Hong Kong vs Singapore KYC/KYB: A Founder's Compliance Map for 2026

Two cities share an ambition to be Asia's trusted financial hub. For founders, that competition becomes tangible in the onboarding file. The same customer, beneficial-owner chain and source-of-funds explanation can pass through two compliance systems that look similar at first and diverge as soon as the applicable rule, regulator and corporate register are identified.

If you are deciding where to incorporate, bank or license a virtual-asset business, the KYC/KYB difference is operational, not academic. It affects the evidence you collect, the records you maintain and the way you respond when activity looks unusual. Both regimes follow the FATF Recommendations, so the answer to KYC requirements Hong Kong vs Singapore is not that one city performs KYC and the other does not. The important differences are supervisory structure, ownership-register mechanics and implementation detail.

By Yuen Lam Kwan (关宇霖), APAC Compliance Lead at UWAY Innovation. This article provides operational guidance, not legal advice. Confirm the rules that apply to your entity, licence and customer with qualified counsel in each jurisdiction.

Key takeaways

• Hong Kong applies the AMLO through several sector supervisors; Singapore applies sector-specific MAS notices alongside ACRA corporate-register duties.
• Both corporate-controller regimes use a more-than-25% ownership or voting test, together with separate control routes.
• Hong Kong keeps the SCR at the company; Singapore requires a private RORC and filing with ACRA's Central RORC. Neither register is generally public.
• The latest Hong Kong PEP guidance stresses proportionality and case-by-case assessment, not blanket enhanced treatment for every relative or associate.
• Both regimes generally use a five-year AML record-retention baseline, although other laws or business records may require longer retention.

Supervisory architecture: AMLO versus sector-specific notices

Hong Kong anchors financial-institution customer due diligence in the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO, Cap. 615). Administration is sector-based. The HKMA supervises authorised institutions and stored-value facilities; the SFC supervises licensed corporations and SFC-licensed virtual-asset trading platforms. Other sectors have their own competent authorities and guidance.

Singapore also uses sector-specific instruments. MAS Notice 626 applies to banks, while separate notices apply to merchant banks, finance companies and payment service providers. The official MAS Notice 626 page is therefore a starting point for banks, not a universal checklist for every Singapore business. ACRA administers the corporate registers; MAS notices govern the AML/CFT duties of the regulated financial institution.

The practical distinction is organisational. A Hong Kong group may interact with different supervisors as its activities change. A Singapore financial business usually deals with MAS for AML/CFT supervision, but it still needs to identify the notice and licence category that actually applies.

Customer due diligence: where the regimes converge and where triggers differ

The two systems converge around the FATF risk-based model:

• identify and verify the customer using reliable, independent information;
• identify and take reasonable measures to verify beneficial owners;
• understand the purpose and intended nature of the relationship;
• apply enhanced measures where risk is higher; and
• monitor the relationship and refresh evidence when circumstances change.

The timing rules contain limited exceptions, so "always complete every verification step before onboarding" is too broad. The safer operating design is to complete CDD before establishing the relationship unless the applicable rule expressly permits delayed verification and the institution has the required risk controls.

Transaction triggers also differ. In Hong Kong, linked occasional transactions can trigger CDD at HKD 8,000 for wire transfers and HKD 120,000 for other occasional transactions, subject to the applicable sector provisions. In Singapore, triggers depend on the relevant MAS notice. Notice 626, for example, includes a SGD 20,000 threshold for certain non-account transactions and separate triggers for specified transfers, suspicion and doubts about existing information. Do not transpose the banking threshold into a payment-services workflow without checking PSN01 and PSN02.

Beneficial ownership and KYB: SCR versus RORC

Corporate-controller registers are where founders notice the clearest structural difference.

Hong Kong: Significant Controllers Register

Most Hong Kong-incorporated companies other than listed companies must identify significant controllers and keep a Significant Controllers Register (SCR). The Companies Registry guidance uses more than 25% of issued shares or voting rights, together with rights to appoint or remove a board majority and significant-influence or control tests.

