AML Policy Management Software for GIFT City & Singapore

Short answer. An entity regulated by IFSCA in GIFT IFSC must have an AML/CFT policy approved by its governing body, under the IFSCA (AML, CFT and KYC) Guidelines, 2022. A fund management company in Singapore must have AML/CFT policies, procedures and controls under MAS Notice SFA04-N02, approved by senior management. If you run both, you can keep one group policy and say locally only what each regulator needs said differently. The hard part is not writing the first version. It is proving, at any later date, which version was in force, who approved it and which clause each section answers.

This guide is for compliance officers and MLROs who hold, or are applying for, a licence in GIFT IFSC, a fund management licence in Singapore, or both. It covers what each regulator asks for, how a group policy with local addenda works in practice, and what good AML policy management looks like from the first day.

GIFT IFSC: the IFSCA (AML, CFT and KYC) Guidelines, 2022

The International Financial Services Centres Authority issued its AML, CFT and KYC Guidelines in 2022 and has updated them since. They apply to regulated entities in GIFT IFSC across banking, capital markets, funds, insurance and finance companies. Chapter I sets out the duties of a regulated entity, and clause 1.5 is the one every policy owner should know by heart. It reads:

"Every Regulated Entity shall formulate an AML-CFT policy, which shall be duly approved by the Governing Body or by a committee to whom such power has been delegated by the Governing Body."

Three things follow. First, the policy is mandatory for every regulated entity the Guidelines cover, not only for banks. Second, approval sits with the governing body, which for most entities means the board, or a committee the board has delegated that power to. A policy signed only by the compliance officer does not meet the clause. Third, the policy is expected to incorporate the key elements of the Guidelines: the risk-based approach, the enterprise-wide risk assessment, customer risk rating, customer due diligence (including enhanced and simplified measures), reliance on third parties, record keeping, suspicious transaction reporting, sanctions obligations, and how the policy applies across groups, branches and subsidiaries. Clause 5.11 adds what the KYC part must document, including how often customer due diligence is refreshed for each risk category.

The Guidelines do not state a review period for the policy itself. They do expect it to be kept current, and most boards set an annual review. Two related documents come up often. A written sanctions screening procedure is good practice rather than a separate requirement in terms, because the screening and freezing duties in clause 11 are binding either way. A V-CIP policy and SOP matter only if you onboard customers through video-based identification.

Singapore: MAS Notice SFA04-N02 for fund managers

In Singapore, the AML/CFT notice that applies to a fund management company holding a capital markets services licence is MAS Notice SFA04-N02, the notice for capital markets intermediaries. It is easy to cite the wrong one. MAS Notice 626 is the banks' notice, and a fund manager's policy that rests on it is resting on rules not addressed to it.

Paragraphs 14.1 and 14.2 of SFA04-N02 deal with the licensee's internal policies, procedures and controls against money laundering and terrorism financing, including compliance, audit and training. Paragraph 4.3(a) requires those policies, procedures and controls to be approved by senior management. The Notice also expects, among others, a procedure for suspicious transaction reporting (paragraph 13.1), record retention for at least five years (paragraph 11.3), screening of employees and representatives on hiring (paragraph 14.13), and, for a Singapore-incorporated licensee with branches or subsidiaries in its financial group, a group policy (paragraph 14.4).

MAS Guidelines sit alongside the Notice: outsourcing, technology risk management, business continuity, individual accountability and conduct, and internal controls. They are guidance, not law. A well-run fund manager usually has policies on each, but an inspector will read them as expectations, and a policy register should label them that way rather than presenting them as binding.

Where the two regimes differ

Both regimes rest on the FATF standards, so the bones of an AML/CFT policy are the same: risk assessment, customer due diligence, screening, monitoring, reporting, record keeping, training and governance. The differences that matter for the policy document are in who approves it, which instrument it answers to and how guidance is treated.

Five mistakes come up repeatedly when one team writes for both places:

• Citing the wrong instrument, most often the banks' notice in a fund manager's policy.
• A policy signed by the compliance officer alone, where the regulator names the governing body or senior management.
• Guidance copied in as "shall", which turns a regulator's expectation into a firm commitment nobody chose to make.
• A group policy with no check that each jurisdiction's own obligations are actually covered by the text in force there.
• No record of which version was in force on a given date, which is the first thing an inspector asks about a historical transaction.

One group policy with local addenda

Groups that hold licences in both places often start with two separate AML policies and end up with two documents that drift apart. A better structure is one group AML/CFT policy that carries the common standard, plus an addendum per jurisdiction that changes only what the local regulator needs said differently: the approving body, the local reporting route, record-retention periods, the local sanctions lists and any local due diligence thresholds.

The test of that structure is whether you can answer, for each jurisdiction, "what text is in force here today, and does it cover every local obligation?" That means reading the group sections and the addendum together, section by section, and checking coverage against that jurisdiction's own rules. When the group policy changes, the addendum's coverage has to be re-checked too.

