Third-party due diligence in Singapore should answer a simple business question: do you have enough reliable information to decide whether a customer, supplier, distributor, partner or other external party is safe to work with? A sensible process helps you check ownership, reputation, financial and legal concerns, sanctions exposure, conflicts of interest and other risks in proportion to the relationship.
For your business, this matters before you sign a contract and throughout the relationship. You can inherit financial, regulatory and reputational problems through the organisations and individuals you choose to work with.
What does third-party due diligence cover?
Third-party due diligence is the process you use to check an external organisation or individual before entering into, continuing or expanding a commercial relationship.
The checks you carry out should depend on the risk involved. Appointing a small local office supplier presents a different level of exposure from giving an overseas distributor authority to represent your brand, handle customer information or make payments on your behalf.
A typical review may consider:
- Corporate registration and current business status
- Directors, shareholders and beneficial ownership
- Sanctions and watchlist exposure
- Adverse media and reputational concerns
- Litigation and other relevant public records
- Financial standing
- Regulatory history
- Political exposure where relevant
- Potential conflicts of interest
- Links between individuals, companies and associated entities
RMI’s research solutions cover KYC and KYV checks, due diligence, reputational risk research and business intelligence for individuals and organisations. These checks can give you independent information to support commercial decisions.
Start by establishing who you are dealing with
A company name and registration number tell you surprisingly little on their own.
Before you assess risk, confirm the legal entity involved. Check its registration, trading status, registered address and directors. Where relevant, establish who ultimately owns or controls it.
This becomes especially important when ownership passes through several companies or jurisdictions. A supplier may appear straightforward at first, while further research identifies another business or individual with a material connection to the relationship.
Your first task is to establish a reliable picture of the party before you draw conclusions about its risk.
Check the people behind the company
Your corporate checks should usually extend to relevant individuals.
Directors, shareholders, beneficial owners and senior decision-makers may create risks that are absent from the company’s basic registration records. Previous directorships, failed businesses, litigation, regulatory action or adverse reporting may all deserve further examination.
The level of research should reflect the person’s influence over the proposed relationship. A beneficial owner who controls a significant part of a prospective business partner deserves closer attention than an individual with a minor, passive holding.
Where individuals are central to your decision, RMI’s screening services can also help you verify areas such as identity, directorships, financial health and reputational concerns.
Look beyond database results
One common weakness in third-party due diligence in Singapore is treating a database search as the entire investigation.
Automated screening can help you identify possible matches against sanctions lists, politically exposed person records and adverse information. A name match still needs interpretation.
Consider a common problem. A database identifies an individual with the same name as the director of a prospective supplier. The record refers to financial misconduct overseas. Before you escalate the finding, you need to determine whether the records actually relate to the same person.
Dates of birth, nationality, employment, addresses, corporate connections and other identifiers may establish that the match is irrelevant. In other cases, further research may strengthen the connection.
What matters is whether you can establish what the information means for your decision.
Assess corruption and reputational risk
Singapore’s Prevention of Corruption Act applies to corruption involving both the public and private sectors. CPIB also advises businesses to maintain clear internal processes and controls to reduce corruption risks.
Third parties deserve particular attention because intermediaries can create exposure outside your direct operations.
For example, you may want to apply extra scrutiny where an agent:
- Interacts with government officials on your behalf
- Requests unusually high commissions
- Uses unexplained subcontractors
- Requests payment to an unrelated entity
- Operates in a higher-risk jurisdiction
- Has unclear ownership or commercial history
None of these factors automatically proves misconduct. They give you a reason to ask further questions and obtain stronger evidence before you proceed.
RMI’s research services include reputational risk assessments and business intelligence designed to help you identify relevant concerns involving third-party individuals and organisations.
Handle personal information properly
Your due diligence process may involve personal data, particularly when you are researching directors, beneficial owners and other individuals.
Singapore’s Personal Data Protection Act sets requirements around the collection, use, disclosure and care of personal data. If you obtain personal information from third-party sources, you should also consider whether that information can validly be disclosed and used.
That means you should not collect information simply because it is available somewhere.
You should consider why a particular piece of information is required, where it came from, how reliable it is and how you will handle it. Your due diligence provider should also be able to explain its research methods and sources.
Apply more scrutiny when the risk increases
An effective programme does not require you to subject every third party to exactly the same investigation.
Start with a basic risk assessment. Consider factors such as jurisdiction, industry, contract value, access to sensitive information, interaction with officials, payment authority and how closely the third party will represent your company.
Low-risk suppliers may need relatively straightforward verification. Higher-risk distributors, joint-venture partners or intermediaries may justify deeper corporate, reputational and financial research.
This risk-based approach helps you keep third-party due diligence in Singapore proportionate while directing attention towards relationships where a failure would have greater consequences.
Record the reasoning behind your decision
A due diligence report should help you make a decision rather than disappear into a filing system.
Record what you checked, which sources you used, what concerns you found, how you assessed those concerns and who approved the outcome.
A red flag does not always require rejection. A historic dispute may have a reasonable explanation. A complex ownership structure may be legitimate. An adverse article may contain inaccurate or outdated information.
What matters is that you examine material findings and document your reasoning.
If you already use employment checks alongside commercial due diligence, RMI’s guide to background screening explains how verification, source checking and risk assessment can support better decisions across your organisation.
Due diligence should continue after onboarding
Risk changes.
A company may change ownership, appoint new directors, face regulatory action or become associated with adverse reporting months after onboarding. A third party that passed your checks three years ago should not automatically be assumed to present the same risk today.
Set review periods according to risk. Higher-risk relationships may justify regular screening as well as event-driven reviews following ownership changes, allegations, regulatory developments or unusual commercial activity.
Good third-party due diligence in Singapore is therefore an ongoing control within your wider risk process.
RMI’s research team can support you with KYC and KYV checks, due diligence reports, reputational risk research and business intelligence across local and international relationships. Independent research can give you a clearer basis for deciding whether to proceed, investigate further, impose additional controls or end a relationship.