Singapore

This is an Insight article, written by a selected partner as part of GIR's co-published content. Read more on Insight

General context, key principles and hot topics

1 Identify the highest-profile corporate investigation under way in your country, describing and commenting on its most noteworthy aspects.

There are currently no high-profile investigations under way in Singapore. The most recently concluded major corporate investigations are those in respect of the corruption scandal involving 1Malaysia Development Berhad (1MDB) and those concerning Keppel Offshore & Marine (Keppel O&M, a subsidiary of Keppel Corporation) and its involvement in the Petrobras bribery scandal.

In relation to 1MDB, the Monetary Authority of Singapore (MAS) conducted a review from 2015 to 2017 of banks involved in 1MDB-related transactions. Two banks have been shut down and total financial penalties of S$29.1 million have been imposed on eight banks for various breaches of anti-money laundering requirements. Goldman Sachs Group Inc has entered into a deferred prosecution agreement (DPA) with the United States Department of Justice. The DPA provides for a global resolution; as part of the DPA, Goldman Sachs (Singapore) Pte Ltd will pay US$122 million to the Singapore government for its role in the 1MDB bond offerings.

Various individuals have been sentenced by the Singapore courts or were served prohibition orders or notices of intention by the MAS prohibiting them from (1) performing any regulated activity under the Securities and Futures Act (SFA) or the Financial Advisers Act (FAA) and (2) taking part, directly or indirectly, in the management of, acting as a director of, or becoming a substantial shareholder of, any capital market services or financial advisory firms under the SFA or the FAA.

Separately, Keppel O&M has reached a global resolution with criminal authorities in the United States, Brazil and Singapore in relation to corrupt payments made by a former agent in Brazil to officials of Brazilian state-run oil company Petrobras and other parties, to win contracts with Petrobras or its related companies. The corrupt payments were allegedly made with the knowledge or approval of former Keppel O&M executives. As part of the resolution, Keppel O&M is subject to fines amounting to US$422.2 million, to be allocated between the United States, Brazil and Singapore.

2 Outline the legal framework for corporate liability in your country.

Corporations can be held criminally liable in Singapore. Under the Interpretation Act, which governs the interpretation of all Singapore law statutes generally, ‘person’ includes any company or association or body of persons, corporate or unincorporate. Under the Penal Code, which is the main criminal law statute in Singapore, the word ‘person’ includes any company or association or body of persons, whether incorporated or not.

Specific statutes also contain provisions attributing liability to corporations and their officers. For example, under section 59 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act, where an offence under the Act committed by a body corporate is proven to have been committed with the consent or connivance of an officer, or to be attributable to any neglect on his or her part, both the officer and the body corporate will be guilty of the offence and shall be liable to be proceeded against and punished accordingly. Similar provisions are found in other statutory legislation, such as the SFA.

In Ho Kang Peng v. Scintronix Corp Ltd [2014] 3 SLR 0329, the Singapore Court of Appeal referred to the three rules of attribution to determine when an act by a person representing a company can be attributed to the company. These rules applied to any person representing the company (1) primary rules of attribution, that is the company’s constitution, (2) general rules of attribution, that is, the principles of agency, and (3) special rules of attribution, that is, the court will determine, on construction of the statutory provision, whether it is intended to include the acts of such an individual as the act of the company.

3 Which law enforcement authorities regulate corporations? How is jurisdiction between the authorities allocated? Do the authorities have policies or protocols relating to the prosecution of corporations?

The law enforcement authorities that regulate corporations include the following:

Accounting and Corporate Regulatory Authority, the national regulator of business entities, public accountants and corporate service providers;
MAS, which is Singapore’s central bank and is focused on enforcement issues relating to financial institutions and the financial services and securities industries;
Inland Revenue Authority of Singapore, the tax authority in Singapore;
Competition and Consumer Commission of Singapore, which exercises oversight over competition-related matters; and
Personal Data Protection Commission, which exercises oversight over data privacy matters.

More generally, the Commercial Affairs Department (CAD), a division of the Singapore Police Force, and the Corrupt Practices Investigation Bureau also exercise oversight over the acts of corporations. These entities have statutory powers to investigate and prosecute offences relating to bribery, corruption and other financial and white-collar crimes.

The MAS and CAD are parties to a joint investigation arrangement, under which they jointly investigate all offences under the SFA and the FAA, to allow both agencies to consolidate their investigative resources and expertise and further improve the overall effectiveness of market misconduct investigations.

Jurisdiction among the authorities is allocated in terms of subject matter generally. General procedures on the prosecution of individuals and corporations are set out in the Criminal Procedure Code and supplemented by provisions within various statutes. In practice, to streamline the process, investigations are usually only commenced by one authority unless there are common issues of relevance to more than one authority (for example, in a case of fraud, the CAD may investigate the fraud alongside the MAS, which may be involved in money laundering issues to the extent that the fraudulent monies were transferred via banks in Singapore).

In addition to the aforementioned law enforcement authorities, there are self-regulatory organisations (SROs) that perform some regulatory functions. For example, in the area of securities and derivatives trading, the approved exchanges (such as the Singapore Exchange Securities Trading Limited) are SROs, with rules governing both their members (business rules) and listed companies (listing rules). The approved exchanges are responsible for administering their respective listing rules, exercising supervision over their members, and ensuring fair and orderly trading of their listed products.

4 What grounds must the authorities have to initiate an investigation? Is a certain threshold of suspicion necessary to trigger an investigation?

There is no specific threshold of suspicion necessary to trigger a police investigation.

Also, there is no specific threshold of suspicion set out in legislation necessary for the MAS to initiate an investigation into an alleged or suspected contravention. For example, under the SFA, the MAS may initiate an investigation so long as it considers an investigation ‘necessary or expedient’ (SFA, section 152).

