TRW & Co · Investigations and financial crime
Corporate Investigations Framework in Singapore
Corporate fraud investigations in Singapore should begin with a simple question: what facts and records do we need to decide the right path? The legal analysis turns on the specific offence under the Penal Code, accounting-records duties under section 199 of the Companies Act and proceeds risk under the CDSA. Stabilise, preserve, investigate under privilege, then decide reporting and remediation.
Key pointKeep "fraud" out of your vocabulary until the facts are verified: premature labels bias interviews, complicate engagement with authorities and employees, and can mis-scope the evidence you collect in the first critical days.
At a glance
Penal Code defines offences
The Penal Code 1871 sets out the offence definitions that may be engaged, so any criminal characterisation must map to a specific offence rather than a general "fraud" label.
Section 199 covers records
Section 199 of the Companies Act 1967 imposes accounting-records obligations. A record-keeping breach is a distinct question from whether an offence has been committed.
CDSA governs proceeds risk
The CDSA addresses dealing with benefits of criminal conduct, so the business must consider whether any proceeds have passed through its accounts or into its hands.
Four-move investigation sequence
Stabilise and contain live risk, preserve records and devices, run scoped fact-finding under privilege with proportionate interviews, then decide reporting and remediation on verified facts.
PDPA limits collection
The Personal Data Protection Act shapes what personal data you collect and how you use it, so over-collecting employee data in a hurry creates a separate exposure.
Swipe or scroll →
This guide to corporate fraud investigations in Singapore sets out how the rules apply in practice, which authority is involved, what evidence decision-makers need and where the common mistakes lie. It is written for boards, founders, general counsel and advisers working through Singapore.
Corporate fraud investigations in Singapore: the short answer
When a Singapore business detects a suspected irregularity—unusual payments, altered records, unexplained losses, or system overrides—the first decision is not “who did it?” but “what facts and records are needed to decide the right path?” The term “fraud” is a broad label; the legal analysis in Singapore turns on the specific offence (if any), the corporate record‑keeping duty that may have been breached, and whether any proceeds risk arises. The statutory anchors are the Penal Code 1871 for offence definitions, Companies Act 1967 section 199 for accounting‑records obligations, and the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 for proceeds‑of‑crime exposure. The Criminal Procedure Code informs evidence handling when criminal processes may follow, and the Personal Data Protection Act shapes how personal data is collected and used during an internal review.
A defensible investigation in Singapore is built in four moves: stabilise and contain live risk; preserve relevant records and devices; run a scoped fact‑finding review under privilege with proportionate interviews; and, based on verified facts, decide the reporting and remediation route. Keep the language neutral until facts are established. Do not promise recovery or name an offender based on preliminary indications. Treat employee fairness, regulator engagement, proceeds‑handling, and civil‑remedies options as distinct decision tracks requiring their own assessments and timelines.
For boards and senior executives, the practical objective is clarity—what happened, what records support that conclusion, what should be reported, to whom and when, and what remediation is proportionate. The approach outlined here is designed to withstand scrutiny from auditors, regulators, counterparties and courts. It is the same discipline that seasoned institutions apply across sectors, from financial services and logistics to technology and healthcare.
This insight focuses on choices and sequencing. For broader perspectives on investigations and risk, see our regional commentary at Perspective. When you need to align resourcing and stakeholders across practice areas, our capabilities overview at Our practices explains the teams that typically intersect on investigations and financial crime mandates.
Scope, authority and the distinction that changes the route
The route you choose depends on two scoping questions. First, what authority are you operating under? Second, what is the specific legal framework that might apply to the conduct and the records?
Authority and mandate. A board, audit committee or management may authorise a fact‑finding review for corporate purposes (for example, to confirm internal controls or consider employment action). That authority should be documented and define scope, objectives, and escalation points. Where criminal‑offence analysis is in view, the review team should anticipate that their methods and outputs may later be tested against criminal‑procedure expectations. The mandate should recognise legal privilege and confidentiality, set out who will be interviewed, and specify record‑preservation steps.
Frameworks that change the answer:
- Penal Code. Offence characterisation determines the elements to prove or refute (for example, dishonest intention, deception, forgery or cheating). This drives the evidence map: which communications, approvals, system logs and financial flows matter. It also influences the tone and timing of any referral to law‑enforcement authorities.
