RORC and beneficial-owner register under CSP Act 2024 — Common mistakes and rejection reasons

The Register of Registrable Controllers (RORC) is the register that every Singapore company and limited liability partnership must keep of individuals or entities with significant control, and most compliance gaps trace back to an incomplete register, a missed update, or confusion between the RORC and the public beneficial-owner disclosure regime under CSP Act 2024. This guide sets out where practitioners go wrong and how to fix each mistake.

Raffles Corporate Services works with a panel of corporate and employment law firms; this article is general information, not legal advice.

What the RORC and beneficial-owner register under CSP Act 2024 actually covers

The RORC is an internal register, not a public one. Every Singapore-incorporated company, foreign company and limited liability partnership, with a small number of exemptions such as public listed companies and Singapore financial institutions already subject to equivalent transparency requirements, must identify its registrable controllers and record their particulars in the RORC. A registrable controller is generally an individual or a legal entity that holds, directly or indirectly, more than 25% of the shares or voting rights in the company, or that otherwise has the right to exercise, or actually exercises, significant influence or control over the company’s management.

The statutory basis for the register sits in Part 11A (sections 386AA to 386AP) of the Companies Act 1967, inserted specifically to bring Singapore’s corporate transparency regime in line with international anti-money laundering standards. The register is not lodged with ACRA as a matter of routine, but it must be produced to ACRA, the police or other law enforcement agencies on request, and it must be kept at the company’s registered office or with its registered filing agent.

Since most companies do not prepare their own RORC in-house, the work is usually done by a corporate service provider. Corporate service providers who prepare, review or lodge RORC-related filings on a client’s behalf are themselves regulated under the Corporate Service Providers Act 2024, which introduced a licensing regime, mandatory customer due diligence obligations, and a fit-and-proper standard for CSP staff handling this kind of work. A defective RORC is therefore rarely rejected by ACRA in the way an incorporation filing might be rejected; the failure more often surfaces later, during an audit, a bank’s know-your-customer refresh, or a licensing due diligence exercise, which is precisely why getting the register right the first time matters so much.

Who this affects: directors, company secretaries and the controllers themselves

Three groups carry RORC obligations, and each tends to misunderstand its role in a different way. Directors are ultimately responsible for ensuring the company maintains an accurate RORC, even though in practice the company secretary or an external CSP does the legwork. Company secretaries are usually the ones who send out the notices requesting controller information and who physically maintain the register. Registrable controllers themselves have a positive duty to respond to a company’s notice and to inform the company of any change in their particulars or in their controlling interest, generally within a short, fixed number of days of the change occurring.

Groups with layered holding structures, family trusts, or nominee shareholding arrangements face the most complexity, because significant control can sit with a person who holds no shares at all, such as a settlor or protector of a trust that owns the shares. Companies with a single individual shareholder-director have the easiest task, since that person is almost always the sole registrable controller.

Multinational groups with a Singapore holding company also need to think about this from the top down rather than only at the local entity. Where the immediate parent is itself a listed entity or a regulated financial institution, it may be exempt from RORC disclosure in its own right, but that exemption does not automatically flow down to the Singapore subsidiary, which must still identify its own registrable controllers by looking through the group structure to the relevant natural persons or exempted entities above it. This is one of the more common points of confusion for regional finance teams who assume that a listed parent’s transparency obligations elsewhere are sufficient for Singapore purposes.

Eligibility and information requirements for a registrable controller entry

For each registrable controller, the RORC must record: full name, alias (if any), residential address, nationality, identification number with the type and country of issue, date of birth, the date the person became a registrable controller, and the nature of that control, whether shareholding, voting rights, or other significant influence. Where the controller is a legal entity rather than an individual, the register instead records the entity’s name, registration number, registered address, legal form and the date it became a registrable controller.

A company that, after taking reasonable steps, believes it has no registrable controllers, which is unusual but possible in some group structures, must still record that conclusion in the register, together with the steps taken to reach it. An empty register with no explanation is treated in the same way as a missing register, and both are common gaps found during compliance reviews.

Cost and timeline for getting the RORC right

For a straightforward private company with one to three individual controllers, a CSP will typically charge between S$150 and S$400 to set up the initial RORC as part of the incorporation or annual compliance package, and the work itself takes about 1 to 2 weeks once the necessary identification documents are in hand. Where the structure involves a trust, a nominee arrangement, or an offshore holding company, proper identification and verification of the ultimate controller can take 3 to 6 weeks, largely because of the time needed to obtain certified documents from overseas and to trace the chain of control back to a natural person.

Ongoing maintenance is comparatively inexpensive: most CSPs bundle an annual RORC review into the corporate secretarial retainer for an incremental S$100 to S$250 a year, with updates triggered by a change in shareholding typically turned around within 3 to 5 business days of the CSP being notified. The real cost of getting this wrong is not the CSP’s fee but the time and legal cost of a retrospective clean-up exercise once a bank, auditor or regulator flags a gap, which can run into several thousand Singapore dollars in professional fees for a group with multiple layers of holding entities.

Step-by-step: identifying, verifying and lodging registrable controllers

First, map the ownership and control structure from the top down, including any trusts, nominee arrangements, or foreign holding vehicles, not just the immediate shareholder register. Second, send a formal notice to every person or entity reasonably believed to be a registrable controller, requesting confirmation and the required particulars. Third, follow up on non-responses; a controller who ignores the notice does not relieve the company of its duty to record what it reasonably believes to be true, based on the best information available to it.

