A good regulatory compliance register tells an organisation which requirements actually apply, who must fulfil them, when action is triggered and what evidence proves completion. It is not a collection of copied laws or a green tick beside an annual filing reminder. In Singapore, ACRA, PDPC and other regulators publish requirements specific to entities and activities. A reliable register links these sources to day-to-day controls and keeps them current.
The practical starting fields are obligation, applicable entity, authoritative source, trigger, accountable owner, evidence, review date and escalation. Each entry should be understandable by the person who must act and verifiable by someone independent. ISO 37301 provides an international management-system framework, but it does not replace Singapore legislation or automatically determine the applicability of a rule.
This guide follows a fictional company that changes its financial year end and subsequently misses a filing dependency. It demonstrates how obligations, source checks, named ownership and change control should fit together instead of trusting a copied spreadsheet.
This article owns the cross-business register of duties and controls, not the drafting of new law in The Gold Standard of Legislative Drafting, public enforcement in The Gold Standard of Regulatory Investigation Governance, employment fact-finding in The Gold Standard of Corporate Internal Investigations or the mechanics of The Gold Standard of ACRA Annual Return Filing Services.
Find the information you need
Use Chapters 1–7 to map obligations, Chapters 8–13 to make duties operable, and the final chapters to test controls, record exceptions and keep the register current.
Open the 17-chapter index
- An obligation register is a living operating system
- Define which entities and activities the register covers
- Use original authorities before secondary summaries
- Separate statute, guidance, contract and chosen standard
- Describe the actual duty in operational language
- Assign a person who can really control compliance
- Verify scope, exemptions and thresholds carefully
- Connect duties to calendars without reducing them to dates
- Keep evidence of performance, not only a checked box
- Build a system for legal and regulatory change
- Treat policy changes as implementation projects
- Integrate third parties and outsourced functions
- Link the register to risk without hiding serious duties
- Test controls rather than only reviewing policy
- Make exceptions and incidents visible
- Keep compliance evidence accessible but secure
- Review the whole system at leadership level
1. An obligation register is a living operating system
A compliance obligation register is a structured map of legal, regulatory and adopted requirements that affect an organisation. It is different from a list of penalties, a lawyer’s folder of statutes or a calendar of annual filing dates. A useful register connects each applicable requirement to the relevant activity, accountable owner, evidence of control and method for handling change. Without those links, the register may look detailed while providing little assurance that anyone knows what to do.
ISO 37301:2021 addresses compliance management systems and has been confirmed current by ISO in 2026. Its public description emphasises establishing, maintaining, evaluating and improving a management system. That international standard is an organisational framework, not the source of each Singapore legal obligation. The first gold-standard test is whether the register helps a real employee identify the relevant duty and responsibly fulfil it.
Begin with a defined entity and activity. An education provider, retailer, regulated financial institution and charitable organisation may all face materially different rules. Do not purchase a generic list and assume it establishes the law for every business.
2. Define which entities and activities the register covers
An organisation may operate several companies, branches, websites and outsourced services. The legal duties of one entity do not always transfer automatically to another simply because they share a logo. A group-level register is helpful only if it identifies where each obligation actually applies. Conversely, separate spreadsheets can hide duties that several operations share.
Create a scope map listing legal entities, jurisdictions, operating activities, products, employment arrangements, relevant regulators and material service providers. Confirm who can approve the scope and how new business activities are added. Where an activity is uncertain, record it for legal assessment rather than forcing a guessed applicability decision. A register should expose uncertainty instead of burying it in a green status cell.
The output is a transparent boundary: managers know which part of the business has been assessed and which proposed expansion would require a fresh review.
3. Use original authorities before secondary summaries
Regulations change and third-party summaries can be incomplete. An article promising ‘all Singapore compliance requirements’ may omit exemptions, effective dates or sector-specific instruments. Legal duties may arise from legislation, subsidiary regulations, official licences, binding orders and contractual or voluntary commitments. These sources do not have identical legal standing.
