Independent Singapore VCC guidance
Direct answer
Build a record-level migration inventory before moving any VCC AML file. Keep the original source, collection date, verification method, party, relationship, reviewer, risk decision, expiry and open remediation attached to each record. Transfer through an approved secure channel, then test completeness, readability, metadata, permissions and links to the correct investor or controller. Do not mark a record current merely because it copied successfully. Reverify stale, unreadable or unsupported evidence and retain the incumbent export, exception log and replacement-provider acceptance as separate records.
At a glance
- Preserve source provenance and review decisions separately.
- Migrate open exceptions, not only clean files.
- Test access and record linkage after transfer.
- Treat successful copying as a technical state, not AML acceptance.
Who this is for
- VCC investor, controller, officer and transaction due-diligence records moving between administrators or compliance providers
Important exclusions
- Replacing current AML analysis or legal advice with a bulk file transfer
Define the record universe
Start from parties and obligations, not folders. Map the VCC, each sub-fund, investors, beneficial owners, controllers, authorised persons, directors, manager, service providers and material counterparties. For each party, list identity evidence, ownership charts, screening results, source-of-funds or wealth support where applicable, risk assessments, approvals, periodic reviews and unresolved requests. ACRA identifies registers and officer information that VCCs maintain, while MAS risk guidance supports effective governance, policies and controls. The migration inventory should show both the evidence and the decision that relied on it.
Sources: Accounting and Corporate Regulatory Authority · Monetary Authority of Singapore| Record class | Minimum link | Acceptance test |
|---|---|---|
| Identity and authority | Party, capacity and effective period | Readable evidence matches the correct party |
| Ownership and control | Entity chain and controller record | Chart and source documents reconcile |
| Screening and risk | Search date, method and reviewer | Result and disposition remain accessible |
| Open remediation | Owner, request and due date | Exception appears in the replacement workflow |
Related guidance: VCC compliance checklist
Preserve provenance and meaning
Keep each document's original filename or immutable identifier, source, collection channel, date, language, issuing authority, certification status, expiry and prior reviewer. Do not flatten a structured case into a folder of PDFs without the relationships that explain why each file exists. If a provider exports transformed copies, retain a manifest linking them to the originals. Preserve superseded records where retention rules require them, label their status and prevent an older document from appearing current merely because the migrated file received a new system timestamp.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore- Record the immutable source identifier and original collection date.
- Retain reviewer, decision, risk rating and supporting rationale.
- Link every document to the correct party and capacity.
- Label current, superseded, expired and disputed states.
- Keep the export manifest and transformation method.
Move records through controlled channels
Classify the information before transfer and use an approved channel with encryption, access limits and delivery confirmation. Transfer only to named replacement-provider users whose roles require access. Separate secrets, credentials and live authentication artefacts from the document migration. Record the export population, file count, checksum or equivalent integrity evidence, sender, recipient and transfer time. If the provider uses a staging area, set an expiry and confirm deletion after acceptance. Operational resilience includes the ability to continue critical functions without creating uncontrolled duplicate repositories.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore- PrepareFreeze the agreed population, resolve obvious duplicates and record the export manifest before transmission begins.
- TransmitUse the approved secure route with named recipients, access logging and integrity evidence for every package.
- LoadImport records without changing original dates, status labels or the relationship to each party and case.
- Retire stagingAfter acceptance, remove temporary copies under the approved retention and deletion process.
