The Monetary Authority of Singapore (MAS) published its Enforcement Report 2025/2026 on 7 October 2026, covering the period from 1 January 2025 to 30 June 2026. Its section on Key Observations from Enforcement Cases gives financial institutions a practical basis for reviewing their own controls. The cases show how weaknesses in compliance, risk management and management oversight can affect an institution’s ability to continue operating.
For boutique and mid-sized firms, the value lies in examining the failures behind the enforcement outcomes. Several involve familiar responsibilities: maintaining an adequate compliance function, monitoring capital, assessing investments and responding to identified deficiencies. The report is a retrospective account of enforcement action, rather than a new set of rules.
A licence depends on continuing compliance
MAS highlights three licence revocations involving fundamental non-compliance. One capital markets services licensee failed to maintain a compliance function appropriate to its business and ensure the submission of its regulatory reports and notifications. Another failed to meet capital requirements and submit quarterly returns despite repeated reminders. A payment institution had serious risk management weaknesses and conflicts of interest, and repeatedly provided false or misleading information to MAS.
The practical lesson is that ongoing obligations need clear ownership and escalation. Boards should be able to see whether capital requirements are being met, returns are being submitted and the compliance function has sufficient resources. Repeated delays in addressing a known breach warrant direct management attention. Firms also need to verify the accuracy of information supplied to the regulator.
Risk frameworks must reflect the business
MAS observed financial institutions using generic risk management frameworks that were insufficiently tailored to their particular risks. The consequences were concrete. At one fund manager, deficiencies led to incorrect management fees, while conflicts arising from a director’s involvement in an underlying investment were inadequately managed. At another, weaknesses in a loan fund’s framework resulted in inadequate credit assessments of debtors.
Senior management at these firms were also reprimanded or prohibited from the industry for failures in risk management, compliance and oversight. Responsibility therefore extended beyond the institution itself.
For a smaller manager, a useful review would trace a sample of actual transactions through the relevant controls. How was creditworthiness assessed? Who checked the fee calculation? How was a director’s conflict identified and managed? The answers help establish whether the framework addresses the risks arising from the firm’s own products and activities.
Account records need to reflect who is trading
The capital markets cases highlight the use of other people’s trading accounts to obscure involvement in market misconduct. In one case, a market manipulator used 13 accounts belonging to friends and associates to create the appearance of trading by multiple participants. Another case involved a trading representative executing trades on a third party’s instructions through three accounts to manipulate a share price.
For firms handling trading instructions, these examples provide a reason to test how authorised instructions are verified and how unusual third-party involvement is escalated. Customer records, trading permissions and monitoring should work together. An account bearing a customer’s name does not, by itself, explain who is directing the activity.
AML remediation requires sustained management attention
MAS describes its approach to anti-money laundering and countering the financing of terrorism (AML/CFT) breaches as risk-proportionate. Financial penalties reflect the nature, severity and impact of the failings. Where serious deficiencies were not addressed promptly, MAS imposed stronger measures, including business restrictions pending remediation, and held responsible senior management and other key individuals accountable.
The report emphasises board and senior management oversight and timely correction of weaknesses. A practical response is to require each significant finding to have a responsible owner, a deadline and evidence of completion. Overdue actions should reach the appropriate decision-makers, while closure should include checking that the revised control works in practice.
Using the cases to review existing controls
The cases offer a useful starting point for a focused management review. Boards and compliance teams can start with four checks:
• Confirm that the compliance function has the competency, resources and authority needed for the current business.
• Test key controls using actual client files and transactions..
• Identify unresolved findings that could affect customers, investors or regulatory obligations..
• Arrange independent review of the evidence supporting closure of significant findings..
For a lean team, this review can help direct limited resources towards the controls most relevant to its activities. It also gives the board a clearer basis for deciding where additional expertise or independent assurance is needed.
Alpadis supports boutique and mid-sized financial institutions in Singapore with regulatory compliance, AML/CFT frameworks and independent internal audit. Our Regulatory Services team can assess control gaps, review policies and test whether governance and compliance arrangements are operating effectively, and support you in the execution of your compliance obligations.