For each entry, record the primary authority, provision, relevant regulator, applicable date and link to an authoritative source. ACRA publishes business-type-specific requirements and guidance for company filings and registers; PDPC explains data protection obligations. Summaries can help identify topics, but material requirements should be checked against the authentic rules and current official publications. Where interpretation is difficult, seek qualified counsel.
Quality means that a reviewer can travel from the practical duty back to the legal source and understand the conditions that make it applicable.
4. Separate statute, guidance, contract and chosen standard
A company might voluntarily adopt ISO 37301, agree to a customer security requirement and also face binding statutory reporting duties. All are important, but their consequences and sources differ. Treating every internal policy as a law exaggerates exposure; treating a binding rule as voluntary invites preventable failure.
Assign each obligation a source category and enforceability note reviewed by an appropriately competent person. Use separate fields for adopted commitments, licence conditions and statutory obligations. If an international standard is referenced in a contract or regulatory framework, explain how that reference affects the organisation rather than asserting that ISO has direct force as national law. Keep management aspirations such as ‘best possible service’ distinct from measurable mandatory requirements.
A readable compliance register gives staff the practical control without misrepresenting what a regulator can legally demand.
5. Describe the actual duty in operational language
Copying an entire Act into a spreadsheet cell is not enough. An employee needs to know what triggers a duty and what action satisfies it. A statement such as ‘comply with the Companies Act’ identifies a broad body of law but does not explain who must maintain which records or how a filing is completed.
Translate legal sources into a concise action description that identifies the actor, trigger, action, due condition and evidence to retain. Have qualified reviewers ensure the summary preserves material exceptions and distinctions. For example, ACRA explains that annual-return requirements depend on company type and financial year end, with company information needing to be accurate. That should not become a universal fixed date copied into every subsidiary.
The test is whether an operational owner can explain exactly what they must check and which source governs a difficult case.
6. Assign a person who can really control compliance
A register can list ‘Legal’ as owner for every item, making nobody accountable for actual execution. Lawyers may interpret obligations while HR maintains employment records, finance files returns and IT protects data. Effective ownership distinguishes legal interpretation, operational performance, independent assurance and escalation.
Record a named accountable role and operational executor, along with a backup for absence or staff turnover. Give each person enough authority and resources to manage their duty. Senior management should recognise material issues outside a junior employee’s control. SGX’s current governance guidance places overall responsibility for risk and internal controls on the board of a listed issuer, while management implements appropriate controls; those governance expectations should not be treated as identical across all private organisations.
The gold standard has no critical obligation for which several teams each believe the other team is responsible.
7. Verify scope, exemptions and thresholds carefully
An organisation may be subject to a general rule but qualify for a lawful exemption or a different filing format. Conversely, a small operation may assume it is exempt when an obligation applies regardless of revenue. Examples include dormant-company filing conditions, particular data protection duties and regulated licensing requirements. A template that omits conditions can mislead in both directions.
Record the facts on which applicability depends and the evidence supporting them. ACRA’s current corporate requirements explain distinct entity profiles, exemptions and registers. Test the decision when the company changes size, activities, entity type or structure. An exemption should not be recorded as permanent merely because it applied in an earlier year. If an interpretation is uncertain, mark it for professional review and set a responsible date.
Reviewers should be able to explain not only why an obligation was included but why an apparently relevant one was excluded.
8. Connect duties to calendars without reducing them to dates
Some obligations recur annually; others arise whenever a director changes, an incident occurs, a complaint is received or a personal-data activity changes. A calendar captures predictable due dates but may miss event-driven duties. It also cannot resolve whether a date is measured from year end, notice receipt, registration or another legal trigger.
Create separate recurrence and trigger fields. Link calendar reminders to the underlying source and designate a verifier for unusual events. ACRA’s annual-return guidance explicitly ties deadlines to company characteristics and financial year ends rather than a single universal day. Event-driven changes to statutory company records may require different steps. Avoid inventing grace periods from internal reminders.