In practice, each authority is likely to prioritise its resources in considering how to respond to all potential breaches of law and whether to undertake a formal investigation. For example, the MAS will consider a range of factors to determine whether to undertake a formal investigation, including the seriousness of the misconduct, the public interest in pursuing the misconduct and the availability of evidence required to prove the misconduct.

5 How can the lawfulness or scope of a notice or subpoena from an authority be challenged in your country?

A notice or subpoena from a law enforcement authority may be challenged by asking the court to quash it or prohibit further action by the relevant law enforcement authority.

A search warrant issued by the Singapore courts under the Criminal Procedure Code may be suspended or cancelled if there are valid grounds for doing so.

6 Does your country make use of co-operative agreements giving immunity or leniency to individuals who assist or co-operate with authorities?

Singapore has a framework for deferred prosecution agreements (DPA). This enables corporates to reach agreement with the Public Prosecutor for the deferral of prosecution, in exchange for the imposition of certain requirements.

7 What are the top priorities for your country’s law enforcement authorities?

Generally, the top priorities for Singapore’s law enforcement authorities include corruption, financial crimes and cybercrime, and for financial institutions, market abuse, financial services misconduct and money laundering-related control breaches.

8 To what extent do law enforcement authorities in your jurisdiction place importance on a corporation having an effective compliance programme? What guidance exists (in the form of official guidance, speeches or case law) on what makes an effective compliance programme?

The presence of an effective compliance programme is usually a mitigating factor, in terms of the quantum and severity of the penalties to be imposed on a corporation.

Under the DPA framework, authorities may defer prosecution on the basis that the company agrees to certain conditions, including putting in place certain compliance frameworks.

Certain authorities have published guidance about what constitutes an effective compliance programme; for example, the Corrupt Practices Investigation Bureau developed ‘PACT: A Practical Anti-Corruption Guide for Businesses in Singapore’ to help domestic business owners prevent corruption in their companies. The MAS has published ‘Guidelines on Risk Management Controls’, which facilitate the implementation of an effective compliance programme.

Cyber-related issues

9 Does your country regulate cybersecurity? Describe the approach of local law enforcement authorities in your country to cybersecurity-related failings.

Cybersecurity and data security issues are primarily regulated through the Cybersecurity Act 2018 (CSA) and the Personal Data Protection Act (PDPA).

The key objectives of the CSA are to (1) strengthen the protection of critical information infrastructure (CII) against cyberattacks, (2) authorise the Cyber Security Agency to prevent and respond to cybersecurity threats and incidents, (3) establish a framework for sharing cybersecurity information, and (4) establish a light-touch licensing framework for cybersecurity service providers. The CII sectors are energy, water, banking and finance, healthcare, transport, audiovisual communications, media, security and emergency services, and government.

The PDPA provides a baseline standard of protection for personal data. It complements sector-specific legislative and regulatory frameworks, such as the Banking Act and the Insurance Act. It comprises various requirements governing the collection, use, disclosure and care of personal data.

As of 1 February 2021, amendments to the PDPA introduced a mandatory data breach requirement. If an organisation identifies a notifiable data breach, the breach must be reported to the Personal Data Protection Commission (PDPC). The organisation must also notify affected individuals once the organisation has determined that the data breach is likely to result in significant harm to any individuals to whom the information relates.

In 2018, SingHealth (Singapore’s national healthcare service provider) was affected by a major data breach involving compromise of the personal particulars of 1.5 million patients and records of outpatient dispensed medicines belonging to 160,000 patients. A committee of inquiry was convened on 24 July 2018 to investigate the causes of the attack and identify measures to help prevent similar attacks. The incident was attributed to sophisticated unnamed state-linked actors. In January 2019, the PDPC imposed fines of S$750,000 on Integrated Health Information Systems (the central information technology agency responsible for Singapore’s healthcare sector) and S$250,000 on SingHealth for breaching its data protection obligations under the PDPA. These financial penalties are the highest imposed by the PDPC to date.

In addition to the CSA and the PDPC, the Monetary Authority of Singapore (MAS) also issues notices and guidelines in relation to cybersecurity for financial institutions, such as the MAS Technology Risk Management Guidelines and Notice on Cyber Hygiene.

10 Does your country regulate cybercrime? What is the approach of law enforcement authorities in your country to cybercrime?

Yes, cybercrime is regulated in Singapore under the Computer Misuse Act. Cybercrime is a serious criminal offence, which is investigated by the Singapore Police Force.

At the regional level, Singapore is the Association of Southeast Asian Nations (ASEAN) Voluntary Lead Shepherd on Cybercrime. This provides a platform for the ASEAN Member States to coordinate the regional approach to cybercrime, and work together on capacity building, training and the sharing of information.

At the international level, Singapore hosts the Interpol Global Complex for Innovation (IGCI), Interpol’s global hub on cybercrime. Singapore has led the IGCI Working Group and the Interpol Operational Expert Group on Cybercrime, working with other Interpol Member States to define Interpol’s cybercrime programme.

Cross-border issues and foreign authorities

11 Does local criminal law have general extraterritorial effect? To the extent that extraterritorial effect is limited to specific offences, give details.

In the main, local criminal law does not have general extraterritorial effect. However, in relation to certain specific offences, extraterritoriality may apply; for example, Singapore citizens committing corruption or bribery overseas may be charged under the Prevention of Corruption Act. The Terrorism (Suppression of Financing) Act is another example of legislation with extraterritorial effect.

12 Describe the principal challenges that arise in your country in cross-border investigations, and explain whether and how such challenges depend on the other countries involved.

Principal challenges arising in cross-border investigations include those concerning the collection of evidence and the implementation of enforcement action.