The SCR is not filed as a public central register. It is kept at the registered office or another notified place in Hong Kong and made available to authorised law-enforcement officers. For a registrable person, particulars are entered within seven days after all required particulars are confirmed; for a registrable legal entity, the seven-day period runs as the particulars come to the company's notice. That is more precise than saying every ownership change has one universal seven-day filing deadline.

Singapore: private RORC plus Central RORC

Singapore companies generally maintain a private Register of Registrable Controllers (RORC) and file the information with ACRA's Central RORC. The controller test also uses more than 25% ownership or voting power and separate significant-control routes. According to ACRA's current RORC guidance, a company updates its private RORC within seven days after being informed of a change, then files the corresponding Central RORC update within two business days.

The Central RORC is not available to the general public. Company officers and registered corporate service providers maintain it, and law-enforcement agencies may access it for authorised purposes. Investors and ordinary shareholders cannot simply purchase the beneficial-owner record. This matters because the central filing improves state access without turning the underlying ownership details into a public database.

From 16 June 2025, Singapore also requires filing with the Central Registers of Nominee Directors and Nominee Shareholders. A company business profile can show the current nominee status, while nominator identities and historical arrangements remain private. This gives due-diligence teams a public signal that a nominee arrangement exists without exposing the full private register.

A practical founder scenario

Consider a group with a Singapore holding company and a Hong Kong operating company. Investor counsel may request a cap table, constitutional documents and controller confirmations from the company. A bank or authority can then test those materials against the registers it is authorised to see. The operational task is not to choose "private" or "transparent" as an abstract value; it is to keep the corporate record, bank KYC file and supporting ownership evidence consistent whenever a controller or nominee arrangement changes.

PEP and enhanced due diligence

Hong Kong's latest banking guidance requires careful wording. The HKMA's November 2025 Smart Tips on PEP treatment emphasise a proportionate, risk-based approach. Family members and close associates are relevant because they can be used to move or disguise proceeds, but institutions should assess relationship proximity and circumstances case by case. They should not apply identical enhanced measures mechanically to every person in a broad social circle.

For former PEPs, the HKMA guidance also avoids an automatic expiry period. Institutions assess time since leaving office, continuing influence, seniority and links between former and current functions before deciding whether PEP-specific EDD remains necessary.

Singapore similarly distinguishes foreign PEPs from domestic and international-organisation PEPs in its sector notices. Foreign PEP relationships generally require PEP-specific enhanced measures. Domestic and international-organisation PEPs are treated according to the applicable higher-risk assessment. Founders should not design a fixed declassification period unless their applicable notice and internal risk framework support it.

The control objective in both markets is the same: identify relevant PEP exposure, establish source of wealth and source of funds to the required depth, obtain the necessary approval and apply enhanced ongoing monitoring in proportion to risk.

Suspicious transaction reporting

Hong Kong sends suspicious transaction reports to the Joint Financial Intelligence Unit (JFIU). Singapore sends them to the Suspicious Transaction Reporting Office (STRO). Both systems are driven by knowledge or suspicion, not by proving the underlying offence or crossing a minimum transaction amount.

Timing should also be stated accurately. The JFIU says disclosure should be made as soon as practicable. Singapore's STRO filing guidance similarly requires filing as soon as reasonably practicable. Internal escalation targets may be tighter, but they should not be presented as the general cross-sector statutory standard.

Tipping off is prohibited. Teams should separate customer-facing enquiries from internal escalation, preserve the basis for the decision and ensure staff do not reveal that an STR has been or may be filed.

The virtual-asset overlay

For Web3 founders, the baseline KYC/KYB comparison is only part of the control map. Hong Kong brings centralised virtual-asset trading platforms into the AMLO framework through SFC licensing. The SFC Travel Rule requirement to submit prescribed originator and beneficiary information immediately, meaning before or when the transfer is conducted, took effect on 1 January 2024.

Singapore regulates digital payment token services under the Payment Services Act and the relevant MAS notices, including PSN01 and PSN02. The local amount boundaries, payload fields and counterparty controls are not identical to Hong Kong's.