A reliable programme helps staff recognise the trigger while preserving the legal calculation for qualified review.
9. Keep evidence of performance, not only a checked box
A task marked complete does not establish that a regulatory filing contained correct information or that a required notice was received. A company might complete an online form but leave an outdated officer address unchanged. An IT team could attest to security training without verifying that access rights were removed for former staff. Evidence quality matters.
Specify the acceptable completion record for each duty: authoritative receipt, verified registry update, approved meeting minutes, training competence check or tested technical control, as appropriate. Preserve sensitive documents through restricted storage and refer to stable source identifiers in the register. Do not upload private records to a broad spreadsheet merely to prove that compliance work occurred.
An independent reviewer should be able to inspect the outcome of a control rather than rely solely on the executor’s self-assessment.
10. Build a system for legal and regulatory change
Regulatory changes are a common source of compliance failure because an organisation may be accurately following last year’s rules. A new commencement date, amended form, additional data duty or updated supervisory guidance may alter what staff must do. Change notices should not remain in an inbox owned by someone who has moved departments.
Assign monitoring sources for each regulator and identify who assesses relevance, legal effect and operational consequences. Record publication, effective and action dates separately. ISO 37301 describes a continuing compliance management system, including keeping requirements current. Distinguish a consultation, enacted law awaiting commencement and operative requirement, especially when future implementation is announced publicly.
The standard is traceable change control: people can see what shifted, who decided its relevance and when the working procedure changed.
11. Treat policy changes as implementation projects
A register can be technically updated while the organisation continues operating under the old procedure. A changed customer-consent requirement may need new forms, staff training, vendor contract terms and technical settings. Simply editing a sentence in Excel does not complete that work.
For each material change, create an implementation task with a named owner, tested requirement, dependencies and evidence of completion. Escalate resources when multiple teams must cooperate. Use a dated version record so auditors can tell which policy was in force when a transaction occurred. Do not silently overwrite historical decisions or pretend the organisation had complied with a rule before it commenced.
A reliable legal-change process ends when the control works in ordinary operations, not when a compliance officer has acknowledged the update.
12. Integrate third parties and outsourced functions
Using an external payroll provider, hosting platform or corporate services firm may change who performs certain tasks but does not automatically eliminate all obligations of the contracting organisation. A company that outsourced filing can still need accurate underlying information and proper oversight. Different statutes and contracts allocate responsibilities differently.
Map which duties the service provider performs, what evidence the organisation receives and who verifies the result. Check contract scope and data-access boundaries. ACRA permits authorised company officers and corporate service providers to file relevant annual returns, but the actual statutory responsibilities and accuracy requirements must still be considered. Keep subcontracting risks within the appropriate legal and operational review.
The gold standard distinguishes ‘someone is paid to do it’ from ‘we can demonstrate that the lawful requirement was fulfilled’.
13. Link the register to risk without hiding serious duties
Risk scoring can prioritise attention, but a low score is not permission to ignore a binding legal requirement. Some obligations protect individual rights even if they generate little immediate financial exposure. Conversely, a complex high-risk process may need deeper review than a straightforward recurring filing.
Use a credible assessment of impact, likelihood where supportable, control strength and legal significance. Identify obligations with mandatory timelines or severe consequences distinctly from general improvement projects. Do not fabricate quantitative probabilities. A useful dashboard explains uncertainty and offers a path to management decisions. ISO 37301’s management-system approach and SGX’s board risk-governance guidance reinforce the need for controls and review, not for invented mathematical certainty.
Responsibility becomes real when prioritisation influences staffing and verification while every mandatory duty remains accounted for.
14. Test controls rather than only reviewing policy
A policy can promise that all records are updated promptly while a real change remains unfiled. A compliance audit should inspect selected transactions to see whether the rule was actually followed. Internal review needs sufficient independence and a method for recording and correcting findings.
