How Often Should You Review Your Compliance Policies?

A surprising number of Capital Markets Services (CMS) licensees in Singapore are still operating on the compliance policy manual they drafted at the point of licensing — sometimes years earlier, with no formal review in between. Keeping policies current is not a bureaucratic nicety; it is one of the more common gaps that surfaces during an MAS supervisory review, and one of the more avoidable ones.

The good news is that a compliance policy review does not require a large team or an expensive project. It requires a clear cadence, explicit ownership, a defined list of trigger events, and a habit of checking each policy against what the firm actually does. This article sets out how to build that.

Why Do Compliance Policies Go Stale?

Policies go out of date for entirely ordinary reasons: MAS notices get amended, the firm’s business activities or client base evolve, headcount and reporting lines change, and new products or services get launched without the compliance manual being updated to reflect them. None of this happens through negligence — it happens because policy review isn’t built into anyone’s ongoing workflow. As a result, it only gets attention when something forces the issue: a licence variation, an inspection notice, or a new hire asking why the manual doesn’t match reality.

There is a second, quieter cause. Many firms adopted a manual drafted by an external provider at licensing and never truly took ownership of it. Nobody feels qualified to change it, so nobody does — and the gap between the document and the business widens every quarter.

What Does “Up to Date” Actually Mean to MAS?

An up-to-date policy is not simply one that has been re-approved on schedule. It needs to accurately describe what the firm actually does — its current organisational structure, its current risk assessment, and its current operational processes — and it needs to reflect the current version of the MAS notices and guidelines it is meant to implement.

Put differently, MAS is testing three things at once:

• Regulatory currency — does the policy reflect the rules as they stand today?
• Operational accuracy — does it describe how the firm genuinely works, including the workarounds?
• Governance evidence — can you show who reviewed it, when, what changed and who approved it?

A policy can pass the first test and fail the other two. That is the most common position firms find themselves in.

What’s the Difference Between a Policy and a Procedure?

This distinction is worth getting right before you design a review cadence, because conflating the two is what makes policy maintenance feel impossible.

A policy states what the firm does and why — the principle, the obligation it discharges, the roles accountable. It changes infrequently and warrants senior sign-off. A procedure states how the work is performed — the system screens, the forms, the approval steps, the named individuals. It changes often and should be maintained by the function that runs it.

Firms that fold procedural detail into board-approved policies end up in one of two places: either the document is amended constantly and governance becomes meaningless, or it is never amended and the procedures described are quietly obsolete. Separating the layers lets you keep principles stable while procedures stay current, and it makes the annual review a manageable exercise rather than a rewrite.

How Often Should You Review Your Compliance Policies?

Most CMS licensees can manage this with a two-track cadence: a scheduled annual review of the full policy suite, often aligned with the annual compliance review, and a triggered review whenever a relevant MAS notice, guideline or consultation response is finalised, or whenever the firm’s own business activities materially change.

Within the annual track, not every policy deserves equal attention. Risk-tiering the suite means the core regulatory policies get genuine scrutiny while low-risk administrative documents get a lighter touch.

Core policies — AML/CFT, conduct of business, risk management, outsourcing — generally warrant closer attention than lower-risk administrative policies.

Which Events Should Trigger an Immediate Review?

The annual review is the floor. The reviews that actually prevent findings are the event-driven ones, and they are easy to miss without a defined trigger list. Treat any of the following as a prompt to review the affected policies within a set period rather than waiting for the next cycle:

• A new or amended MAS notice, guideline or circular affecting your regulated activities
• A change in law with cross-cutting effect — data protection, sanctions, tax reporting or employment
• New products, strategies, asset classes or jurisdictions, reviewed before launch rather than after
• A new client segment, particularly a shift toward retail or higher-risk investor types
• Changes in key personnel — a new CEO, compliance officer, director or MLRO changes who owns what
• A new material outsourcing arrangement or a change of administrator, custodian or core system
• A breach, incident, complaint or near-miss, where the root cause points to a gap between policy and practice
• An MAS inspection finding or industry-wide thematic review, even where your firm was not inspected
• Enforcement action against a peer for a failure your own controls might not prevent
• Material growth in headcount or assets that outpaces the control environment

A current example of a trigger that reaches well beyond financial services regulation: the change in how organisations may use NRIC numbers for authentication. It affects onboarding forms, call centre verification scripts, document security and HR records — and it is precisely the kind of cross-cutting development that gets missed when policy review is left to the annual cycle. We cover the detail and the remediation steps in our article on the PDPA changes to NRIC use and what businesses need to do.

Which Policies Should Be in Your Review Inventory?

Before you can review on a cadence, you need a list. For a typical CMS licensee or licensed fund management company, the inventory usually covers:

• Compliance manual and compliance monitoring programme
• AML/CFT policy and procedures, plus the enterprise-wide risk assessment
• Client onboarding, classification and suitability
• Conflicts of interest, personal account dealing, gifts and entertainment
• Order handling, best execution, trade allocation and error correction
• Valuation and pricing
• Client money and asset handling
• Outsourcing and vendor management
• Technology risk, cyber hygiene and business continuity
• Data protection and records retention
• Marketing and communications review
• Complaints handling, breach and incident reporting
• Training, competency and continuing professional development
• Whistleblowing and staff conduct

Build this as a simple register with four columns: policy name, owner, last reviewed, next review due. That single sheet answers most of what an inspector will ask about policy governance, and it makes obvious which documents have drifted.