Most of the time, these matters are dealt with between governments pursuant to treaties on mutual legal assistance between the jurisdictions involved, which are given legal effect under the Mutual Assistance in Criminal Matters Act.

13 Does double jeopardy, or a similar concept, apply to prevent a corporation from facing criminal exposure in your country after it resolves charges on the same core set of facts in another? Is there anything analogous in your jurisdiction to the ‘anti-piling on’ policy as exists in the United States (the Policy on Coordination of Corporate Resolution Penalties) to prevent multiple authorities seeking to penalise companies for the same conduct?

It is unclear whether the concept of international double jeopardy applies in Singapore, as the issue has not been tested in Singapore courts.

That said, double counting is prohibited insofar as breaches of Singapore law are concerned. Section 40 of the Interpretation Act (Cap. 1) states that where any act or omission constitutes an offence under two or more written laws (i.e. legislation in Singapore), the offender shall, unless the contrary intention appears, be liable to be prosecuted and punished under any one of those written laws but shall not be liable to be punished twice for the same offence. Accordingly, multiple authorities will not be able to penalise companies for the conduct insofar as they contravene section 40 of the Interpretation Act.

14 Are ‘global’ settlements common in your country? What are the practical considerations?

It is not uncommon for there to be ‘global’ settlements involving the Singapore authorities (e.g., in the 1Malaysia Development Berhad (1MDB) and Keppel Offshore & Marine/Petrobras cases). Practical considerations include the level of co-operation amongst the authorities in the various jurisdictions.

15 What bearing do the decisions of foreign authorities have on an investigation of the same matter in your country?

Generally, in practice we expect that regulators will ordinarily seek to achieve consistency where practicable, particularly when co-operating with foreign authorities.

Economic sanctions enforcement

16 Describe your country’s sanctions programme and any recent sanctions imposed by your jurisdiction.

Singapore implements United Nations Security Council sanctions through the United Nations Act (Cap. 339) for non-financial institutions and individuals and the Monetary Authority of Singapore Act (Cap. 186) for financial institutions.

Singapore also applies targeted financial sanctions against designated individuals and entities under the Terrorism (Suppression of Financing) Act. The relevant individuals and entities are designated by the Inter-Ministry Committee on Terrorist Designation pursuant to the United Nations (UN) Security Council Resolution 1373 relating to terrorism.

Singapore does not enforce unilateral sanctions imposed by other countries.

17 What is your country’s approach to sanctions enforcement? Has there been an increase in sanctions enforcement activity in recent years, for example?

Generally, sanctions implemented in Singapore are enforced by the Singapore Police Force, Singapore Customs (trade sanctions), the Monetary Authority of Singapore (financial sanctions) and the Inter-Ministerial Committee on Terrorist Designation.

The number of prosecutions for sanctions violations has increased over the years. In 2018, T Specialist International and its director, Ng Kheng Wah, were charged in Singapore for, among other things, the supply of sanctioned luxury goods to North Korea in breach of UN sanctions against North Korea. In the same year, Singaporean Chong Hock Yen and North Korean Li Hyin, were charged in court (together with companies linked to Chong) for the supply of perfumes, wines and watches to North Korea in breach of UN sanctions.

In 2020, a Singaporean national on the Federal Bureau of Investigation’s most wanted list (Tan Wee Beng) was charged with falsifying invoices of two companies to hide transactions with North Korea-linked entities.

18 Do the authorities responsible for sanctions compliance and enforcement in your country co-operate with their counterparts in other countries for the purposes of enforcement?

Under the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act (Cap. 65A), a mechanism is available for financial intelligence to be shared with other financial intelligence units of other jurisdictions. Assistance may also be provided pursuant to the Mutual Assistance in Criminal Matters Act or the Monetary Authority of Singapore Act.

19 Has your country enacted any blocking legislation in relation to the sanctions measures of third countries? Describe how such legislation operates.

Singapore does not enforce unilateral sanctions imposed by other countries.

20 To the extent that your country has enacted any sanctions blocking legislation, how is compliance enforced by local authorities in practice?

Not applicable.

Before an internal investigation

21 How do allegations of misconduct most often come to light in companies in your country?

Allegations of misconduct are often reported by whistleblowers or complainants making complaints directly to companies or to law enforcement authorities or via surveillance of authorities.

Apart from reports or complaints of misconduct, ‘suspicious transaction reports’ lodged pursuant to disclosure obligations under the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act (Cap. 65A) in respect of property that is reasonably suspected of being connected to criminal activity are also a means by which wrongdoing comes to light. These reports are lodged with the Suspicious Transaction Reporting Office, which is Singapore’s financial intelligence unit. Although these suspicious transaction reports are property-based and for the purpose of combating money laundering, the Singapore Police Force may also initiate investigations into misconduct associated with the property.

Internal investigations into misconduct may also be initiated pursuant to internal or external audits conducted by a company.

Information gathering

22 Does your country have a data protection regime?

Yes. Personal data is protected under the Personal Data Protection Act (PDPA). The PDPA provides a baseline standard of protection for personal data. It comprises various requirements governing the collection, use, disclosure and care of personal data.

In addition, Singapore has a strict banking secrecy regime under the Banking Act (Cap. 19). Certain other information is also protected under various statutes, such as the Official Secrets Act (Cap. 213). The common law of confidentiality also applies to protect certain types of information.

23 To the extent not dealt with above at question 9, how is the data protection regime enforced?

The PDPA ensures a baseline standard of protection for personal data, which requires organisations to comply with the PDPA as well as common law and other relevant laws that apply to the industry to which they belong, when handling personal data in their possession.