Our VASP Travel Rule compliance in APAC guide compares those transfer rules with Dubai and Malaysia. The Travel Rule Configurator documents how to maintain corridor-specific thresholds, fields, counterparties and versioned approval evidence.

Record keeping and ongoing monitoring

For AML/CFT records, both regimes generally use a five-year baseline after the end of the business relationship, with transaction records retained for the applicable five-year period. Other corporate, tax, limitation or sector rules may require longer retention, so a group should maintain a documented retention schedule rather than deleting every record automatically on day one after the AML minimum expires.

Ongoing monitoring is equally important. Singapore's COSMIC framework allows participating financial institutions to share specified risk information under statutory safeguards. Hong Kong institutions operate their own monitoring and reporting controls under the relevant supervisor's guidance. In both markets, changes in directors, controllers, products, corridors or expected activity should trigger review rather than wait for a calendar refresh.

For a group operating in both cities, one evidence model can support two jurisdiction-specific outputs. AML Sentinel connects alert triage to the underlying customer context, while Compliance Quality Analysis measures whether files contain the required evidence and decision trail. The product does not replace legal interpretation or the accountable MLRO.

Choosing between Hong Kong and Singapore

There is no universal winner. Use an operating-fit assessment:

• Hong Kong may fit a business centred on Hong Kong or Greater Bay Area counterparties, or one whose regulated activities sit clearly within an established Hong Kong supervisory path.
• Singapore may fit a business centred on Southeast Asian payments, funds or institutional counterparties and prepared to operate within the relevant MAS notice and ACRA filing framework.
• A dual structure may fit a group with genuine operations in both markets, provided governance, substance, licensing and data flows are designed for each entity rather than copied from one jurisdiction.

The decision should follow customers, banking partners, licence scope, management substance, data location and tax advice. Beneficial-owner register mechanics are one input, not a substitute for the full incorporation and licensing analysis.

Six-step rollout checklist

1. Map each entity to the correct regulator and rule. Identify the Hong Kong supervisor or Singapore MAS notice family before writing requirements.
2. Build the corporate registers and KYB evidence together. Keep the SCR or RORC consistent with cap tables, nominee records and bank onboarding materials.
3. Apply ownership and control tests precisely. Record more-than-25% interests and unwind control through other means to the relevant natural persons.
4. Design PEP controls around risk. Identify family and associate exposure without replacing proportionality with indiscriminate EDD.
5. Wire STR escalation to the correct FIU. JFIU in Hong Kong, STRO in Singapore, with documented no-tipping-off controls.
6. Monitor changes and retain evidence. Use a five-year AML baseline, then overlay longer legal or business requirements where applicable.

For the wider multi-market control model, read our Cross-Border KYC/KYB Customer Due Diligence guide.

Hong Kong vs Singapore KYC/KYB at a glance

FAQ

Is KYC stricter in Singapore or Hong Kong? Neither is categorically stricter. Hong Kong applies AMLO through multiple sector supervisors; Singapore uses sector-specific MAS notices. The operational burden depends on the entity, licence, customer risk and product.

What is the beneficial ownership threshold in each market? For the corporate controller registers compared here, both use more than 25% of shares or voting rights, together with separate tests for significant influence or control. Financial-institution CDD must follow the definition in the applicable rule and sector guidance.

How quickly must controller-register changes be updated? In Hong Kong, SCR particulars are generally entered within seven days after confirmation for a registrable person or after the particulars come to the company's notice for a registrable legal entity. In Singapore, the private RORC is updated within seven days after notification, followed by Central RORC filing within two business days.

Can investors search Singapore's Central RORC? No. The Central RORC is not available to the general public. Company officers, registered corporate service providers and authorised law-enforcement agencies have access for their respective functions. Current nominee status may appear separately on a purchased company business profile.

How do the regimes differ for virtual-asset businesses? Hong Kong applies the SFC VATP regime and AMLO Travel Rule requirements. Singapore applies the Payment Services Act and relevant MAS notices, including PSN01 and PSN02. The amount boundaries and transfer-data rules must be configured per jurisdiction.