- Companies Act section 199. Irregularities often surface as gaps or manipulation in accounting records. Section 199 sets the duty to keep proper accounting and other records that sufficiently explain transactions and the company’s financial position. Weaknesses here may be a breach in their own right, independently of any offence analysis, and will matter to auditors and lenders.
- CDSA. If there is a realistic possibility that assets, payments, or benefits are proceeds of crime, the company must consider whether it holds or may deal with such property, and what risk controls to apply pending advice. This proceeds lens is separate from establishing an underlying offence.
- Criminal Procedure Code. Even where the review is internal, the team should plan as if their materials could be sought in later proceedings. Chain‑of‑custody discipline, interview notes quality, and device imaging protocols should reflect that possibility.
- PDPA. Internal reviews often involve personal data of employees, customers or third parties. The organisation should ensure that its purposes for collection and use are properly identified and notified, that access is limited to those who need to know, and that any cross‑border transfers follow company policy and law.
The practical distinction that changes the route is this: are you primarily managing a corporate‑governance and controls issue, or do the facts indicate a plausible criminal‑offence scenario or proceeds‑handling risk? The first path leans toward internal remediation and possibly employment action. The second path requires early consideration of criminal reporting, preservation for potential law‑enforcement engagement, and careful communication inside and outside the company. Many matters have elements of both; if so, manage them as parallel tracks with separate decision gates and advisers.
Process, documents and evidence
A structured internal review reduces noise and shortens time to decision. The process below is proportionate to most suspected‑irregularity scenarios in Singapore.
Records to secure and how to secure them
Start with preservation. Halt routine deletion where relevant, secure devices and shared drives, and collect key accounting records. Section 199 of the Companies Act requires sufficient accounting and other records to explain transactions and the company’s financial position. Where those records exist, ensure they are complete and unaltered before any substantive review. Where they do not, document the gap precisely; it will matter for remediation and reporting.
Typical preservation actions include the following, adjusted to scope and risk:
- Issuing a targeted hold notice to relevant custodians describing the categories to preserve (for example, specified email accounts, messaging platforms, finance‑system exports, approvals, supplier files, expense claims, and access logs).
- Securing accounting ledgers, journals, bank statements, reconciliations, payment‑run approvals, vendor‑master change logs, and any manual journal entries around the period of concern.
- Imaging relevant laptops or mobiles where proportionate and permitted by policy, using forensically sound methods with documented chain of custody.
- Preserving physical records such as contracts, delivery notes, inventory counts and warehouse‑access logs; consider CCTV or access‑control data if retention windows are short.
- Exporting system logs for enterprise resource planning (ERP), procurement and identity‑access management platforms, focusing on privilege escalations, override events and unusual log‑in patterns.
Collection should be as narrow as possible while sufficient to test the hypothesis. Over‑collecting creates cost and privacy risks without improving outcomes.
Interviews, fairness and documentation
Interviews aim to clarify how controls operate, what approvals were expected, and whether entries or payments reflect legitimate business purpose. Prepare with specific records in mind; show documents or extracts where necessary to anchor recollections.
Fairness and process matter. Use neutral language; do not characterise conduct as “fraud” in interviews or notes. Explain the mandate and confidentiality arrangements. For employees, follow workplace policies and give them a fair chance to respond to concerns supported by documents. Record who was present, what questions were asked, and the witness’s responses. Keep interview notes factual and avoid editorial conclusions. If legal privilege is being claimed over investigation work product, ensure that lawyers direct the work, the purpose is framed appropriately, and distribution is controlled.
Working with counsel and privilege
Early engagement with counsel helps structure the review around the Penal Code elements relevant to the suspected conduct, identify Companies Act and CDSA touchpoints, and configure privilege and confidentiality. Where criminal reporting is under consideration, counsel can assess whether and when to approach the authorities, how to protect evidence integrity, and how to position subsequent employer or civil actions so as not to prejudice potential proceedings under the Criminal Procedure Code.
Expect to revisit scope as facts evolve. Escalate if the review uncovers indications of intent to deceive, document alteration, undisclosed conflicts, or proceeds‑handling risk. Escalation does not require firm conclusions; it requires sufficient indicators that the reporting calculus may change.
Operational and commercial implications
Investigations do not occur in a vacuum. Even a tightly scoped review can affect operations, reputation, financing and counterparties. Decision‑makers should anticipate and plan for the following implications.
