In this guide · 8 sections
- 01Who must register as a corporate service provider
- 02What CDD records a CSP must keep
- 03Video calls, director consent and e-signatures
- 04Controlling Bizfile and Corppass access
- 05Where to store CDD files securely
- 06Backups and incident planning for CSP records
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Registered CSPs must keep all customer due diligence records for 5 years after the relationship ends, in a way that lets each transaction be reconstructed, and must control who can file through Bizfile. Store CDD files in one access-controlled, backed-up location, not in email and personal drives.
Who must register as a corporate service provider
ACRA's page on the Corporate Service Providers Act 2024 sets out the scope: all business entities carrying on a business of providing corporate services in and from Singapore must register as CSPs, even if they never file transactions with ACRA for customers. That includes businesses carrying out designated activities connected with accounting services.
Former registered filing agents were moved to CSP registration automatically on 9 June 2025, and registrations now run for two years. Penalties are significant: operating without registration can bring a fine of up to S$50,000 or two years' jail, and a breach of AML, CFT or proliferation financing duties up to S$100,000 per breach for the CSP and, separately, for its senior management.
ACRA's overview for CSPs lists the ongoing duties. This guide focuses on the parts that live in your IT: records, access and evidence.
What CDD records a CSP must keep
ACRA's Guidelines for Registered CSPs (version of 8 July 2025) quote regulation 20 of the CSP Regulations: for each customer and agent you must obtain and record at least the following.
- Full name, including any alias.
- Identity card, birth certificate or passport number for individuals; incorporation or registration number for entities.
- Residential or business address and contact number.
- Date of birth, incorporation or registration.
- Nationality or place of incorporation.
- For companies: the identities of all directors, and beneficial owners as required.
On top of identification, you keep customer risk assessments, screening results, records of ongoing monitoring, evidence for non-face-to-face verification, and copies of signed director consent forms. The guidelines state that the record-keeping period is 5 years, beginning on the date the CSP stops providing corporate services to the customer, and that records must be kept in a way that allows individual transactions to be reconstructed.
Video calls, director consent and e-signatures
Some of the new duties generate evidence that has to be stored somewhere sensible.
| Duty in the ACRA guidelines | What you must keep | IT tip |
|---|---|---|
| Live video call for remote incorporations or shelf company transfers (para 6.48) | Proper records of the call; recording is encouraged; a screenshot is mandatory (para 6.50) | Save the screenshot into the client's CDD folder the same day, with the date in the file name |
| Director not physically present (para 6.51) | A copy of Form 45 signed by the proposed director; the CSP must not sign it on the director's behalf | Keep the signed copy and the signing platform's audit trail |
| Customer screening (para 6.24 to 6.25) | Documented results of screening and any follow-up | Export results to PDF; do not rely on a screening tool's history alone |
| Ongoing monitoring (para 6.57) | Records of reviews and enhanced monitoring | Use a simple review log per client with dates |
The guidelines note that notarised documents and identity verification tools cannot replace the live video call for those transactions. For signatures, a platform that records signer identity, time and IP gives you better evidence than a scanned page; our comparison of DocuSign and Sign with Singpass covers the options.
Controlling Bizfile and Corppass access
Filing for clients happens through ACRA's electronic transaction system (Bizfile), reached with Corppass. The guidelines require CSPs that file for customers to have internal policies, procedures and controls (IPPC) so that the system is used only for transactions authorised by the customer, and only by a registered qualified individual (QI) or an authorised employee supervised by one.
List everyone with filing access
Use Bizfile's CSP employee list (downloadable as CSV or XLSX) and compare it with your staff list.
Remove leavers the day they leave
Revoke Corppass and Bizfile access as part of offboarding, not at the next review.
Tie each filing to client authority
Keep the client's instruction (email, signed engagement or portal approval) in the client file before filing.
Protect the Corppass admin role
Limit the Corppass admin to one or two senior people with Singpass 2FA on their own devices. Our guide to Corppass roles explains the set-up.
Review access each quarter
Record the review date and outcome, which also helps when ACRA conducts a compliance review.
Where to store CDD files securely
Most small CSPs already pay for Microsoft 365 or Google Workspace. Either can hold CDD records properly if set up with care. The common failure is records spread across email attachments, WhatsApp chats and staff laptops, which makes reconstruction and disposal almost impossible.
CDD storage checklist
The compliance officer must have timely access to all customer records, so avoid systems where only one person holds the key. If you are setting up a client upload channel, see our guide to secure client portals for accounting firms.
Backups and incident planning for CSP records
Five years is a long time for data to survive. Ransomware, an accidental bulk delete or a staff member wiping a shared folder on the way out can destroy records you are legally required to produce.
Cloud suites keep deleted items for a limited time only, so a third-party backup of SharePoint or Google Drive is worth having for the CDD area. Test a restore at least once a year and write down how long it took. Our guide to backing up Microsoft 365 and Google Workspace compares the options.
A breach of CDD files is also a personal data breach. If it is likely to cause significant harm, or affects 500 or more people, the PDPA requires notification to the PDPC within three calendar days of assessing it. Accounting and CSP firms are targets for payment fraud and identity theft; our accounting firm cybersecurity guide covers email and device defences.
Do it yourself or get help?
The policies (risk assessment, screening, monitoring) are compliance work for your QI and compliance officer. The storage, access control and backups are IT work, and they are what ACRA will see when it asks you to retrieve a file.
Our Microsoft 365 / Google Security Lockdown (S$590) sets up a restricted CDD area with MFA, sharing limits and audit logs. Backup & Ransomware Recovery (S$290) adds an independent backup with a tested restore, and the PDPA Compliance Pack (S$690) covers retention and breach procedures. This guide is general information, not legal advice; check the CSP Regulations and ACRA's guidelines for your exact duties.
Frequently asked questions
ACRA's Guidelines for Registered CSPs state that the prescribed period under section 17(5) of the CSP Act is 5 years, beginning on the date the CSP stops providing corporate services to the customer. The records must be kept in a way that allows individual transactions to be reconstructed, including amounts and currencies where relevant.
ACRA does not currently require the call to be recorded, though it strongly encourages it. It does require you to take and keep a screenshot of the call as evidence that it happened with the right person and that verification was done through live interaction. Keep the screenshot with the client's CDD records.
Yes, for CDD purposes. The CSP Regulations require you to obtain and record identity card or passport numbers, and the PDPC's NRIC guidance allows collection where required by law. You still have to protect the data, restrict access, and dispose of it when the retention period ends.
Only registered qualified individuals employed, engaged or appointed by the registered CSP, or authorised employees working under a registered QI's supervision. The CSP must have internal controls so the system is used only for transactions authorised by the customer, and must assess those controls regularly.
Usually yes, if configured properly: a dedicated, access-restricted location, MFA, external sharing off, audit logging on, and a separate backup. The risk is not the platform but scattered files in email and personal drives, which make retrieval, reconstruction and timely disposal difficult.