If the Personal Data Protection Commission (PDPC) finds that an organisation is in breach of any of the data protection provisions in the PDPA, it will direct the organisation to take steps to ensure compliance, such as to:

stop collecting, using or disclosing personal data in contravention of the PDPA;
destroy personal data collected in contravention of the PDPA;
provide access to or correct the personal data; and
pay a financial penalty.

There are also offences under the PDPA for which an organisation or a person may be liable.

24 Are there any data protection issues that cause particular concern in internal investigations in your country?

The PDPA provides that an organisation may use or disclose personal data about an individual without the consent of the individual where the use is necessary for any investigation or proceeding.

However, if personal data is to be transferred out of Singapore for the purposes of an internal investigation (e.g., a cross-border investigation), the relevant organisation must comply with the Transfer Limitation Organisation, which requires that an organisation ensure that personal data transferred overseas is protected to a standard comparable with the data protection provisions within the PDPA.

25 Does your country regulate or otherwise restrict the interception of employees’ communications? What are its features and how is the regime enforced?

To the extent that employees’ communications contain personal data subject to the PDPA, organisations must comply with the Act in terms of interception of their communications. The PDPA is a consent-based regime, subject to exceptions in the Act. If the organisation is able to rely on an exception to intercept the communications, consent of the employee is not necessary. For example, one of the exceptions in the PDPA is whether the use, collection or disclosure of the personal data is necessary for investigations.

However, if the PDPC finds that an organisation is in breach of any of the data protection provisions in the PDPA, it will direct the organisation to take steps to ensure compliance, for example:

stop collecting, using or disclosing personal data in contravention of the PDPA;
destroy personal data collected in contravention of the PDPA;
provide access to or correct the personal data; and
pay a financial penalty.

There are also offences under the PDPA for which an organisation or a person may be liable.

Dawn raids and search warrants

26 Are search warrants or dawn raids on companies a feature of law enforcement in your country? Describe any legal limitations on authorities executing search warrants or dawn raids, and what redress a company has if those limits are exceeded.

Yes, search warrants and dawn raids on companies are a feature of law enforcement in Singapore.

Searches are generally conducted by regulatory authorities with search warrants and must be carried out in accordance with the terms within the warrants, as well as any applicable provisions of statutory legislation (e.g., the Criminal Procedure Code). A search warrant may be suspended or cancelled if there are good reasons for doing so (Criminal Procedure Code (CPC), section 27(1)).

There are also instances when searches can be carried out by the police without search warrants, for example, if a police officer has good grounds for believing that stolen property will be removed from the premises by the time the search warrant is obtained.

If an illegal search is conducted, the aggrieved party may make a criminal complaint for trespass or criminal force, or commence a civil claim for damages in the tort of trespass.

27 How can privileged material be lawfully protected from seizure during a dawn raid or in response to a search warrant in your country?

A company subject to a search and seizure order should inform investigating officers that there is (or may be) privileged material within the seized data and assert its claim to privilege. Thereafter, it should follow up with a written notice to claim privilege and reserve all its rights.

28 Under what circumstances may an individual’s testimony be compelled in your country? What consequences flow from such compelled testimony? Are there any privileges that would prevent an individual or company from providing testimony?

There are statutory provisions that allow an individual’s testimony to be compelled for the purposes of criminal or regulatory investigations.

For example, section 283(2) of the CPC provides that an individual may be summoned to give evidence when his or her evidence is essential to making a just decision at the close of the case for the defence, or at the end of any proceeding under the CPC.

The Monetary Authority of Singapore (MAS) has the power to require persons to be examined (Securities and Futures Act (SFA), section 154), and evidence obtained by the MAS in this regard may be used in criminal investigations and proceedings (SFA, section 168B).

There is a right against self-incrimination in Singapore under section 22(2) of the CPC, whereby a person need not say anything that might expose him or her to a criminal charge, penalty or forfeiture.

An advocate, solicitor or in-house counsel would be prohibited from disclosing any communications covered by legal privilege (Evidence Act, sections 128 and 128A). Further, a person would not be permitted to produce any unpublished official records relating to the affairs of the state (Evidence Act, section 125).

Whistleblowing and employee rights

29 Describe the whistleblowing framework in your country. What financial incentive schemes exist for whistleblowers? What legal protections are in place for whistleblowers?

Singapore does not have formal whistleblowing legislation. However, whistleblowers may be entitled to protection for the reporting of offences set out within specific statutes (e.g., the Prevention of Corruption Act). Under these statutes, the informer’s identity will remain confidential throughout any proceedings that may result from the reporting of the offence.

Companies are also encouraged to maintain internal whistleblowing policies as a matter of corporate governance and best practice.

For example, the Monetary Authority of Singapore, in its Guidelines on Individual Accountability and Conduct, sets out requirements for financial institutions to maintain a formalised whistleblowing programme. The programme should include the whistleblowing channels available to employees, procedures to ensure anonymity and adequate protection of employees who raise concerns about the financial institution’s policies, practices and activities via this channel, and procedures for handling whistleblower complaints.

30 What rights does local employment law confer on employees whose conduct is within the scope of an investigation? Is there any distinction between officers and directors of the company for these purposes?

Section 14(8) of the Employment Act provides that for the purposes of a due inquiry (i.e., conducted as part of the investigations process), an employer may suspend an employee from work for a period not exceeding one week, or such longer period as the Commissioner of Labour may determine on an application by the employer. During the period of suspension from work, the employer must pay the employee at least half of his or her salary. If the inquiry does not disclose any misconduct on the part of the employee, the employer shall immediately restore to the employee the full amount of the salary withheld (Employment Act, section 14(9)).

Under common law, general requirements of due process (a right to a fair hearing, etc.) are applicable.

There is no distinction between officers and directors of the company for these purposes.