Choose risk-based samples linked to identified obligations. Verify the actual source records, completion steps, dates and authorised actions. Compare outcomes to the register’s claimed controls and ask what failed if evidence is missing. Keep personal data protected and avoid theatrical testing that creates real violations. Do not interpret an isolated discrepancy as automatic proof of criminal wrongdoing. Remediation must follow the proper legal and organisational process.
The gold standard is a documented check capable of disproving management’s assumptions when they are wrong.
15. Make exceptions and incidents visible
People may discover a late filing, unavailable control, wrong data disclosure or unclear legal requirement. If the system rewards everyone for appearing green, staff may hide these incidents. A credible programme needs an honest way to record exceptions, assess impact and seek lawful correction.
Create an escalation route with severity, actual due date, responsible owner and status. Distinguish a confirmed breach from uncertainty requiring interpretation. Do not invent a generic voluntary disclosure duty for every regulator; notification obligations are context-specific. Assign corrective measures and verify them. Where a legal incident may require prompt reporting, consult current official guidance and competent advisers without delaying necessary protective action.
A register is working when exceptions cause timely decisions rather than disappearing under a changed spreadsheet colour.
16. Keep compliance evidence accessible but secure
Registers often link to contracts, company officers’ details, personal information and internal audit findings. Access controls should allow necessary verification without exposing sensitive records to all staff. A publicly shared folder is not automatically a suitable evidence repository.
Use role-based access, retention controls and logs showing legitimate changes. Refer to source IDs rather than copying entire confidential documents into widely circulated cells. Coordinate with the Data Protection Officer where personal data is involved; PDPC guidance emphasises organisational accountability and appropriate data-protection practices. Retain information for lawful business and legal purposes rather than keeping every draft forever.
The quality standard combines retrievability for authorised reviewers with appropriate confidentiality for the people named in the records.
17. Review the whole system at leadership level
A compliance register can grow for years without anyone questioning whether it still covers the actual business. New operations, supplier changes and evolving rules may render parts outdated. Leadership should receive a meaningful report about unresolved obligations, control effectiveness and necessary resources, not simply a total count of spreadsheet rows.
Evaluate recent law changes, audit findings, missed duties, ownership gaps and controls that no longer work. For listed issuers, SGX Practice Guidance 9 discusses board oversight and review of risk and internal control systems; other entities should apply governance appropriate to their actual obligations. Record decisions to invest, correct, retire or expand controls. The process should be able to identify important matters that the current register missed.
A mature system measures whether decisions improve compliance, not whether the register looks visually complete.
Original worked example: the register stayed green after the business changed
A fictional Singapore private company has a compliance spreadsheet with a row marked ‘ACRA annual return — completed last year’. The company changes its financial year end and later hires a new company secretary. Its internal calendar, however, still contains the previous year’s filing assumptions and the earlier secretary’s email address. A staff member sees green because the last filing was successful, while no one has verified the new trigger, current official records and actual responsibilities. That is a governance failure even before a deadline is missed.
The compliance owner first retrieves the company information, authorised decisions and current ACRA guidance. A qualified reviewer checks the filing applicability and time calculation, including any relevant company features, instead of assuming the old date remains correct. The register is updated with the current source, entity, trigger and accountable owner. Finance and the corporate services provider clarify who prepares the information and who verifies completion. The team separately checks whether officer records and official contact details require updating. No one silently overwrites the historical filing date to pretend there was never a gap.
If the review discovers a filing is already late, the responsible team records the actual issue and seeks proper official or legal guidance about correction and consequences. The company tests its change-control process so that a future financial year-end change automatically generates an obligation review. Leadership sees the defect and the verified remedy, not just a new green status. The result is a register that learns from a concrete failure rather than awarding itself compliance for owning a spreadsheet.
