defined trigger evidence, at least two controlling parties where practical, immutable access logging and prompt credential rotation after use. Store recovery material apart from daily devices and primary offices. The process should identify which actions remain prohibited until the trustee, bank, board or family authority has made a separate decision.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore- TriggerDefine objective events and the people who may declare that emergency access is needed.
- AuthenticateVerify the requester and the event through a channel independent of the unavailable key person.
- ReleaseProvide only the credentials, documents and permissions needed for the approved critical action.
- ResetReview activity, rotate access, reseal recovery material and report every exception after the event.
Related guidance: family incapacity meeting pack
Run a realistic absence exercise
Choose an unannounced but controlled scenario in which the key person cannot be contacted. Ask the backup team to identify an urgent obligation, locate authority evidence, access the correct system, contact the provider, prepare a decision and preserve the audit trail. Do not execute a real payment merely to test. Measure time, missing records, failed authentication, ambiguous authority and information overexposure. A tabletop discussion is useful, but it does not prove devices, credentials and provider records work.
Sources: Monetary Authority of Singapore · Monetary Authority of SingaporeClose gaps and maintain the map
Turn every failed step into a remediation with an owner, due date, evidence and later retest. Review the map after staff changes, new entities, bank migrations, trustee changes, device replacement and significant family events. Compare user lists with mandates and actual responsibilities. Remove dormant access promptly while preserving records. Report to the appropriate family, board or trustee forum in a form that shows risks and decisions without publishing sensitive credentials. Test again after remediation closes.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore- Current critical-action and authority inventory.
- Named primary and alternate users by system.
- Emergency release and credential-rotation evidence.
- Provider call-back and document-custody verification.
- Exercise results, remediation owners and retest dates.
Related guidance: family office staff exit access controls
Frequently asked questions
Should two people know every password?
No. Shared knowledge can weaken accountability and may breach provider rules. Prefer named access, dual approval, separate privileged administration and a controlled recovery mechanism that is released only under defined conditions.
Does a backup user automatically have legal authority?
No. System access and legal authority are different. Check bank mandates, board decisions, powers, trust arrangements and provider records before assuming an alternate user may make or approve a decision.
How often should a family office test key-person access?
Set a frequency based on risk and change, and retest after material staff, system, bank, trustee or device changes. The important point is current evidence that the route works, not a fixed calendar slogan.
Can the exercise include a real payment?
It usually need not. Use read-only access, a prepared but cancelled instruction, a provider verification call or a non-production workflow to prove readiness without creating an unnecessary transfer risk.
Official sources and further reading
- Operational resilience (Monetary Authority of Singapore)
- Express trusts (Ministry of Law)
- FAQs on Trust Companies Act and Trust Companies Regulations (Monetary Authority of Singapore)
- Financial Institutions Directory: Licensed Trust Company (Monetary Authority of Singapore)
Discuss your fund, family office or trust structure
Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.
- Email: hello@rafflescorporateservices.com
- WhatsApp: +65 8501 7133
- WhatsApp: +65 9018 0072
Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.