31 Do employees’ rights under local employment law differ if a person is deemed to have engaged in misconduct? Are there disciplinary or other steps that a company must take when an employee is implicated or suspected of misconduct, such as suspension or in relation to compensation?

Under section 14(1) of the Employment Act, an employee is entitled to a due inquiry before dismissal on the grounds of misconduct. Under common law, general requirements of due process (a right to a fair hearing, etc.) are applicable.

32 Can an employee be dismissed for refusing to participate in an internal investigation?

An employee may be dismissed for refusing to participate in an internal investigation, if dismissal for that cause is permitted under the employment contract.

Commencing an internal investigation

33 Is it common practice in your country to prepare a document setting out terms of reference or investigatory scope before commencing an internal investigation? What issues would it cover?

Yes. This document would set out the scope and purpose of the investigation, documents reviewed and referred to, persons to interview, issues in question, impediments to information gathering, as well as an overview of personal data protection laws of which the investigators should be mindful.

34 If an issue comes to light prior to the authorities in your country becoming aware or engaged, what internal steps should a company take? Are there internal steps that a company is legally or ethically required to take?

The company should commence an internal investigation. A company should also assess its reporting obligations in respect of the regulatory and law enforcement authorities, and report any suspected or confirmed misconduct as required under applicable legislation.

Typically, as an internal management measure, senior management or the board (or both) would also be briefed, depending on the severity of the conduct involved.

35 What internal steps should a company in your country take if it receives a notice or subpoena from a law enforcement authority seeking the production or preservation of documents or data?

The company should first assess whether the notice or subpoena applies to it, and whether it is legally obliged to comply with it.

If yes, the company should take steps to comply with the notice or subpoena, which will include imposing document retention notices, finding and preserving data, conducting searches over electronic data sets, among other things. The company should also brief management and the affected employees, and provide instructions regarding compliance with the notice or subpoena.

36 At what point must a company in your country publicly disclose the existence of an internal investigation or contact from a law enforcement authority?

This requirement applies only to publicly listed companies. Under the Singapore Exchange (Mainboard) Listing Rules, material information should be disclosed by listed companies. Material information is defined as information that is either ‘necessary to avoid the establishment of a false market in [its] securities’ or ‘that would be likely to materially affect the price or value of its securities’. This information would probably include the existence of an internal investigation or contact from a law enforcement authority.

There is no corresponding disclosure requirement for private companies, although they may wish to voluntarily disclose the matter for public relations purposes and to offset any reputational concerns.

37 How are internal investigations viewed by local enforcement bodies in your country?

Internal investigations are generally welcomed as they complement the general law enforcement and regulatory framework. The swift conduct of internal investigations, as well as follow-up reporting to the authorities, may be viewed as a mitigating factor if the authorities decide to press any charges against the relevant company or individuals.

There are no other legal requirements regarding the conduct or format of internal investigations.

Attorney–client privilege

38 Can the attorney–client privilege be claimed over any aspects of internal investigations in your country? What steps should a company take in your country to protect the privilege or confidentiality of an internal investigation?

Legal advice privilege and litigation privilege may be claimed over materials and documents generated during internal investigations.

For litigation privilege to apply, there must be a reasonable prospect of litigation at the time the documents were created, and the dominant purpose for the creation of the documents over which privilege is claimed is pending or contemplated litigation. This includes documents that may be generated by third parties (such as forensic accounting reports prepared for the purposes of the internal investigation).

If there is a pending regulatory investigation (which is being conducted in parallel with the internal investigations), a company should record this in writing so that material generated during the internal investigations is more likely to be protected by litigation privilege.

For legal advice privilege to apply, it must be shown that the documents in question contain solicitor–client privileged advice, or otherwise was generated for the dominant purpose of seeking legal advice.

For this reason, a company should generally copy its external or in-house legal counsel in on written correspondence generated in the course of internal investigations, and also mark such communications ‘strictly confidential and legally privileged’ or ‘for the purposes of obtaining legal advice’. However, the fact that legal counsel is copied, or that correspondence is marked privileged, does not necessarily mean that the contents of the communications are indeed privileged. A court or tribunal will examine the substance of the communications to determine whether any claims of privilege will succeed.

Further, to mitigate against the risks of disclosure, a company should keep the amount of written communication and documentation generated in an internal investigation to a minimum, and only circulate the materials on a need-to-know basis.

39 Set out the key principles or elements of the attorney–client privilege in your country as it relates to corporations. Who is the holder of the privilege? Are there any differences when the client is an individual?

Legal professional privilege comprises legal advice privilege and litigation privilege. For legal advice privilege to apply, it must be shown that the documents in question contain solicitor–client privileged legal advice, or otherwise was generated for the dominant purpose of seeking legal advice.

Privilege is held by the client. There are no material differences in how privilege operates when the client is an individual.

40 Does the attorney–client privilege apply equally to in-house and external counsel in your country?

Yes, pursuant to section 131 of the Evidence Act, which expressly provides that in-house counsel are legal professional advisers for the purposes of determining whether privilege applies.

41 Does the attorney–client privilege apply equally to advice sought from foreign lawyers in relation to investigations in your country?

Yes, subject to any additional requirements imposed by the home jurisdiction of the foreign lawyer.

42 To what extent is waiver of the attorney–client privilege regarded as a co-operative step in your country? Are there any contexts where privilege waiver is mandatory or required?

There is no strict legal requirement for waiver of legal professional privilege in the investigations context. However, in practice, if regulatory authorities request privileged information, it may be difficult to reject such a request, as a company will wish to co-operate.

43 Does the concept of limited waiver of privilege exist as a concept in your jurisdiction? What is its scope?

The concept of limited waiver of privilege does exist as a concept in Singapore. In this regard, the English common law position is likely to be endorsed by a Singapore court or tribunal.