What Does a Substantive Policy Review Actually Involve?

“Reviewed” should mean more than “read and re-approved”. A defensible review runs through six steps:

1. Regulatory gap analysis. Compare the policy against the current notices and guidelines it implements, noting amendments since the last review.
2. Walkthrough against practice. Sit with the people who perform the process and confirm the document describes what they actually do. This is where most gaps surface.
3. Sample testing. For higher-risk policies, test a small sample of files or transactions to confirm the control operated, not just that it exists on paper.
4. Resolve the differences. Where policy and practice diverge, decide deliberately: either the practice changes to meet the policy, or the policy is amended because the practice is sound. Record which, and why.
5. Approve and version. Obtain sign-off from the policy owner and, for core regulatory policies, from the CEO or board.
6. Communicate and train. Circulate the updated policy, train affected staff on what changed, and collect attestations. An updated policy nobody has read has not changed anything.

Step four is the one firms skip. Discovering that the manual doesn’t match practice is uncomfortable, and the temptation is to quietly update the document. But the choice between changing the practice and changing the policy is a risk decision, and MAS will want to see it was made consciously.

What Should Your Version Control and Audit Trail Show?

Beyond the content itself, MAS inspectors expect to see evidence of the review process: a version history showing when each policy was last reviewed, who reviewed it, what changed and why, and explicit sign-off from the designated policy owner.

In practice, a version control block at the front of each policy should capture the version number, effective date, reviewer, approver and approval date, a short summary of changes from the previous version, and the next scheduled review date. Retain superseded versions rather than overwriting them — if an inspector asks what your policy said at the time of a historical transaction, you need to be able to answer. Align the retention period for superseded policies with your wider record-keeping obligations.

What Happens When Policies Are Out of Date?

Outdated policies create risk on two fronts. Operationally, staff may be following an outdated or informal process that was never properly documented or risk-assessed. From a supervisory perspective, a policy that visibly hasn’t been touched in years — or that describes a process the firm no longer follows — signals to an MAS inspector that governance isn’t being actively maintained, which tends to invite closer scrutiny of everything else in the compliance framework.

There is a sharper version of this risk that firms underestimate. A policy is a statement of what you told your regulator you would do. If your documented policy is more demanding than your actual practice, you have created a self-inflicted breach — you are failing to follow your own framework, which is a finding in itself regardless of whether the underlying regulation was breached. This pattern shows up repeatedly in supervisory outcomes: our review of recent MAS enforcement actions and the lessons for regulated firms shows scrutiny consistently landing on controls that existed on paper but were never operated.

Who Should Own the Review?

Policy review works best when ownership is explicit rather than assumed.

How Do You Align Policy Review with the Annual Compliance Cycle?

Policy review shouldn’t run as an isolated exercise disconnected from the rest of the firm’s compliance calendar. Firms get the most value when policy review is timed to feed into, or draw from, the annual compliance review, fit and proper reassessments, and any internal or outsourced compliance audit — so that findings from one process inform updates to the other, rather than three separate teams independently re-discovering the same gaps.

A workable sequence for a firm with a December year-end: monitoring and testing through the year feeds a compliance review in the first quarter; findings from that review drive policy updates in the second quarter; updated policies are approved and rolled out with training before the half-year; and the register’s next-review dates reset from there. The point is that policy changes should be an output of your monitoring, not a parallel activity that never touches it.

What If Your Policies Have Already Fallen Behind?

If it has been several years, don’t attempt a full rewrite in one pass — that is how these projects stall. A staged approach over roughly 90 days works better:

• Weeks 1–2: Build the policy register. Name every document, its owner and its last review date. Accept that some entries will say “unknown”.
• Weeks 3–6: Triage. Review the core regulatory policies first — AML/CFT, conduct of business, risk management, outsourcing — against current notices and actual practice.
• Weeks 7–10: Remediate the highest-risk gaps, approve the updated core policies, and roll out training with attestations.
• Weeks 11–13: Work through the remaining policies, set next-review dates, and document the cadence and trigger list so the position doesn’t recur.

Keep a record of the exercise itself. A firm that identified a gap and remediated it on a documented plan is in a materially stronger position than one that was found to have the same gap.

Where Should You Start?

Treating policy review as a continuous discipline, rather than a one-off exercise from the licensing stage, is one of the more cost-effective ways a CMS licensee can reduce its inspection risk. It doesn’t require a large team — it requires a clear cadence, clear ownership, and a habit of checking policies against what the firm actually does, not just re-approving what’s already on file.

If you do only one thing this quarter, build the policy register. Everything else follows from knowing what you have, who owns it, and when it was last genuinely looked at. Firms without the internal bandwidth to run this cycle often find outsourced policy drafting and review more practical than hiring for it.

This article is for general information only and does not constitute legal or regulatory advice. Contact Alder for advice specific to your circumstances.