Independent Singapore VCC guidance
Direct answer
Create a separate Corppass access register for every VCC, company and other entity used by the family office. Record the registered officer, administrators, sub-administrators, users, third parties, assigned digital services, agency roles, sub-UEN parameters, purpose, approver, last use and review date. Do not copy one entity's access model across the group. Remove broad or stale permissions, test the actual agency service after each change, and preserve screenshots or exported evidence. Corppass access proves digital authorisation for the entity; it does not replace a board, trustee or family governance decision.
At a glance
- Register access by entity, person and service.
- Keep digital access separate from decision authority.
- Avoid default all-service access without a reason.
- Test removal and retain evidence.
Who this is for
- Singapore family office entities using government digital services through Corppass
Important exclusions
- Sharing credentials, bypassing Singpass identity checks or deciding trustee powers without advice
Build an entity-by-entity access register
Start with every VCC, holding company, operating company, charity, partnership and other UEN or agency relationship used by the family. Corppass describes itself as the authorisation system through which entities manage employee access to government digital services. Record the registered officer, Corppass administrators, sub-administrators, users, enquiry users, third parties, service assignments and any sub-UEN scope. A person's job title is not enough. State which entity granted the authority, why it is needed, who approved it, when it expires and which internal decision supports the transaction.
Sources: Corppass · Corppass| Field | Example | Review question |
|---|---|---|
| Entity | VCC or holding company UEN | Is the correct entity selected? |
| Account role | Admin, sub-admin or user | Is this level necessary? |
| Digital service | ACRA, IRAS or another agency | Is the service still used? |
| Authority | Board, officer or service mandate | Does internal approval still exist? |
Related guidance: VCC and family office guide
Separate identity, platform access and legal authority
Corppass users verify identity through Singpass before accessing government digital services, while administrators assign service access and roles. That platform chain should be reconciled with the family office's own decision chain. A user may be technically able to lodge a filing but still lack internal approval to change an officer, submit a tax position or appoint a provider. For a VCC, ACRA's portal handles dedicated registrations and filings and the official corporate records remain entity-specific. The access register should therefore link each digital permission to the board, officer, trustee or delegated authority that governs the task.
Sources: Corppass · Accounting and Corporate Regulatory Authority · Accounting and Corporate Regulatory Authority- Personal identity and entity account distinguished.
- Agency service and role recorded separately.
- Internal decision authority linked.
- High-risk submissions require review.
- Shared credentials prohibited and removed.
Related guidance: VCC compliance checklist
Control administrators and third-party access
Limit administrator and sub-administrator roles to people who need to create, change or remove access. Corppass says service access can be customised, while default access to all digital services may cover most onboarded services and can later be removed. Broad access should have a documented reason and review date. IRAS also recognises access for employees and third parties such as tax intermediaries. Record the firm, individual user, engagement, service scope, start date and end date rather than treating a provider name as authority for all its staff. Revoke access promptly when the mandate or employment ends.
Sources: Corppass · Inland Revenue Authority of Singapore- Administrator neededGrant only when the person must manage other users and service assignments for that entity.
- Task-specific userAssign the named digital service and narrow role needed for the approved work.
- External intermediaryTie access to a current engagement, named person, scope and expiry date.
- No current purposeRemove the permission and preserve tested revocation evidence. Record the evidence, owner and acceptance decision before this step is closed.
Related guidance: VCC roles guide
Recertify access against real services
Review access at a fixed frequency and after a director, employee, trustee, provider or entity-status change. ACRA's Bizfile guide explains how users can inspect assigned services and notes that an administrator can still receive a not-authorised error if the required service is missing. Test the actual service with the intended role rather than relying only on the Corppass summary. For each exception, record the error, requested change, approver, completion evidence and retest. Do not perform a live filing merely to test access; use the service's supported view or pre-submission route where possible.
Sources: Accounting and Corporate Regulatory Authority · Corppass| Test | Evidence | Failure response |
|---|---|---|
| Correct entity | Selected UEN or profile | Stop and switch entity |
| Correct service | Assigned service list | Request narrow assignment |
| Correct role | View or transaction capability | Adjust role with approval |
| No stale access | Former users absent | Revoke and retest |
Close removals and preserve evidence
When access ends, remove the user's service and administrative permissions, invalidate any agency-specific role where required, update internal password-vault or contact records, and test that the former route no longer works. Preserve the change receipt, administrator evidence, date, reviewer and affected services without storing passwords or authentication secrets. Reconcile the access register to current employees, directors, providers and entity status. For a closed or dormant family entity, confirm whether Corppass access should be removed or retained for a bounded filing task. A clean user list is not enough unless each live permission has a current purpose and accountable owner.
Sources: Corppass · Accounting and Corporate Regulatory Authority · Inland Revenue Authority of Singapore- Service and administrator permissions removed.
- Agency-specific role checked.
- Internal provider and vault records updated.
- Revocation tested without making a filing.
- Evidence and reviewer retained securely.
Related guidance: Singapore VCC guide
Frequently asked questions
Is Corppass access the same as board authority?
No. It is digital-service authorisation for the entity. Internal corporate, trustee and governance approvals remain separate. For this specific map corppass access across family office entities task, record the governing facts, current source, authority, accountable owner, evidence and next review date before any operational, legal, tax or regulatory action is treated as complete.
Should a family office use default access to all services?
Only with a documented need, approver and review date. Narrow service and role assignments are easier to justify and recertify. For this specific map corppass access across family office entities task, record the governing facts, current source, authority, accountable owner, evidence and next review date before any operational, legal, tax or regulatory action is treated as complete.
Can a tax adviser receive Corppass access?
IRAS recognises third-party intermediaries, but access should be tied to a named user, current engagement, specific service, scope and expiry. For this specific map corppass access across family office entities task, record the governing facts, current source, authority, accountable owner, evidence and next review date before any operational, legal, tax or regulatory action is treated as complete.
How should removal be proved?
Retain the change evidence and test that the former user or provider no longer has the relevant entity, service or administrator route. For this specific map corppass access across family office entities task, record the governing facts, current source, authority, accountable owner, evidence and next review date before any operational, legal, tax or regulatory action is treated as complete.
Do passwords belong in the access register?
No. Record roles, authority and evidence, but keep credentials and authentication material only in approved secure systems. For this specific map corppass access across family office entities task, record the governing facts, current source, authority, accountable owner, evidence and next review date before any operational, legal, tax or regulatory action is treated as complete.
Official sources and further reading
- Digital service list and access roles (Corppass)
- About Corppass (Corppass)
- Setting up Corppass access for Bizfile (Accounting and Corporate Regulatory Authority)
- Variable Capital Company registration and filing portal (Accounting and Corporate Regulatory Authority)
- Overview of managing a variable capital company (Accounting and Corporate Regulatory Authority)
- Corppass access for entities and intermediaries (Inland Revenue Authority of Singapore)
Discuss your fund, family office or trust structure
Contact Raffles Corporate Services about Singapore VCC setup, fund structures, family offices and corporate administration.
- Email: hello@rafflescorporateservices.com
- WhatsApp: +65 8501 7133
- WhatsApp: +65 9018 0072
Where legal assistance is required, we can coordinate an introduction to an associate independent law firm, with your consent. The law firm advises you under a separate engagement. Raffles Corporate Services is not a law firm. Tax, investment management and trustee services, where needed, require appropriately qualified or authorised providers.
General information only. This article is not legal, tax, regulatory or investment advice and does not imply affiliation with or endorsement by ACRA, MAS or IRAS.