Independent Singapore VCC guidance
Direct answer
Create an access register for every lawyer, tax adviser, investment adviser, administrator, accountant, family-office employee and technology provider touching trust records or systems. For each person and firm, record the appointing authority, purpose, repositories, permissions, data classes, decision rights, effective period and reviewer. Remove access that is unused, excessive, expired or tied to a former engagement. Test removal through the actual system and provider, preserve evidence, and require fresh approval for later restoration. Adviser access should never be mistaken for trustee authority.
At a glance
- Review people, firms, shared accounts and integrations.
- Tie every permission to trustee authority and purpose.
- Separate advice access from decision or transaction rights.
- Test revocation and successor access end to end.
Who this is for
- Singapore-administered family trusts and family offices using external advisers or service providers
Important exclusions
- Determining legal privilege, trustee powers or regulated licensing questions without qualified advice
Inventory every adviser access route
List individuals, firms, service accounts, shared mailboxes, portals, document rooms, accounting systems, portfolio platforms, bank view access, e-signature tools, password vaults, communication channels and data integrations. Record the trust, company or family entity affected. MinLaw explains that the trustee is the legal owner who manages trust property for beneficiaries, while licensed trust-company services sit within a regulated framework. That makes identity and authority important: a trusted adviser may receive information but does not acquire trustee decision power merely through system access.
Sources: Ministry of Law · Monetary Authority of Singapore| Field | Example | Review question |
|---|---|---|
| Authority | Trustee resolution or engagement | Is the approver still valid? |
| Purpose | Tax return, advice or administration | Is access still necessary? |
| Permission | View, edit, approve or transact | Is it least privilege? |
| Period | Start, expiry and review date | Should it end now? |
Related guidance: VCC and family office guide
Classify data and decision rights separately
Separate trust instruments, beneficiary identity, financial data, tax records, legal advice, health information, security credentials, investment material and family correspondence. Then classify what the adviser may view, upload, edit, approve, communicate or transact. A lawyer's access to a privileged folder may not justify access to bank instructions. An investment adviser may propose decisions without authority to approve payments or distributions. The trustee should identify the source of every delegated or shared permission and retain matters that cannot validly be delegated.
Sources: Ministry of Law · Monetary Authority of Singapore- Data class and sensitivity recorded.
- View, edit, approve and transact rights separated.
- Privilege and confidentiality boundaries identified.
- Trustee-reserved decisions remain restricted.
- Beneficiary and family access is purpose limited.
Challenge necessity and current authority
Ask the engagement owner and trustee to confirm the present purpose, not the historical reason. Review the engagement status, adviser personnel, conflicts, insurance or licensing where relevant, confidentiality terms, subcontractors, data location and exit obligations. MAS third-party guidance emphasises governance and risk controls for services supplied by external providers. An adviser firm may remain appointed while its original staff have left, or a portal may retain accounts created for a completed project. Treat silence as a failure to recertify, not as confirmation.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore- Necessary and correctly scopedRecertify for a defined period with the trustee authority and reviewer recorded.
- Necessary but excessiveReduce repositories, data classes or actions before renewing the permission. Record the evidence, owner and decision before acceptance.
- No current purposeRevoke access, recover records and confirm provider-side deletion or lawful retention. Record the evidence, owner and decision before acceptance.
- Authority or conflict unclearSuspend risky actions and obtain advice before any access is renewed. Record the evidence, owner and decision before acceptance.
Related guidance: VCC provider directory
Revoke access through every dependency
Disable the person, firm, shared account, API token, forwarding rule, group membership, delegated mailbox, mobile device and offline export that can still provide access. Recover physical files, keys and authentication devices where applicable. Ask providers to confirm revocation on their side. Change shared secrets rather than assuming a removed user cannot remember them. Preserve the engagement record, return or deletion evidence and any lawful copies the adviser must retain. Do not destroy records under a hold or professional duty.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore- Primary account disabled and sessions ended.
- Groups, forwarding and shared credentials changed.
- Tokens, integrations and devices revoked.
- Physical and offline records returned or controlled.
- Provider confirmation and exceptions retained.
Related guidance: VCC compliance checklist
Test removal and successor continuity
Perform a safe test showing that the former adviser cannot sign in, retrieve a restricted file, receive forwarded mail or use an integration. Then confirm that the trustee and authorised successor can retrieve the records needed to administer the trust. MAS business-continuity guidance takes an end-to-end service view, which is useful when trust administration depends on several systems and providers. Record failed tests and remediate them before closing the engagement. Schedule periodic recertification and event-driven reviews after personnel, trustee, protector, adviser, bank or system changes.
Sources: Monetary Authority of Singapore · Monetary Authority of Singapore · Ministry of Law- Test denialUse controlled checks across login, links, forwarding, devices and provider-side access routes.
- Test retrievalConfirm the trustee and approved successor can reach complete, intelligible and current records.
- Resolve exceptionsAssign every residual copy, token or access gap to an owner and deadline.
- Schedule reviewSet periodic and event-driven recertification based on risk and provider changes. Record the evidence, owner and decision before acceptance.
Related guidance: VCC roles guide
Frequently asked questions
Does an adviser engagement automatically authorise system access?
No. Access should follow a specific trustee or valid delegated authority, purpose, scope and period. The engagement describes services, but each system permission still needs to match the actual role and data.
Should lawyers and tax advisers see the same records?
Not by default. Give each adviser the data needed for the instructed task, considering privilege, confidentiality and conflicts. Separate view, edit, approval and transaction rights and obtain advice on sensitive boundaries.
Is disabling the main login enough?
No. Check group memberships, shared credentials, forwarding rules, API tokens, linked devices, offline copies, physical files and provider-side access. Test the actual routes instead of relying on an administration screen.
How often should access be recertified?
Set a risk-based periodic cycle and run event reviews after trustee, adviser, personnel, system, bank or engagement changes. High-risk transaction or credential access may justify more frequent confirmation.
What evidence closes an access removal task?
Keep the authority, full access inventory, revocation actions, provider confirmations, denial test, record return or lawful-retention position, successor retrieval test, exceptions and accountable approval.
Official sources and further reading
- Express trusts (Ministry of Law)
- FAQs on Trust Companies Act and Trust Companies Regulations (Monetary Authority of Singapore)
- Third-Party Risk Management (Monetary Authority of Singapore)
- Guidelines on Business Continuity Management (Monetary Authority of Singapore)
Discuss your fund, family office or trust structure
Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.
- Email: hello@rafflescorporateservices.com
- WhatsApp: +65 8501 7133
- WhatsApp: +65 9018 0072
Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.