CMS Licence Fund Management Internal Audit Singapore: What MAS Actually Requires

MAS does not set a fixed audit cycle for CMS licence holders in fund management. Its own guidance is more specific and more useful than a blanket number of months: an FMC has adequate internal audit arrangements if it has a process for regular internal reviews of its systems and controls, calibrated to the size of the assets it manages and the number of investors it serves. That single standard, not a generic “annual audit” assumption, is what actually shapes a CMS licence fund management internal audit in Singapore.

This distinction trips up a lot of licensed fund managers. Some treat internal audit as a fixed annual box-ticking exercise copied from a template. Others under-invest in it because no specific frequency is written into the Securities and Futures Act (SFA). Neither reading matches what MAS is looking for, and both create exposure at the next thematic inspection or licence renewal review.

This guide covers who needs an internal audit, what MAS expects it to cover, how often it realistically needs to happen, and who is allowed to perform it.

Who Needs an Internal Audit Under the CMS Licence Regime

Two categories of CMS licensee carry out fund management business in Singapore today. Licensed Fund Management Companies (LFMCs) are split between Retail LFMCs, which can serve the public, and Accredited/Institutional LFMCs (A/I LFMCs), restricted to accredited and institutional investors. Venture Capital Fund Managers (VCFMs) operate under a separate, lighter-touch regime for managers running venture capital strategies.

The lighter-touch Registered Fund Management Company (RFMC) category that used to sit alongside these no longer exists. MAS repealed the RFMC regime with effect from 1 August 2024, and existing RFMCs transitioned to A/I LFMC status. Any internal guidance, checklist, or article still built around an RFMC track is out of date. If your firm is weighing which of these categories applies, our overview of fund management licences in Singapore sets out the distinctions in more detail.

All three current categories, Retail LFMC, A/I LFMC, and VCFM, fall within MAS’s internal audit expectations. The scale of what is expected differs by firm size and complexity, but the underlying obligation to maintain adequate audit arrangements does not depend on which of the three you hold.

How MAS Defines “Adequate” Internal Audit Arrangements

Under the SFA, MAS expects the business activities of every FMC to be subject to adequate internal audit, with arrangements that are commensurate with the scale, nature, and complexity of the firm’s operations. In practice, MAS has confirmed that it will treat a firm as having adequate arrangements if it maintains a process for regular internal reviews of the effectiveness of its systems and controls, taking into account the assets it manages and the number of investors it serves. There is no separate fixed frequency written into the guidelines.

This internal audit of controls is distinct from the independent annual audit of financial statements that FMCs must also arrange under the SFA and the Securities and Futures (Licensing and Conduct of Business) Regulations [SF(LCB)R]. That statutory audit of accounts is an annual, external requirement. The internal audit of systems and controls is the flexible, risk-based one, and it is the one most firms get wrong by either over- or under-scheduling.

MAS allows three ways to perform the internal audit:

• An internal audit function based within the FMC itself.
• An internal audit team from the FMC’s head office or group, where the FMC can rely on centralised group auditors for functions such as trade execution or risk management that are handled at head office level.
• A competent third-party service provider engaged to perform the work independently.

Whichever model is used, the FMC keeps ownership and responsibility for the outcome. Outsourcing registers do not need to be submitted to MAS every year as a matter of course, but MAS can request them, and the FMC is expected to produce them promptly.

How Often Should the Audit Actually Happen

Because MAS ties adequacy to scale and complexity rather than a fixed date, the practical answer depends on the firm. As a working benchmark, Alder recommends a comprehensive internal audit every 12 to 18 months for most LFMCs and VCFMs, with the cycle shortened when any of the following apply:

• The firm has recently launched a new fund, strategy, or investor category.
• Assets under management or headcount have grown materially since the last review.
• A previous audit or MAS inspection flagged findings that need to be closed out and re-tested.
• The client base includes higher AML/CFT risk profiles, such as complex ownership structures or higher-risk jurisdictions.
• The firm is within its first 12 months of holding a CMS licence, when systems and controls are least tested.

Core Areas a CMS Licence Internal Audit Should Cover

Risk Management and AML/CFT Controls

AML/CFT obligations for CMS licensees sit under MAS Notice SFA04-N02, on the prevention of money laundering and countering the financing of terrorism. The Guidelines to this Notice were updated with effect from 1 July 2025, expanding requirements around identifying and verifying beneficial owners and introducing quality-assurance checks, such as a second review on closed sanctions alerts. An internal audit should test whether the firm’s AML/CFT policies and procedures reflect these updates, not just the version in place when the framework was first drafted.

On the investment risk side, MAS issued an Information Paper on Risk Management Practices for Fund Management Companies on 29 May 2026. It does not create new rules, but it sets out, in detail, what MAS expects to see in governance over fund launches, investment due diligence, conflicts of interest, and ongoing monitoring, based on findings from thematic inspections. A current internal audit should benchmark the firm’s practices against this paper rather than against older, more generic risk management checklists.

Fund Valuation Governance

MAS’s companion Information Paper on Valuation Practices for Fund Management Companies, also issued on 29 May 2026, sets out supervisory expectations for valuation governance, including a three-level fair value hierarchy (quoted prices, observable inputs, and unobservable inputs) and a clear expectation that valuation be overseen by senior management independent of the portfolio management function. This is particularly relevant for funds holding private credit or other hard-to-price assets. An internal audit should confirm that valuation methodologies are applied consistently, that judgement calls are documented, and that any third-party valuers or fund administrators used are genuinely independent.

Operational Controls and Outsourcing Oversight

Where functions are outsourced, whether to an external provider or to a related company within the group, the FMC retains ownership and responsibility for that function. Good practice for the audit includes:

• Maintaining clear service level agreements for every outsourced function.
• Reviewing vendor performance and security practices on a periodic basis.
• Keeping a centralised outsourcing register, including intra-group arrangements, ready to produce to MAS on request.

Where a function such as trade execution or risk management is handled by a head office team, the FMC does not need to commission a separate audit of that function if it can rely on the group’s own internal audit coverage of it.

Client Onboarding, KYC and Filings

Onboarding procedures should capture the CDD and beneficial ownership information required under the AML/CFT Guidelines while respecting data privacy obligations. Conflict-of-interest checks at onboarding and at regular intervals thereafter remain a standard audit item. On the filings side, the audit should confirm that periodic returns and other MAS submissions are accurate and made on time, and that supporting records are retained in a form that can be produced quickly if MAS requests them.

Choosing How to Resource the Internal Audit Function

Why an Independent Review Matters Ahead of a MAS Inspection

An internal audit conducted with genuine independence, whether in-house, group-based, or outsourced, gives the board and senior management an honest picture of where controls are working and where they are not. MAS’s own Good Practices for Auditors of Fund Management Companies sets out baseline expectations for anyone performing this work, and firms that align their audit approach with it are better placed to close gaps before a thematic inspection rather than during one.

Working With Alder

Alder supports LFMCs and VCFMs with outsourced compliance advisory, including internal audit support scoped to your firm’s size and risk profile, drawing on the current MAS guidelines set out above. Where a client needs the audit itself performed by an independent third party, this is arranged through our sister company, Hub Corporate Services.

Frequently Asked Questions