Fourth, verify identification documents against the original or a certified true copy, particularly for foreign nationals and foreign entities, before entering particulars into the register. Fifth, keep the register in the prescribed format at the registered office or with the registered filing agent, together with the underlying notices and responses as supporting evidence. Sixth, review the register whenever there is a share transfer, allotment, change in the constitution affecting control, or restructuring of a trust or nominee arrangement, and update it within the statutory notification period. Seventh, where a corporate service provider handles this on the company’s behalf, confirm that the provider is properly licensed under the Corporate Service Providers Act 2024, and ask what due diligence checks it applies to controller verification, since this affects how defensible the record is if challenged later.

Common mistake: treating nominee and trust arrangements as invisible to the RORC

The single most frequent gap found on review is a company recording only its registered shareholders and stopping there. Where shares are held by a nominee, or by a corporate trustee on behalf of a trust, the registrable controller is not the nominee or the trustee; it is the person who ultimately controls how those shares are voted or who stands to benefit from them, such as the beneficial owner behind the nominee arrangement, or the settlor, trustee, protector or beneficiaries with a vested interest of over 25% in a trust.

The fix is to ask, at the point of incorporation and at every annual review, whether any shareholder holds its shares for and on behalf of another party, and to trace that chain until a natural person or an exempted entity is reached. This is precisely the situation the RORC was designed to capture, and it is also the reason groups with family trusts or offshore holding companies should budget for the longer 3 to 6 week verification timeline described above rather than assuming a same-week turnaround.

Common mistake: missing the notification window when control changes

The RORC is not a set-and-forget document. A common failure is updating the shareholder register after a share transfer or allotment but forgetting that the RORC needs a corresponding update, particularly when the change pushes a shareholder’s interest across the 25% threshold, or removes an existing controller’s interest below it. Companies also frequently fail to capture control that arises other than through shareholding, such as a new shareholders’ agreement giving one investor a veto right over major decisions, which can itself create a registrable controller with no change in the share register at all.

The practical fix is to build RORC review into the same checklist as every share transfer, allotment, buyback and constitutional amendment, rather than treating it as a separate annual task. Anyone amending a company’s constitution should also be prompted to check whether the amendment changes anyone’s degree of control over the company.

Common mistake: confusing the internal RORC with public disclosure under the CSP Act 2024 regime

Since the Corporate Service Providers Act 2024 tightened obligations on CSPs, some practitioners have assumed the RORC itself became a publicly searchable register, or that CSP Act 2024 introduced a new statutory register replacing the RORC. Neither is accurate. The RORC remains an internal company record under the Companies Act 1967 framework; what changed is the obligations placed on the corporate service providers who help maintain it, including stricter due diligence on the client company’s beneficial owners before a CSP will act, and record-keeping obligations on the CSP’s own file, kept separately from the company’s own RORC.

The fix is simple but frequently skipped: confirm with your CSP exactly which register they are updating and under which piece of legislation, and keep the company’s own RORC and the CSP’s internal due diligence file as two distinct sets of records, both accurate and both current. Practitioners advising on the RORC and beneficial-owner register under CSP Act 2024 obligations should treat these as complementary but separate compliance streams, not one and the same register.

FAQs

Does the RORC have to be filed with ACRA every year?
No. The RORC is kept by the company itself, at its registered office or with its registered filing agent, and produced to ACRA or law enforcement on request rather than lodged as a routine annual filing.

What happens if a company genuinely has no registrable controllers?
The company must still record that conclusion in the register, together with a note of the reasonable steps it took to reach that view, rather than leaving the register blank.

How is a registrable controller different from a nominee shareholder?
A nominee shareholder appears on the share register but holds the shares for someone else. The registrable controller is the person the nominee acts for, or the person who otherwise exercises significant control, and it is that person’s particulars that belong in the RORC.

Who checks whether a corporate service provider handling RORC work is properly licensed?
Licensing of corporate service providers falls under the Corporate Service Providers Act 2024. Companies engaging a CSP for RORC or other statutory compliance work can verify licensing status with ACRA before engagement.

Does a shareholders’ agreement need to be reviewed for RORC purposes?
Yes. Rights such as board appointment rights or veto rights over major decisions can create significant control even without a shareholding above 25%, so shareholders’ agreements should be reviewed whenever they are signed or amended.

Related guides

For the full mechanics of setting up and maintaining a compliant register from scratch, see our companion piece, Singapore Register of Registrable Controllers (RORC): a complete compliance guide. Groups that also hold, or are assessing whether they need, a Monetary Authority of Singapore payments licence may find it useful to read our separate guide to MAS Payment Services Act licensing for major and standard payment institutions, since controller disclosure obligations under that licensing regime run alongside, though separately from, RORC obligations under the Companies Act 1967. Where an existing employment pass holder in the group is also rejoining the same employer under a fresh application, our sister site’s note on EP holders rejoining the same employer covers that adjacent process; it is not part of RORC compliance but often comes up in the same onboarding conversation for group HR teams.

For the underlying legislation, the relevant provisions can be checked directly on Singapore Statutes Online. Company particulars and filing status can be verified through ACRA’s BizFile portal, and tax residency or reporting questions that touch on beneficial ownership disclosures can be checked against guidance published by IRAS.

Need help with this? Call, SMS or WhatsApp +65 8501 7133, or email [email protected]. Raffles Corporate Services works with a panel of corporate and employment law firms; this article is general information, not legal advice.