The Belhaj v. DPP ([2018] EWHC 513 (Admin)) is likely to be persuasive authority on the scope of limited waiver of privilege. In this case, the High Court of England and Wales observed that privilege may be waived for a limited purpose without being waived generally. However, the existence of limited waiver is to be determined objectively and does not depend on the party’s subjective intention. Although the Singapore courts have not specifically decided on the issue of limited waiver in the context of limited production to law enforcement agencies, the Singapore courts are likely to view the Hong Kong Court of Appeal decision in Citic Pacific Limited v. Secretary for Justice and the Commissioner of Police (CACV60/2011) (whether limited waiver of privilege in respect of documents produced to the Securities and Futures Commission of Hong Kong was recognised) as persuasive authority.

44 If privilege has been waived on a limited basis in another country, can privilege be maintained in your own country?

This issue has not been specifically considered or determined in Singapore. However, the concept of limited waiver of privilege is recognised.

45 Do common interest privileges exist as concepts in your country? What are the requirements and scope?

Common interest privilege exists as a concept in Singapore. It can be used to enable one party to shield behind the privilege of another, and prevent a third party from obtaining or using documents disclosed, pursuant to the common interest between the former parties, in the subject-matter of the communications.

For common interest privilege to apply, a ‘similar interest’ must be at stake. For example, when several persons have a common interest in anticipated litigation, they may be able to assert this privilege.

46 Can privilege be claimed over the assistance given by third parties to lawyers?

Yes. For example, in Skandinaviska Enskilda Banken AB, Singapore Branch v. Asia Pacific Breweries (Singapore) Pte Ltd ([2007] 2 SLR(R) 367), the Court of Appeal held that certain draft reports by accountants commissioned by the company’s directors after discovery of a fraud on the company were prepared for the dominant purpose of litigation and, therefore, were subject to litigation privilege.

Witness interviews

47 Does your country permit the interviewing of witnesses as part of an internal investigation?

Yes, witness interviews are permitted and are an integral part of an internal investigation.

48 Can a company claim the attorney–client privilege over internal witness interviews or attorney reports?

Yes. A company can claim legal professional privilege over internal witness interviews or attorney reports, so long as the requirements for legal advice privilege or litigation privilege are satisfied. For legal advice privilege to apply, it must be shown that the documents in question contain solicitor–client privileged legal advice, or otherwise was generated for the dominant purpose of seeking legal advice. Attorney reports, for example, are likely to be protected by legal advice privilege.

Having a legal counsel attend and conduct witness interviews also enhances the prospects of a claim of legal professional privilege.

49 When conducting a witness interview of an employee in your country, what legal or ethical requirements or guidance must be adhered to? Are there different requirements when interviewing third parties?

There are no formal legal requirements for the conduct of witness interviews. In practice, Upjohn warnings are usually administered at the beginning of a witness interview, and accurate notes of the interview should be taken.

These practical requirements apply equally for interviews of third parties (such as former employees).

50 How is an internal interview typically conducted in your country? Are documents put to the witness? May or must employees in your country have their own legal representation at the interview?

How an internal interview is typically conducted depends on the internal procedure and policies of the particular company and, therefore, would differ case by case. To facilitate the fact-finding process, documents are usually put to the witnesses at the interview, subject to any confidentiality concerns.

There is no requirement for employees to have their own legal representation, and any request to obtain legal representation at the interview will be subject to the agreement of the employer.

Reporting to the authorities

51 Are there circumstances under which reporting misconduct to law enforcement authorities is mandatory in your country?

Yes. For example, under section 39 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act, if a person knows or has reasonable grounds to suspect that any property is implicated in drug dealing or criminal conduct (i.e., represents the proceeds of a crime, was used in connection with a crime or is intended to be used in connection with a crime), and that knowledge or suspicion arose in the course of his or her trade, profession, business or employment, it must be reported to a Suspicious Transaction Reporting Officer. Failure to do so constitutes a criminal offence.

Under sections 8 and 10 of the Terrorism (Suppression of Financing Act), information about terrorist activity and property must also be disclosed to the police. Failure to do so constitutes a criminal offence.

In the financial services industry, it is mandatory for financial institutions and regulated entities to report certain types of misconduct committed by their representatives under the Monetary Authority of Singapore Notices on Reporting of Misconduct of Representatives by Holders of Capital Markets Services Licence and Exempt Financial Institutions and by Financial Advisers; for example, acts involving fraud, dishonesty or other offences of a similar nature, market misconduct and insider trading, and other types of serious breaches.

52 In what circumstances might you advise a company to self-report to law enforcement even if it has no legal obligation to do so? In what circumstances would that advice to self-report extend to countries beyond your country?

Whether a company should self-report to law enforcement even if it has no legal obligation to do so, is a question to be assessed in each particular case. If the misconduct involved is of a nature that would trigger a regulatory investigation, self-reporting would be viewed as a mitigating factor by the regulatory authorities.

53 What are the practical steps you need to take to self-report to law enforcement in your country?

Depending on the type of offence or misconduct to be reported, the entity in question should complete a robust internal investigation or review to ensure that the facts are accurate, and that any formal requirements are complied with.

The reporting entity should also envisage questions from the regulator and pre-empt them.

Responding to the authorities

54In practice, how does a company in your country respond to a notice or subpoena from a law enforcement authority? Is it possible to enter into dialogue with the authorities to address their concerns before or even after charges are brought? How?

A company should review the notice or subpoena carefully to determine its scope and legitimacy, and whether the law enforcement authority is properly entitled to the materials sought. If it is, the company should comply with the notice or subpoena (as the case may be).

It is possible to enter into a dialogue with the authorities to address their concerns before, or even after, charges are brought, depending on the facts of the case and the severity of the charges. External lawyers experienced in these matters will typically liaise with the authorities.

