COSMIC is the MAS platform that lets participating banks share information on customers who show multiple red flags of financial crime. MAS Notice 626 now requires a participating bank to fold that information into its customer knowledge, its assessment of unusual transactions and its treatment of PEPs and higher-risk customers. Ongoing monitoring stops being a purely internal exercise.
COSMIC is limited to prescribed institutions, and MAS has said it will widen the scope and the participants over the next two years. The Notice 626 requirements below are drawn from the amendment effective 1 July 2025; confirm paragraph-level wording against the published notice before relying on it.
This guide is written for CCOs and AML heads at BSP-, OJK-, BNM- and SBV-regulated institutions who want to understand what Singapore's model changes, and what an institution outside it can still do with the same questions.
What is COSMIC, and who uses it?
It is a digital platform for secure information sharing between financial institutions, launched by MAS on 1 April 2024 with six major commercial banks.
On its COSMIC page, MAS describes the platform as a way for institutions to share information on customers who show multiple red flags, where stipulated thresholds are met. The first phase concentrates on three risk areas in commercial banking: the misuse of legal persons, the misuse of trade finance for illicit purposes, and proliferation financing. The legal basis is the Financial Services and Markets Act, as amended in 2023, with a dedicated MAS notice setting out what a participating institution must do. Our earlier post on COSMIC and customer red flags covers the red-flag logic. This guide covers what the platform does to the obligations in Notice 626.
What does Notice 626 now require of a participating bank?
It requires the bank to use what COSMIC tells it, in four places where the notice already asks for judgement.
MAS Notice 626 is the prevention of money laundering and countering the financing of terrorism notice for banks. The current version is the amendment dated 30 June 2025, in force from 1 July 2025. The amendment text connects COSMIC to ongoing due diligence in four ways. A bank that participates must include COSMIC information in what it knows about the customer. It must take that information into account when assessing unusual transactions. Its internal systems for politically exposed persons and for higher-risk customers must also take COSMIC information into account. The same amendment adds digital token and value transfer provisions and group-level sharing of unusual-transaction analysis, so the notice reads as a monitoring document, not a one-off platform rule.
Six at launch, 1 April 2024
Shared information on customers with multiple red flags
How does COSMIC change ongoing monitoring?
It adds an external signal to a process that was built on internal data alone.
Ongoing monitoring has two inputs: the behaviour of the customer on the books, and what the bank knows about the customer. COSMIC extends the second input to what other banks have seen. A customer that looks ordinary in one institution can look different when a counterparty bank has raised red flags on the same legal person. That matters most for the three risk areas MAS chose, because shell companies, trade invoices and sanctions-evasion structures are designed to look unremarkable inside a single bank. For the monitoring team the practical consequence is that an alert can start from a shared signal, and the case record has to show how that signal was weighed. The line between periodic and event-driven review, which we set out in ongoing customer due diligence, becomes sharper when an outside event can trigger the review.
What has COSMIC delivered, and where is it going?
MAS reports that participating banks filed additional suspicious transaction reports and closed a significant number of accounts, and says the platform will expand within two years.
In an oral reply to Parliament on 5 August 2026, MAS said banks filed additional suspicious transaction reports from shared information and closed a significant number of suspicious accounts after review. It said the platform helped identify suspicious networks and that the Financial Action Task Force's mutual evaluation of Singapore affirmed its effectiveness. The expansion will widen the scope beyond the original three risk areas and bring in other major banks, to be completed within two years. MAS also stated that it will manage the expansion to balance the benefits against undue de-risking and the confidentiality of customer information. FinTech Global reported first-year figures of 461 additional reports covering more than SGD 1.6 billion, 1,152 accounts closed and two networks that institution-level monitoring had missed.
What can an institution outside COSMIC take from it?
The questions COSMIC answers can still be asked from an institution's own data, with a connected-party view and a case record.
A bank regulated by the BSP, OJK, BNM or SBV cannot rely on a shared platform of this kind. It can still ask the same questions. Which customers share directors, addresses or introducers? Which legal persons receive trade-related payments with no matching documents? Which accounts look like a pass-through for a connected group? Answering them needs the screening, monitoring and case data in one view, which is the argument in our guide to transaction monitoring and the Southeast Asia due diligence benchmark. The risk MAS prioritised is also the risk that shows up in corporate mule accounts, where a newly formed company moves funds on behalf of others, and our money mule scenario library shows the individual patterns behind it.
What should a team do before the expansion lands?
Make the case record able to carry an external signal, and decide in advance how a shared signal moves a customer's risk rating.
Three steps are practical. First, check that a customer's risk rating can be changed by an external event and that the reason is captured, which a customer risk rating review will test. Second, define how a signal from a counterparty or a group entity enters the alert queue, so it is not handled by email. Third, keep the audit trail for the decision, because an examiner will ask why a customer was retained or exited after a shared red flag. MAS's reference to undue de-risking is a reminder that the decision has to be reasoned, not automatic.
How does Fyscal ARCX support information-led monitoring?
Fyscal ARCX gives the monitoring team a connected view of a customer and a case record that carries every signal, internal or external, and the decision it led to. A compliance team defines its own variables and scenarios, tests them against historical data before activation, and holds one case per customer so that connected entities are investigated together. Named parties are screened against sanctions, PEP and watchlists, and Regulatory Reporting prepares and tracks the filing that follows a confirmed suspicion. COSMIC participation itself is a matter for prescribed institutions and MAS; the controls around it are what any institution can build.