Disruption, communications and confidentiality
Containment steps—such as access restrictions, suspension from sensitive duties, or securing records—can slow business processes. Design compensating controls so core operations continue without signalling sensitive moves to a wide audience. Limit communications to need‑to‑know groups and avoid speculative explanations. For customers and suppliers, restrict messaging to operational facts (for example, “we are reviewing process controls affecting X function”); avoid legal characterisations until facts are established and advice obtained.
Investor and auditor interactions may be time‑critical. Auditors will ask how the company satisfies section 199 obligations and whether controls addressed the risk. Provide a clear, factual chronology, the preservation steps taken, and the plan for remediation. If the company is part of a group, coordinate with the parent’s governance and disclosure framework.
Financial reporting and disclosures
Where accounting entries are in scope, consider whether misstatements may require correction or disclosure under applicable standards and listing rules (if relevant). The existence of a suspected irregularity does not itself determine disclosure; materiality and certainty matter. Keep the disclosure file contemporaneous: the trigger event, steps taken, findings to date, and advice received. Distinguish clearly between known facts, working hypotheses and open questions.
Counterparty and contract clauses may be engaged by suspected misconduct, including termination, audit rights, or representations on compliance. Avoid precipitous notices until the facts are clearer; but do review notice periods and evidence thresholds so that the company is prepared to act once conclusions are supported. Consider whether insurance notification is required under fidelity, crime or D&O policies.
Where proceeds risk is in view, operational decisions—such as paying a suspect invoice, releasing collateral, or on‑paying funds—should be paused or conditioned pending advice, given the potential exposure under the CDSA framework. Separate the team controlling potentially tainted funds from day‑to‑day approvers to reduce inadvertent handling.
Corporate fraud investigations in Singapore: how the first fortnight plays out in practice
The early days of a suspected fraud decide what the business can prove months later. The scenario below shows the decision points that most often go wrong, and how a disciplined sequence avoids them.
Illustrative scenario: unexplained vendor payments
Illustrative only; the facts are invented to show the decision points.
A mid-sized logistics company finds that a new vendor has received a series of payments that do not match delivery records. The finance manager who onboarded the vendor also approved the payments, and a system override appears in the audit log.
The first decision is containment. Payments to the vendor are suspended pending review, the finance manager's approval rights are temporarily limited on a neutral basis, and the board is told that an irregularity is under review, not that fraud has occurred.
The second decision is preservation. Accounting exports, approval trails, vendor master-data change logs and email for the relevant custodians are captured immediately, because some system logs have short retention windows. Personal data collection is limited to what the mandate needs.
The third decision is framing. Counsel scopes the review against three distinct questions: whether any Penal Code offence may be engaged, whether section 199 record-keeping duties were met, and whether any proceeds risk arises under the CDSA. Interviews are planned only after documents are reviewed.
| Step | Owner | Timing | Evidence to hold |
|---|---|---|---|
| Contain live risk | CFO with legal | Day one | Payment hold record, access change log |
| Preserve records and devices | IT and forensic support | Days one to three | Export logs, chain-of-custody notes |
| Set mandate and privilege structure | General counsel | Days one to three | Written mandate, engagement letters |
| Review documents, then interview | Investigation team | Weeks one and two | Review notes, interview records |
| Decide reporting and remediation | Board or committee | On verified facts | Findings report, decision minute |
When the review points to wider control weaknesses, remediation should be tracked to closure; our investigation and crisis response team typically supports boards through both the findings and the follow-through.
Three questions boards raise
When should we engage law enforcement?
There is no single rule. The decision depends on the verified facts, whether a reporting obligation is engaged under the applicable framework, the risk of further loss, and the effect on civil recovery and employment steps. Many organisations benefit from establishing core facts first so that any report is accurate. Others, especially where assets are moving or harm is continuing, need to act quickly. Take advice on timing and record the reasons for whichever course you choose, so the decision is defensible if questioned by auditors, regulators or the court.
How far should the review look beyond the incident?
Start with the incident but build in a checkpoint. If the documents show the same override, vendor pattern or approver across other transactions, the board should decide whether to widen scope. Widening too early wastes money and delays findings; never widening risks missing a systemic issue that auditors or regulators later find. A short written scoping note at each checkpoint, approved by the decision-maker, keeps the review proportionate and shows that scope was managed deliberately rather than drifting with each new document or rumour.