55 Are ongoing authority investigations subject to challenge before the courts?

Yes, there is a theoretical risk of judicial review but this is rare in practice.

56 In the event that authorities in your country and one or more other countries issue separate notices or subpoenas regarding the same facts or allegations, how should the company approach this?

Yes, it would be prudent for a company to negotiate a consistent disclosure package between the various countries, subject to any applicable local requirements, as regulators will generally expect to be treated fairly and be provided with similar or consistent information.

57 If a notice or subpoena from the authorities in your country seeks production of material relating to a particular matter that crosses borders, must the company search for, and produce material, in other countries to satisfy the request? What are the difficulties in that regard?

This depends on the scope of the subpoena. Generally, if the material is in the possession, custody or power of a company, the company must search for and produce the material. This includes material that may be located overseas (e.g., on a server maintained in another jurisdiction), as long as it is within the possession, custody or power of the company.

When data servers or material are maintained by third parties or related companies not in Singapore and not within the possession, custody or power of the company, it may nonetheless choose to co-operate and offer assistance to provide access to these data servers or materials.

58 Does law enforcement in your country routinely share information or investigative materials with law enforcement in other countries? What framework is in place in your country for co-operation with foreign authorities?

We expect that law enforcement in Singapore may routinely share information or investigative materials with law enforcement in other countries. These matters are regulated under the Mutual Assistance in Criminal Matters Act, the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act (Cap. 65A), the Terrorism (Suppression of Financing) Act and the Monetary Authority of Singapore Act (the MAS Act).

59 Do law enforcement authorities in your country have any confidentiality obligations in relation to information received during an investigation or onward disclosure and use of that information by third parties?

Certain statutes may contain specific provisions regulating onward disclosure to, and use by, foreign and domestic authorities. See, for example, part VC of the MAS Act, which sets out statutory provisions governing assistance to foreign authorities and domestic authorities for their supervisory and other actions in respect of money laundering, terrorism financing and other offences.

60 How would you advise a company that has received a request from a law enforcement authority in your country seeking documents from another country, where production would violate the laws of that other country?

The company should obtain legal advice explaining why production of those documents would violate the laws of that other country. The company should resist disclosure, providing an explanation as to why production of the documents would cause the company to be in breach of the relevant foreign laws.

61 Does your country have secrecy or blocking statutes? What related issues arise from compliance with a notice or subpoena?

Singapore does not have secrecy or blocking statutes, save for the Official Secrets Act, which prevents the disclosure of official government documents and information.

62 What are the risks in voluntary production versus compelled production of material to authorities in your country? Is this material discoverable by third parties? Is there any confidentiality attached to productions to law enforcement in your country?

Generally, law enforcement authorities maintain the confidentiality of materials provided to them.

If the documents are privileged, they may be disclosed on the basis of a limited waiver of privilege. If so, this reduces the risk of onward disclosure and use.

If the documents are not privileged, the position on onward disclosure to, and use by, third parties is less clear. Foreign law enforcement authorities may request assistance and the sharing of information or documents, pursuant to legislation, treaties or other working agreements between them and the Singapore authorities.

Generally, shareholders will not have a right to apply for disclosure of such documents, unless they are allowed to do so under the company’s articles and memorandum of association, or other corporate constitutional documents or agreements, or if they obtain the documents in the course of civil proceedings.

Prosecution and penalties

63 What types of penalties may companies or their directors, officers or employees face for misconduct in your country?

A company found guilty of a criminal offence will generally be punished by a fine.

A company’s directors, officers or employees found guilty of a criminal offence may also be subject to imprisonment or fines (or both).

In this regard, certain legislation (such as section 331 of the Securities and Futures Act) provides that when an offence under the legislation committed by a body corporate is proved to have been committed with the consent or connivance of, or to be attributable to any neglect on the part of, an officer of the body corporate, the officer as well as the body corporate shall be guilty of that offence and shall be liable to be proceeded against and punished accordingly.

Further, a company or individual found guilty of a criminal offence may be required by a court to pay compensation to affected third parties.

In addition, companies or their directors, officers or employees may also be subject to sanctions or civil penalties imposed by regulatory bodies such as the Singapore Exchange and the Monetary Authority of Singapore (MAS) (e.g., orders prohibiting or suspending a person from taking part in certain regulated financial activities).

A court may also order a third party who has benefited from misconduct to disgorge the benefit arising from that misconduct, on the application of the MAS or any other claimant, pursuant to section 236L of the Securities and Futures Act.

64 Where there is a risk of a corporate’s suspension, debarment or other restrictions on continuing business in your country, what options or restrictions apply to a corporate wanting to settle in another country?

The options or restrictions applying to such a corporate would depend on the law of that other country. Generally, for certain regulated entities (such as banks and financial institutions), debarment or another regulatory sanction in one country may adversely affect the ability of that entity to carry on similar business in another jurisdiction.

65 What do the authorities in your country take into account when fixing penalties?

The authorities will take into account general sentencing guidelines and sentencing precedents in fixing penalties. They will also consider other factors, such as the severity of the misconduct, the culpability of the offender, whether other mitigating factors exist, the accused person’s antecedents, and any other relevant facts relating to the offence.

Resolution and settlements short of trial

66 Are non-prosecution agreements or deferred prosecution agreements available in your jurisdiction for corporations?

Deferred prosecution agreements (DPAs) are available for certain offences, including offences under the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act, the Prevention of Corruption Act and the Securities and Futures Act. The DPA framework enables corporates to reach agreement with the Public Prosecutor for the deferral of prosecution, in exchange for the imposition of certain requirements.