Related guidance: VCC provider directory
Test content, linkage and permissions
A file-count match is only the first test. Sample high-risk and ordinary records across every sub-fund and party class. Confirm the file opens, pages are complete, metadata survived, the document links to the correct case, the prior decision is visible and the next review date is accurate. Test permissions from several roles, including a user who should not have access. Reconcile open sanctions, adverse-information, ownership and document-expiry exceptions. A clean technical load with missing review context is not an accepted AML migration.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore| Test | Pass condition | Failure response |
|---|---|---|
| Population | Manifest and loaded records reconcile | Stop acceptance and locate omissions |
| Readability | Files open completely and remain legible | Recover from source or request replacement |
| Case linkage | Correct party, capacity and VCC relationship | Repair mapping and retest the population |
| Permissions | Only authorised roles can view or change | Contain access and review exposure |
Handle stale or unsupported evidence
Classify exceptions by risk and operational effect. An expired identity document, unresolved ownership chain or unsupported risk decision may require refreshed evidence before further dealing, depending on the applicable framework and facts. An unreadable historical document may need recovery rather than automatic recollection. Do not rewrite the incumbent decision to make the replacement database look complete. Preserve the original state, open a remediation item, name the owner and record any temporary restriction. Escalate legal, sanctions or suspicious-activity issues through the authorised process rather than the migration workstream.
Sources: Monetary Authority of Singapore · Accounting and Corporate Regulatory Authority- Current and supportedAccept the record after technical, linkage and permission tests pass with complete provenance.
- Expired but traceableRetain the history, set the correct status and begin risk-based refresh before the relevant activity.
- Unreadable or incompleteRecover from the source, document the gap and restrict reliance until evidence is restored.
- Decision unsupportedEscalate for fresh review without overwriting the original reviewer record or rationale gap.
Related guidance: Singapore VCC guide
Accept and close the migration
The replacement provider should sign a population and exception acceptance that identifies what was loaded, tested, rejected and left open. The incumbent should confirm the final export scope and preserve its retention obligations. Directors and the manager should receive a concise residual-risk view, not only a completion percentage. Close temporary accounts, revoke departing users and verify that production teams can retrieve the evidence needed for onboarding, monitoring, reporting and inspection. Keep the manifest, integrity evidence, test results, exceptions and approvals together.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore- Obtain incumbent export-scope confirmation.
- Complete population, readability, linkage and access testing.
- Assign every exception to an owner and due date.
- Revoke old access and remove temporary transfer copies.
- Approve production use with an explicit residual-risk record.
Related guidance: VCC roles and responsibilities guide
Frequently asked questions
Can the replacement provider rely on every migrated AML record?
Not automatically. Reliance depends on the record, provenance, currency, verification method, applicable rules and the provider's own obligations. The migration should preserve the prior evidence and decision, but stale, unreadable or unsupported items need risk-based review before continued reliance.
Should old or superseded identity documents be deleted?
Do not delete them merely because a current document exists. Apply the governing retention and privacy rules, label status accurately and restrict access. Historical evidence may explain earlier decisions or transactions. Deletion should follow an approved retention schedule and documented legal analysis.
Is a checksum enough to prove AML migration success?
No. Integrity evidence helps show that files did not change, but acceptance also requires completeness, readability, metadata, case linkage, permissions, review status and open-exception testing. A technically identical file can still be attached to the wrong investor or lack its decision context.
What should happen to open remediation requests?
Migrate them as active workflow items with the original request, evidence received, outstanding question, risk, owner, due date and temporary restriction. Reconcile them after the load and confirm that alerts and escalation routes work. Do not close them to improve completion statistics.
Who owns final acceptance of the migrated records?
Operational teams can test and the replacement provider can accept its load, but governance remains with the accountable VCC and manager roles. Approval should identify residual exceptions and restrictions. Legal or compliance advice is needed where reliance, retention or reporting obligations are uncertain.
Official sources and further reading
- Updating VCC information and officers (Accounting and Corporate Regulatory Authority)
- Overview of managing a variable capital company (Accounting and Corporate Regulatory Authority)
- Risk management practices for fund management companies (Monetary Authority of Singapore)
- Operational resilience (Monetary Authority of Singapore)
Discuss your fund, family office or trust structure
Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.
- Email: hello@rafflescorporateservices.com
- WhatsApp: +65 8501 7133
- WhatsApp: +65 9018 0072
Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.