How do employment action and the investigation interact?
Treat them as separate tracks with their own fairness requirements. Precautionary steps such as limiting access or paid suspension should be framed neutrally and kept under review. Disciplinary decisions should follow the company's own procedures and be based on findings, not suspicion. Communications to staff should be limited to what is necessary and should not name or prejudge individuals. Coordinating the two tracks prevents an employment step from compromising evidence or the integrity of any later report to authorities, and gives the employee a fair process.
Corporate fraud investigations in Singapore succeed when containment, preservation and fact-finding are kept separate from conclusions. Where the matter turns on an employee, our workplace investigations practice can support the employment track.
Common mistakes
Organisations under pressure to “do something now” often take steps that complicate later decisions. The most common pitfalls in Singapore investigations include the following.
- Using conclusive labels too early. Calling conduct “fraud” or “forgery” before facts are verified biases the process, undermines fairness, and may complicate later engagement with authorities or employees.
- Failing to align the review with the right legal frame. Treating a record‑keeping breach as an offence issue (or vice versa) leads to mis‑scoped evidence collection and the wrong interview questions.
- Incomplete preservation. Not capturing accounting exports, approval trails or system logs at the outset leaves gaps that cannot be closed later, particularly where retention windows are short.
- Over‑collecting personal data. Sweeping up entire mailboxes and devices without a tailored purpose invites PDPA risk and increases cost without improving clarity.
- Mixing roles and messages. Allowing operational managers who may be part of the factual matrix to manage the review invites conflict and undermines confidence in outcomes.
- Premature reporting. Referring matters to law enforcement before basic facts and records are stabilised may be necessary in some cases, but often results in reactive, less coherent engagement and operational disruption that could have been mitigated.
- Promising recovery or discipline. Assuring stakeholders that losses will be recovered or individuals dismissed sets expectations that may not align with the law or the evidence.
- Letting proceeds move. Continuing to process payments linked to the suspected irregularity without controls may expose the company to proceeds‑handling risks under the CDSA framework.
Action plan and decision points
The table below sets out a proportionate sequence that senior teams can adapt to the scale and risk of their situation. Each step anticipates the frameworks most commonly engaged in Singapore: the Penal Code, the Companies Act’s record‑keeping duty, the CDSA proceeds lens, the Criminal Procedure Code for evidence handling, and the PDPA for personal data.
| Step | Decision or action | Evidence or record | When to escalate |
|---|---|---|---|
| 1 | Stabilise and contain: limit access, pause suspect workflows, and issue a targeted hold notice. | Hold notice, list of custodians, access‑revocation logs, segregation‑of‑duties changes. | If live tampering risk, potential proceeds movement, or regulatory deadline pressure emerges. |
| 2 | Map the facts and records: define the hypothesis and the specific Penal Code elements potentially engaged. | Chronology, process map, list of transactions and approvals in scope. | If indicators of deception, document alteration or undisclosed conflicts appear. |
| 3 | Secure accounting and other records sufficient to satisfy Companies Act s199 obligations. | General ledger extracts, journals, bank statements, reconciliations, vendor‑master changes. | If records are missing, incomplete or inconsistent; consider parallel remediation. |
| 4 | Preserve devices and system logs using forensically sound methods and document chain of custody. | Imaging reports, hash values, collection notes, system‑log exports. | If external forensic support is needed or criminal referral is contemplated. |
| 5 | Conduct proportionate interviews with fairness safeguards and privilege controls. | Interview plans, attendance and note‑taking records, document packs used. | If new custodians or records surface; broaden the hold and revisit scope. |
| 6 | Assess proceeds risk under the CDSA and configure interim handling controls. | Payment holds, segregated accounts, decision logs on fund movements. | If there is a realistic possibility that property comprises benefits from criminal conduct. |
| 7 | Decide the reporting route: internal remediation only, regulator engagement, and/or criminal referral. | Findings memo distinguishing facts, analysis, options and risks. | If statutory or contractual reporting triggers are likely; seek targeted advice. |
| 8 | Implement remediation: control fixes, training, record‑keeping improvements, and follow‑up testing. | Remediation plan, control‑design documents, testing evidence, board updates. | If new issues arise in testing or the risk profile shifts materially. |
Decision-maker checklist
Use this checklist to keep the review on a defensible track:
- Mandate and scope. Is there a documented authority for the review, with clear objectives, escalation points and privilege protocols?