In Policy Register, a policy becomes a group policy when it gets its first jurisdiction addendum. The addendum starts from the group sections you choose, overrides only those, and can add local sections. For each jurisdiction the group page shows the composite in force there, each section marked as group, local override or local addition, with coverage computed on that composite against that regulator's obligations. Group and addenda live within one Omnified organisation, and each addendum is drafted, approved and versioned like any other policy.

A regulatory policy register mapped to IFSCA and MAS

A policy folder answers "do we have an AML policy?" A regulatory policy register answers the questions an inspector actually asks: which obligations apply to us, which section of which approved policy covers each one, who owns it, when it was last checked, and what changed since. Policy Register keeps that register for IFSCA-regulated entities and, in Singapore, for fund management companies only.

• Each applicable obligation is listed with its citation, a verdict (covered, partial or gap), the policy section that covers it, an owner and the date it was last checked.
• Each verdict comes from your policy text and is reviewed by your team; anyone with the right role can overrule it with a written reason, and the override is recorded.
• When a rule your effective policy is mapped to changes, or a review date approaches, an upgrade task opens. Starting it creates a new draft in which only the affected sections are redrafted, and that draft goes to approval like any other version.
• Binding text is listed as required. Guidance is listed as recommended and never presented as law.

Where SEBI fits

Omnified publishes a public register of SEBI intermediaries at /register/sebi. SEBI rules are listed as coming soon. Policy Register does not yet draft or map policies to SEBI rules.

What a compliance officer gets on day one

The first week after a licence is granted is usually spent working out what must exist before commencement. Policy Register starts there.

• A Blueprint: every policy your regulator requires of an entity like yours, computed from your licence, activities and customers. Each item shows whether it is required, conditionally required or recommended, the clause that mandates it, the approving body, the review cadence (annual by default where the instrument states none) and its current state.
• Questions instead of assumptions: an item that depends on a fact, such as whether you belong to a financial group with overseas branches, is asked as a yes or no question.
• Three ways to fill a gap: draft with AI from the regulator's own text, upload the policy you already have (PDF, DOCX, Markdown or text), or write it in the section editor. Every route ends in the same approval queue.
• An obligations register that shows, once a policy is approved, what is covered, partly covered or missing, and who owns each obligation.
• Approval evidence by design: the author cannot approve their own version, and a board-level policy needs the board resolution and meeting date before it takes effect.

None of this replaces judgment. The regulator's text tells you what must be covered; your firm decides thresholds, systems and owners, and your governing body or senior management approves the result. What a register changes is how much of your week goes into reconstructing evidence, and how quickly you see that a rule moved under a policy that still reads as current.

Frequently asked questions

Does an IFSC entity need a board-approved AML policy?

Yes. Clause 1.5 of the IFSCA (AML, CFT and KYC) Guidelines, 2022 requires every regulated entity to formulate an AML-CFT policy approved by its Governing Body, or by a committee to which the Governing Body has delegated that power. For most entities that means the board.

Which MAS notice applies to fund managers?

MAS Notice SFA04-N02, the AML/CFT notice for capital markets intermediaries, which covers fund management companies holding a capital markets services licence. Paragraphs 14.1–14.2 deal with internal policies, procedures and controls, and paragraph 4.3(a) requires them to be approved by senior management. Notice 626 is the notice for banks.

Can one group policy cover IFSC and Singapore?

Yes, if each jurisdiction has an addendum for what its regulator needs said differently, such as the approving body, the reporting route and retention periods, and coverage is checked per jurisdiction on the group text plus the addendum. In Policy Register a group policy and its addenda sit within one organisation.

Do you cover SEBI?

Omnified publishes a public register of SEBI intermediaries at /register/sebi. SEBI rules are listed as coming soon. Policy Register does not yet draft or map policies to SEBI rules.

Related reading

• KYC and AML at IFSCA: onboarding investors from everywhere, under one rulebook
• IFSCA KRA integration: what GIFT IFSC entities should build
• Compliance policy register with clause-level citations
• Draft, map and track compliance policies to regulation: a how-to
• IFSCA regulated entities register
• Public MAS register of financial institutions
• SEBI intermediaries register
• Pilcrow: regulatory Q&A with verbatim citations
• About the author, Shubham Khandelwal

Sources

• IFSCA — AML, CFT and KYC Compliance (Guidelines, 2022, as updated)
• Monetary Authority of Singapore — regulations, notices and guidelines (mas.gov.sg)

This article is general information, not legal advice. Check the current text of the IFSCA Guidelines and MAS Notice SFA04-N02 before relying on any summary here. Screenshots show demo data for fictitious entities.

Source: Monetary Authority of Singapore (mas.gov.sg); MAS publications as obtained from the MAS website for the corpus release of 2 September 2026. For the latest version, see mas.gov.sg. Omnified is not affiliated with or endorsed by the Monetary Authority of Singapore. MAS's published text is authoritative and prevails over anything shown here; consult mas.gov.sg.