Further, section 232(5) of the Securities and Futures Act also provides for the possibility of out-of-court settlements with the Monetary Authority of Singapore (MAS), for breach of the disclosure of interests or market conduct provisions in the Act. In such cases, the MAS will expect the person who contravened the relevant statutory provisions to provide an admission of liability (see the MAS Enforcement Monograph, at [6.12]).

67 Does your jurisdiction provide for reporting restrictions or anonymity for corporates that have entered into non-prosecution agreements or deferred prosecution agreements until the conclusion of criminal proceedings in relation to connected individuals to ensure fairness in those proceedings?

Section 149J of the Criminal Procedure Code provides that the high court may postpone the giving of public notice of matters relating to a DPA as is necessary to avoid a substantial risk of prejudice to the administration of justice in any legal proceedings, investigation under the Criminal Procedure Code, or any criminal investigation under any other written law.

The court also has the power to order that information in court documents be removed or redacted.

68 Prior to any settlement with a law enforcement authority in your country, what considerations should companies be aware of?

Companies should be aware of any outstanding liabilities that it may have in respect of other parties (e.g., in civil claims) and consider the potential consequences of entering into a settlement agreement with the law enforcement authority. Companies should also consider the effect of a settlement on any pending or parallel regulatory investigations in other jurisdictions, which may arise out of the same or similar subject-matter.

69 To what extent do law enforcement authorities in your country use external corporate compliance monitors as an enforcement tool?

Law enforcement authorities, in particular, the MAS, may use external corporate compliance monitors as an enforcement tool. For example, in April 2021, as part of the enforcement measures taken against Bank J Safra Sarasin Ltd, Singapore Branch for its failures to comply with certain anti-money laundering and counter-terrorist financing requirements, the MAS required the bank to appoint an independent party to validate the effectiveness of the bank’s remediation measures and report the findings to the MAS.

70 Are parallel private actions allowed? May private plaintiffs gain access to the authorities’ files?

There are no legal restrictions on civil proceedings taking place in parallel with regulatory investigations. However, in practice, civil proceedings are usually put on hold pending the conclusion of criminal proceedings, to avoid conflicting evidence that may complicate the civil proceedings.

Civil litigants are unlikely to gain access to the authorities’ files and documents unless special third-party or non-party discovery orders are sought by the litigants and granted by the court.

Publicity and reputational issues

71 Outline the law in your country surrounding publicity of criminal cases at the investigatory stage and once a case is before a court.

Criminal cases are generally kept confidential at the investigatory stage, unless there is a public interest in the matter, in which case the relevant authority may choose to issue a press statement stating that it is investigating the matter. However, details of the investigation are unlikely to be released until investigations are complete or certain milestones have been reached.

Once a case is before a court, it will become public knowledge unless any confidentiality orders (e.g., to protect minors) are specifically sought and granted. Generally, and unless ordered otherwise by the court, members of the public may also attend criminal trials.

Under the Administration of Justice (Protection) Act 2016, anyone who intentionally publishes any matter or carries out any other act that prejudices, interferes with or poses a ‘real risk of prejudice’ to current court proceedings is liable to be found guilty of contempt of court.

72 What steps do you take to manage corporate communications in your country? Is it common for companies to use a public relations firm to manage a corporate crisis in your country?

Yes, it is common for companies to use a public relations (PR) firm to manage corporate crises in Singapore. A PR firm may work with a company’s corporate communications or media relations team to determine the appropriate approach to such communications. Lawyers may also provide high-level input and guidance on these matters.

73 How is publicity managed when there are ongoing related proceedings?

Companies generally do not comment on ongoing related proceedings unless it is necessary to do so. In any event, any statements or comment provided by a company must be accurate, unbiased and consistent.

Duty to the market

74 Is disclosure to the market in circumstances where a settlement has been agreed but not yet made public mandatory?

For listed companies, disclosure may be required under Rule 703 of the Singapore Exchange (Mainboard) Listing Rules, subject to any further requirements imposed by the relevant law enforcement authorities.

Environmental, Social and Corporate Governance (ESG)

75 Does your country regulate ESG matters?

The ESG regulatory regime is developing in Singapore. For example, in 2019, the Monetary Authority of Singapore (MAS) published its Green Finance Action Plan, which sets out strategies for Singapore’s transition to green finance.

In 2020, the MAS released a set of Guidelines on Environmental Risk Management for the asset management, banking and insurance sectors. Among other things, these Guidelines require financial institutions to put in place robust policies and processes to manage environmental risk in a systematic and consistent manner (e.g., scenario analysis and stress testing).

Companies listed on the Singapore Exchange (SGX) are also required to submit sustainability reports annually under Listing Rule 711A-B. These reports should cover material ESG factors; policies, practices and performance; targets; a sustainability reporting framework; and a board statement.

76 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address ESG matters?

In 2021, the SGX commenced a public consultation exercise on enhancements to its sustainability reporting guidelines, including climate-related reporting in line with the recommendations of the Task Force on Climate-Related Financial Disclosures. This is a first step to better prepare issuers for reporting against anticipated global baseline sustainability reporting standards to be developed by the International Financial Reporting Standards Foundation.

77 Has there been an increase in ESG-related litigation, investigations or enforcement activity in recent years in your country?

No, but we expect this to be a rising trend in the future.

Anticipated developments

78 Do you expect to see any key regulatory or legislative changes emerge in the next year or so designed to address corporate misconduct?

The Monetary Authority of Singapore’s Guidelines on Individual Accountability and Conduct took effect on 10 September 2021. We expect to see further regulatory scrutiny on the conduct of senior managers and employees of financial institutions, as well as culture and conduct in these institutions more generally.

Footnotes

¹ Kabir Singh is a partner at Clifford Chance Asia. Janice Goh is a partner and Tian Yi Tan is a senior associate at Cavenagh Law.