- Neutral framing. Are internal communications avoiding conclusive labels until facts are verified?
- Preservation discipline. Have you secured the specific accounting and other records needed to satisfy section 199, plus targeted communications and system logs?
- Evidence integrity. Are device imaging, data collection and note‑taking practices configured so they would withstand scrutiny under criminal‑procedure expectations?
- Fairness and employment process. Are interviews and potential employment actions consistent with workplace policies and a fair‑hearing approach?
- Proceeds‑handling controls. If there is a plausible CDSA risk, are interim controls in place to avoid dealing with potentially tainted property pending advice?
- Data‑protection posture. Is the collection and review of personal data necessary and proportionate to the stated purposes, with access tightly controlled?
- Reporting calculus. Have you mapped potential reporting routes—internal, regulatory, criminal—and the dependencies and implications of each?
- Stakeholder alignment. Are auditors, the board, insurers and—if relevant—group oversight bodies appropriately briefed on facts, not speculation?
- Remediation and testing. Is there a time‑bound plan to fix control gaps, retrain teams and verify effectiveness?
Questions on corporate fraud investigations in Singapore often sit alongside these areas of our work:
- Investigation and crisis response in Singapore
- Workplace investigations in Singapore
- Sanctions and restricted trade in Singapore
See all Singapore practice areas or contact the Singapore office.
Sources and official materials
Primary sources selected for this insight:
- Penal Code 1871
- Companies Act 1967 section 199
- Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992
Sources checked 17 October 2026. Current law and guidance should be checked before acting.
Frequently asked questions
01When do we engage law enforcement?
Engagement is a case‑specific judgement. Many organisations first stabilise evidence and develop a verified factual summary aligned to the potential Penal Code offence elements. Early engagement may be appropriate if there is immediate risk to assets, ongoing criminality, or where the organisation lacks capacity to contain the issue. Counsel can help assess timing, the scope of information to share, and how to protect privilege and operational stability. Prepare for potential requests informed by the Criminal Procedure Code by ensuring chain‑of‑custody documentation and clean data extractions are ready.
02How far should we look—just the incident or wider themes?
Start narrow to answer the incident question quickly. If evidence suggests a control weakness or pattern (for example, repeated override events, vendor‑master manipulation, or undisclosed relationships), expand in phases with clear criteria and approvals. Each expansion should be justified by concrete indicators, not general suspicion. Keep a decision log explaining why scope expanded or did not; this is useful for auditors and, if needed, regulators.
03What about employment action and communications?
Separate the fact‑finding function from employment decision‑making. If precautionary suspension is necessary to protect records or customers, document the rationale and preserve pay and benefits per policy where appropriate. Do not announce conclusions. Internal communications should describe operational steps, not legal characterisations. When evidence supports action, ensure the employee has seen and can comment on the relevant documents. Maintain neutrality in references and external messaging while processes are ongoing.
04What drives the cost of a fraud investigation?
Cost is driven mainly by scope, data volume and the number of people involved. A tightly scoped review of one payment chain with good system exports is far cheaper than a wide review triggered by vague concerns. Costs rise when preservation was incomplete and data must be recovered, when forensic accountants are needed to rebuild transactions, or when parallel employment, regulatory and civil tracks must be managed. Setting a clear mandate and checkpoints at which scope is reviewed keeps costs proportionate.
05What if the suspected employee resigns mid-investigation?
A resignation does not end the company's need to establish facts. Secure company devices, access credentials and records on exit, and remind the departing employee of continuing confidentiality obligations. Consider whether contractual or civil steps are needed to protect assets or information. The investigation can usually continue on documents and other witnesses, but the report should note that the individual's account was not obtained, and any decision on reporting to authorities should be made on the evidence available.
06How do we handle a fraud with overseas elements?
Map where the money moved, where the records sit and which group entities were involved. Evidence held abroad may be subject to local data-protection and employment rules, so collection should be coordinated rather than pulled ad hoc into Singapore. If proceeds have left Singapore, early legal advice on tracing and recovery options matters. Keep one investigation plan and one decision log across jurisdictions so findings remain consistent.
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
