Country-specific guidance Current

Requesting identity documents from an individual client

Check what basis applies before requesting sensitive identity documents.

A statutory duty to identify and verify an individual client applies where your firm is registered as a corporate service provider (CSP) doing in-scope work, or where another specific legal, professional, or verification basis applies, not to every Singapore accounting engagement by default. Once a basis applies, the right document to request depends on residency status: a Singapore citizen or permanent resident is generally asked for their NRIC, a foreign resident for the document that carries their FIN, and a client without either for a passport. This guide sets out a practical approach. It is general information, not legal or compliance advice.

Action plan

1 Confirm a specific basis applies before requesting sensitive identity documents The Corporate Service Providers Act's CDD duty is triggered by an in-scope service, not by being an accounting firm.

The Corporate Service Providers Act 2024's customer due diligence duty applies where your firm is registered as a CSP and the engagement involves an in-scope corporate service, such as company incorporation, company secretarial work, or nominee arrangements. For an engagement that doesn't involve one of those services, don't request NRIC, FIN, or passport copies on the assumption the CSP Act requires it. Rely instead on another specifically identified basis (for example a different regulator's requirement, or your firm's own documented client-acceptance and professional-prudence practice) before collecting sensitive identity documents.

  • Check whether this engagement involves an in-scope CSP service before requesting ID documents on that basis
  • Identify the specific basis relied on when the CSP Act doesn't apply, rather than defaulting to CSP-style collection
  • Don't collect NRIC, FIN, or passport copies as a routine step where no specific basis requires it

Done when: A specific basis for requesting the client's identity documents was confirmed before the request was made

See CDD obligations for corporate service providers
2 Match the document you request to the client's residency status A Singapore-issued number only exists for residents; a foreign client without one needs a passport instead.

Once a specific basis for identity verification applies, matching the document to the client's residency status is the practical next step. That generally means requesting the NRIC for a Singapore citizen or permanent resident, the document that carries the FIN for a foreign resident (for example the pass issued for an Employment Pass, S Pass, or Work Permit), and a passport for a client who holds neither.

  • Ask a Singapore citizen or permanent resident for their NRIC
  • Ask a foreign resident for the government-issued document that carries their FIN
  • Ask a client without an NRIC or FIN for a passport

Done when: The identity document requested matches the client's actual residency status, not an assumption

ACRA: Corporate Service Providers Act 2024
3 Request a current, government-issued copy, not a description A due diligence file needs the document itself, and it needs to still be valid.

Ask for a copy of the actual government-issued document rather than a written description of its details, and check that it has not expired before accepting it. An expired or self-reported document does not meet the same standard as a current, government-issued one.

  • Request a copy of the document itself, not a summary of its details
  • Check the expiry date before accepting the document
  • Ask for a replacement if the document is expired or about to expire

Done when: A current, government-issued copy of the document was obtained, not a description of it

See verifying identity documents from a reliable source
4 Tell the client why you're asking, at the point you ask Requesting the document and explaining the purpose are two separate steps, and both are expected.

When you request an identity document, also tell the client the purpose for which your firm is collecting it. This is a separate obligation to the request itself, and it sits under Singapore's data protection framework, not the customer due diligence framework.

  • State the purpose of collection at or before the point you request the document
  • Don't rely on a general privacy policy alone to cover a specific request
  • Keep a record that the purpose was communicated

Done when: The client was told the purpose of collection at or before the document was requested

See PDPA client data collection and notification