The minimum effective obligation record
| Field | What must be recorded | Common failure |
|---|---|---|
| Authority | Current regulator or legal provision | Unverified vendor summary |
| Applicability | Entity, activity and conditions | Assuming every rule applies to every branch |
| Trigger | Event, period or date rule | Old calendar copied forward |
| Owner | Accountable and executing roles | Everyone named, nobody responsible |
| Control | Operational task and proof | Policy statement without testing |
| Change | Review source and revised version | Law changes ignored |
| Escalation | Issues, owner and corrective evidence | Unexplained green status |
Compliance-register quality checklist
- Identify legal entities, activities, jurisdictions and material partners.
- Record the actual legal authority and its effective status.
- Distinguish binding duties from voluntary commitments and contracts.
- Summarise the operative action without deleting key conditions.
- Assign accountable owners, executors and backups.
- Track conditional exemptions and their evidence.
- Separate event-driven duties from calendar recurrence.
- Require verifiable proof of filings and other controls.
- Monitor official regulatory changes and commencement dates.
- Turn law changes into tested operational updates.
- Include duties performed by outsourced providers.
- Escalate and correct missed obligations transparently.
- Use role-based access for personal and confidential evidence.
- Review the register at leadership level and after business changes.
Frequently asked questions
Is a regulatory compliance register legally compulsory for every Singapore business?
Do not assume one universal register format is mandated. Specific statutory records and duties depend on entity type and sector; a compliance register is an organisational management tool.
Does ISO 37301 replace Singapore company law?
No. ISO 37301 is a management-system standard and does not substitute for applicable domestic legislation, regulator requirements or licence conditions.
Can an accountant or corporate service provider take over all legal responsibility?
Providers may perform authorised work, but duties and oversight depend on the relevant law, role and agreement. Verify what remains the company’s responsibility.
Are annual returns due on the same calendar date for all companies?
No. ACRA’s current guidance differentiates deadlines according to company characteristics and financial year end.
What should happen when a new law is enacted but not yet operative?
Track publication, commencement and implementation separately. Do not present a planned future rule as already enforceable.
Can a green spreadsheet status prove compliance?
No. Completion should be supported by appropriate, verifiable evidence and controls tested in practice.
Is every internal policy violation a regulatory offence?
No. Internal rules, contracts and law can have different consequences. Record and assess the source correctly.
How often should the register be reviewed?
Use a suitable recurring cadence plus event-driven reviews after relevant legal, business or operational changes; no universal interval fits every obligation.
The gold standard is a register that changes behaviour
A register is successful when it prevents avoidable failures, makes uncertainty visible and gives people a responsible next step. Legal interpretation remains with competent professionals, while operational owners actually perform the work and independent reviewers test it. Comprehensive-looking spreadsheets that nobody uses cannot substitute for a functioning compliance management system.
The most important evidence is what happens after a real change: a new regulation, a different business activity, an outsourced service or an identified failure. When duties, owners, controls and results can be updated together, the register becomes a living part of responsible governance instead of an annual documentation exercise.
Official and professional sources
ISO 37301:2021 — Compliance Management Systems (Confirmed 2026)
ACRA — Compliance Requirements by Business Type (Updated September 2026)
ACRA — Annual Return Filing Steps and Verification (Updated October 2026)
ACRA — Company Registers and Record Requirements
PDPC — Organisational Data Protection Services
SGX Practice Guidance 9 — Risk Management and Internal Controls
Connected eduKate Gold Standard articles
The Gold Standard of Legislative Drafting
The Gold Standard of Regulatory Investigation Governance
The Gold Standard of Corporate Internal Investigations
The Gold Standard of ACRA Annual Return Filing Services
Featured image is the historic former C J Koh Law Library building at NUS Bukit Timah, used to illustrate legal source research, not a regulatory office or an actual compliance audit.
Editorial review: 19 October 2026. This is a general compliance-management framework, not legal advice or a determination of any organisation’s obligations. Verify current law and qualified professional interpretation for a specific entity.