Data Bureau (Singapore) will never ask you to transfer money or disclose banking log-in details over a phone call.
Call the 24/7 ScamShield Helpline at 1799 if you are unsure if a contact is legitimate.
Circular 04/2026 · New Entry Notification · Programme Reference: CSP-18
A formal credential issued by Data Bureau (Singapore) confirming that the holder is an ACRA-registered Corporate Service Provider that meets an independently assessed standard of governance, compliance, and operational conduct.
The Certificate of Corporate Secretarial Practice (Programme Reference: CSP-18) is issued by Data Bureau (Singapore) to Corporate Service Providers (CSPs) registered with the Accounting and Corporate Regulatory Authority (ACRA) under the Corporate Service Providers Act 2024. Each certificate is assigned a unique Certificate ID and is valid for one year from the date of issuance, subject to ongoing compliance with the Data Bureau (Singapore) Renewal, Revocation & Programme Conduct Policy (DB-POL-001).
The certificate confirms that the holder is a legally registered CSP in good standing with ACRA, and has satisfied Data Bureau's independently assessed standard across six domains: regulatory standing and institutional legitimacy, AML/CFT/KYC compliance, statutory and regulatory filing governance, employment and human resource compliance, operational governance and client protection, and public institutional presence and brand integrity.
ACRA CSP registration is a prerequisite for application. Registration confirms who may operate and under what conditions. CSP-18 assesses what a CSP does within that framework — how it governs its compliance, manages client obligations, maintains its staff, and presents itself to the market.
Certificates are publicly verifiable at any time via the Data Bureau (Singapore) registry at databureau.com.sg/registry. Any business, counterparty, or procurement officer may enter a Certificate ID to confirm its authenticity and current status.
The assessment areas below follow the CSP-18 standard framework used by Data Bureau (Singapore). They are presented in neutral, high-level terms and do not constitute an exhaustive disclosure of all evaluative factors.
The assessment areas below are illustrative. An entity may satisfy every published area and still not receive certification where proprietary assessment factors indicate material risk. Published areas are a necessary but not sufficient condition for certification.
Assessment Area 1
Assessment Area 2
Assessment Area 3
Assessment Area 4
Assessment Area 5
Assessment Area 6
Applications are submitted directly to Data Bureau (Singapore). Assessment is conducted remotely. No physical site visit is required.
The applicant submits the CSP-18 application form via the designated submission channel, confirming ACRA CSP registration status. The application fee is settled at submission.
The applicant submits the full evidence package covering all six assessment domains. Incomplete submissions are returned within five working days with a written specification of outstanding items.
Data Bureau's assessing panel reviews the four mandatory domains first. Where any mandatory domain does not meet its individual threshold, the applicant is notified and the assessment is closed. The applicant may reapply after a minimum remediation period of 90 days.
Where all mandatory domains are satisfied, the panel assesses the remaining domains. A clarification interview by video conference may be requested to resolve evidentiary ambiguities.
A confidential assessment report is issued to the applicant specifying domain-level findings and, where applicable, remediation requirements. The report is issued within 15 working days of evidence package acceptance.
Upon a certified outcome, the CSP-18 certificate is issued in digital format. The firm's name and certification status are recorded in the Data Bureau public registry.
Certificate holders are subject to the Data Bureau (Singapore) Renewal, Revocation & Programme Conduct Policy (DB-POL-001), which governs ongoing compliance obligations, annual renewal requirements, revocation grounds, and the appeals process.
Recertification is required at 12-month intervals. Material changes to the firm's structure, ownership, or regulatory status must be notified to Data Bureau within 21 days of the change occurring.
The full policy is published separately and is available online.