By the APAC Compliance Lead, UWAY Innovation. Program-level guidance; operational, not legal advice.
S$27.45 million is the half of the 2025 record you can read off a balance sheet. The other half was written against named people.
On 4 July 2025 the Monetary Authority of Singapore imposed S$27.45 million in composition penalties on nine financial institutions (MAS, 4 July 2025). It is the largest number in the story and the least important one.
Read that release to the end. MAS also issued prohibition orders to four named people. Three to six years each, against a CEO, a COO, an executive director who also held a relationship manager role, and a former relationship manager. The fines were the corporate ledger. The bans were personal.
No framework follows. Just what changed, three cases worth ten minutes, and how to tell whether you are exposed.
What Actually Changed in 2025
For most of the past decade, an AML failure in APAC was settled in the corporate voice. A firm was penalised, a spokesperson said the firm took its obligations seriously, and no individual's name entered the public record.
By the end of 2025 that had stopped being true. MAS paired its nine-firm settlement with prohibition orders against four individuals and public reprimands against named senior managers at two more of the nine. The SFC banned a manager-in-charge and suspended a responsible officer. Regulators began writing down names.
The mechanisms differ, the direction is the same
MAS uses prohibition orders and reprimands; the SFC uses bans and fines under the Securities and Futures Ordinance. The HKMA's July action fined three banks HK$16.2 million and named no individuals (HKMA, 22 July 2025). Three statutes, one direction. If you operate in both hubs, how Hong Kong and Singapore split supervisory responsibility is the map.
Three Cases Worth Ten Minutes
MAS, 4 July 2025: nine firms, and four people banned
The S$27.45 million was shared across nine institutions. Eight were cited for transaction monitoring: BJBS, Citi, CSSB, LGTS, UOB, UOBKH, TTCSPL and UBSS all failed to "adequately review relevant transactions flagged as suspicious by their own systems." Not for lacking a system. For not reading what it produced.
All four prohibition orders went to people at one firm. Six years for its CEO, five for its COO. Three each for an executive director who also held a relationship manager role, and for a former relationship manager. MAS did not scatter individual sanctions across nine institutions. It reached into one. For its duration, a prohibition order bars you from any MAS-regulated activity, from taking part in the management of any financial institution, and from becoming a substantial shareholder of one.
SFC, 18 August 2025: a manager-in-charge who never held a licence
Zhu Hong was a substantial shareholder, director and former manager-in-charge of core functions at Kylin International (HK). The SFC banned her from regulated activity for twelve months and fined her HK$400,000 (SFC, 18 August 2025). The stated reason was "fund management failures": her failure to discharge her duties as director and MIC for AML/CTF while managing private funds.
She has never been a licensed person under the SFO. She still falls within the definition of a "regulated person" under section 194(7), which includes anyone who was, at the relevant time, involved in the management of a licensed corporation's business. You do not need a licence to be in scope. You need to have been in the room.
SFC, 2 October 2025: four months, and the alert nobody followed
Joey Lo Wai Hon was a responsible officer of MTF Securities Limited, suspended for four months (SFC, 2 October 2025). Three cash clients deposited HK$10,000 each in January 2021, and MTF granted each a trading limit of HK$4 million to HK$5 million at its substantial shareholder's request. No application had come from the clients, and no proper due diligence had been done on their financial status.
They then traded in ways incommensurate with the finances of two of them, in patterns the SFC said should have aroused reasonable suspicion. MTF did not identify them as suspicious, did not follow up, and did not ensure timely reporting to the Joint Financial Intelligence Unit and the SFC. The SFC attributed that failure to Lo. That is precisely the gap the alert-to-evidence triage loop exists to close.
Why "I Followed the Process" Is No Longer a Defence
The reflex of every compliance officer reading this is: we have the policies. MAS anticipated it:
MAS observed that most of the FIs had established AML/CFT policies and controls. The breaches arose out of poor or inconsistent implementation of these policies and controls.
Read that twice. MAS treated policy as a starting point, not a defence, and moved straight to implementation. The question now put to a named person is not "was there a policy?" It is "show me that you personally exercised judgement: that you saw the alert, weighed it, decided, escalated and recorded it."
I have sat in rooms where a hundred-page policy pack was produced in twenty minutes and not one decision record could be found. For years that trade was safe. It is not safe now.
More documentation does not make you safer. A thicker manual is not coverage; it is often evidence of the gap between what was written and what was done. What defends a named person is a record of decisions taken at the time.
What This Means for Your Evidence Layer
The firm-level version of that question is already on the table: whether licensed firms can prove their controls work. The individual version is narrower and far harder. If a supervisor asked you to reconstruct one alert from eighteen months ago, what would you hand over: what you saw, what you concluded, who you escalated to?
Most teams cannot answer. The system logs the alert. The mailbox logs the email. The case file, where one exists, logs the outcome. Almost nothing logs the judgement in between. That gap is the part the 2025 cases actually turned on.
The evidence layer now needs two purposes: satisfy the regulator, and defend the person who was named. A trail from the alert to the decision to the escalation to the report, each step carrying a time and a name, is the only artefact that does both.
The number that will still be there in 2026
The 2025 pattern is easy to summarise and harder to absorb. Nine firms paid S$27.45 million in Singapore and four people were banned for three to six years. In Hong Kong, a manager-in-charge who never held a licence lost twelve months and HK$400,000, and a responsible officer lost four.
Your policies are not your protection. Your records are. That is what the total cost of a control you cannot evidence looks like when the price is measured in a career rather than a budget line. If you want to know where your own exposure sits, start with an evidence-layer review, or subscribe for the next signal piece.