MAS Notice 626 is the AML/CFT instrument banks in Singapore are inspected against, and it remains the most-cited compliance reference in the market. It is easy to over-generalise it, though. Notice 626 applies specifically to banks licensed under the Banking Act; payment service providers, capital markets intermediaries and other institution types sit under separate MAS notices with equivalent but distinct obligations. This article focuses on what Notice 626 requires for ongoing transaction monitoring, and how the COSMIC information-sharing framework fits alongside it.
What Notice 626 covers
Notice 626, issued under the Banking Act, sets out customer due diligence, ongoing monitoring, suspicious transaction reporting and record-keeping requirements for Singapore banks, supported by MAS's accompanying AML/CFT Guidelines. It reflects FATF Recommendations and is one of the primary instruments MAS examiners test compliance against during inspections.
Its monitoring provisions require banks to implement systems capable of detecting unusual or suspicious transactions, investigate resulting alerts within defined timeframes, and document monitoring outcomes in a form MAS can review. Notice 626 also incorporates FATF Recommendation 16 wire transfer requirements, meaning banks must collect, retain and transmit originator and beneficiary information on funds transfers.
Why 'the policy exists' is not the same as 'the monitoring works'
MAS has taken enforcement action where monitoring, customer oversight or investigation processes left gaps in AML/CFT controls, and its expectations in examination have consistently run ahead of the bare minimum text of the Notice. In practice this means alert rules calibrated to a bank's actual customer base and risk profile, not generic industry-standard settings applied without adaptation, and documented analysis behind every alert closed without a suspicious transaction report, so MAS can reconstruct the investigation path from alert to disposition.
Regular tuning matters too: removing rules that consistently generate false positives without surfacing genuine suspicious activity, and adding coverage for typologies the bank has not previously modelled, are both expected as an ongoing discipline rather than a one-off calibration exercise.
How COSMIC fits alongside Notice 626
COSMIC, which launched on 1 April 2024, is a separate information-sharing platform developed by MAS together with six major banks (DBS, OCBC, UOB, Citibank, HSBC and Standard Chartered). It lets participating financial institutions share customer information where specific financial-crime red flags are met, currently focused on misuse of legal persons, misuse of trade finance, and proliferation financing. It operates under the Financial Services and Markets Act 2023 and its subsidiary legislation.
COSMIC does not replace Notice 626's monitoring obligations. Where a prescribed bank obtains information through COSMIC, including risk assessment results, it is expected to factor that into the risk mitigation measures Notice 626 already requires, rather than treating COSMIC as a separate, parallel compliance track.
What this means for a bank's monitoring build
A monitoring programme that satisfies MAS in practice needs three things working together: rules genuinely calibrated to the institution's own book rather than an off-the-shelf template, an audit trail that shows the reasoning behind every disposition, and a process for incorporating both internal tuning and, where relevant, COSMIC-sourced red flags into risk mitigation decisions. Institutions outside the banking sector should also confirm which specific MAS notice actually governs them (PSN01 for payment service providers, PSN02 for digital payment token providers, or the equivalent notice for their licence class) rather than assuming Notice 626 applies by default.
