Singapore’s response came the same day. The Monetary Authority of Singapore committed to widening COSMIC, its cross-bank information-sharing platform. The expansion will cover a broader set of cases and bring in banks beyond its original six. What MAS did not say was when, or which banks.

That single commitment is the clearest live test yet of an idea most banks still treat as theoretical. Financial crime risk, it implies, should be assessed at the level of the network, not the jurisdiction.

What COSMIC Actually Does

MAS launched COSMIC on 1 April 2024 with six major banks: DBS, OCBC, UOB, Citibank, HSBC and Standard Chartered Bank. Participation is voluntary.

The mechanism is simple: a bank flags a customer showing multiple red flags to other member banks. That closes a blind spot no single institution can see alone: a customer unremarkable in one bank’s data but moving money across several.

Loo Siew Yee is MAS’s Assistant Managing Director for Policy, Payments and Financial Crime. At launch, she said the platform would “enable FIs to warn each other of suspicious activities.” That, she added, would support faster, better-informed risk assessments across the industry.

Coverage has so far been narrow by design: three risk categories, misuse of legal persons, misuse of trade finance and proliferation financing, and six banks. Scam-network typologies are not among them yet.

Why FATF Forced the Issue

FATF’s review found Singapore’s AML regime capable and well-coordinated, willing to try new solutions ahead of its regional peers. But it drew a clear line under one shortfall. Results were not yet sharp or consistent enough to prove the system’s effectiveness, not just its design.

That finding has a concrete backdrop. In July 2025, MAS imposed S$27.45 million in penalties on nine financial institutions tied to the S$3 billion money-laundering case uncovered in 2023 – the second-largest AML enforcement action in Singapore’s history.

It is exactly the kind of case FATF’s evaluators would weigh when judging whether risk-based outcomes are demonstrable and consistent, not just well-designed on paper.

Widening COSMIC is Singapore’s direct answer to that specific finding. It is not a broader package of reform, but a targeted move to close the exact gap FATF identified.

The Gap Between Commitment and Execution

What MAS has not specified matters more, for planning purposes, than what it has. No published timeline. No named banks beyond the original six. No confirmation that expanded participation will stay voluntary.

A platform’s value is a function of its coverage, and an incomplete roster is a real constraint, not a footnote.

The Limit Even a Working Model Has

COSMIC also carries a structural limit that becomes more consequential the more it succeeds: it is a domestic tool. It closes blind spots between banks operating inside Singapore.

It does nothing for the blind spot between Singapore and the other jurisdictions the same criminal network moves through. That gap is the argument at the centre of the companion piece, An Organised Crime Economy That Ignores Borders. For any risk officer deciding how much weight to place on a single jurisdiction’s AML upgrade, it is essential reading.

Widening COSMIC strengthens one node in a network built to ignore borders. It does not connect the nodes. For risk committees outside Singapore, the useful question is not whether Singapore’s model is good enough to copy. It is why no equivalent platform exists anywhere else the network operates.

Infographic: What COSMIC Covers and What It Doesn’t

COSMIC currently operates under the Financial Services and Markets (Amendment) Act 2023. That law sets the legal basis for banks to share customer information without breaching confidentiality duties, provided stipulated red-flag thresholds are met.

The three founding risk categories are misuse of legal persons, misuse of trade finance for illicit purposes, and proliferation financing. Scam-network typologies of the kind described in the main piece are not among them.

The six founding banks, DBS, OCBC, UOB, Citibank, HSBC and Standard Chartered Bank, co-developed the platform with MAS and were its first participants. MAS’s 6 May 2026 statement commits to adding “other major banks” without naming them.

Participation remains voluntary. That single fact determines whether COSMIC’s expansion becomes an industry standard or an opt-in exercise.

The post COSMIC’s Expansion: A Working Blueprint for Network-Based AML appeared first on Bizruption Asia.

For compliance teams still running country-wide screening lists, that is a direct instruction to stop. It also lands squarely inside the argument the main piece makes. Risks that move as a network should not be assessed one jurisdiction at a time.

What the Guidance Actually Says

The guidance is built on three principles. Proportionality requires a financial crime programme sized to an institution’s actual footprint, not a generic template.

Prioritisation means directing resources at the highest-risk customers and activities and stopping or redesigning controls that add little value.

Effectiveness means judging a programme by demonstrable outcomes, not by the number of checks completed.

None of this is a first draft. Wolfsberg’s original risk-based approach guidance dates to 2006. This update revises that framework rather than replacing it.

Why Now

The timing is not incidental. FATF’s own reforms to Recommendation 1 push in the same direction, explicitly rejecting what the industry calls a “zero failure” approach to financial crime compliance.

FATF has separately and repeatedly warned against a related failure mode. Terminating business relationships with entire regions or classes of customer, rather than assessing risk individually, is exactly that mistake.

Wolfsberg’s guidance gives banks a practical framework for acting on both pressures at once.

What Changes for a Risk Committee

For a risk committee, the guidance is a mandate to review three specific documents. They are correspondent due diligence questionnaires, country-risk rating models and the criteria used to exit a relationship altogether.

Each should be tested against a single question. Does this control target actual risk, or does it exist because removing it feels harder to defend than keeping it?

A country-risk model that scores every customer in a jurisdiction identically is the kind of blanket control the guidance singles out for redesign. It ignores individual transaction behaviour entirely.

Proportionality means the model should reflect the customer, not just the country on their file.

Where the Discipline Has a Limit

That discipline cuts both ways. Wolfsberg’s own language leaves room for stopping a relationship entirely when it no longer earns its cost. But FATF has been explicit for over a decade that this discretion is not licence for wholesale de-risking.

FATF defines that practice as cutting loose entire countries or classes of customer without individual assessment.

The distinction echoes in the main analysis, An Organised Crime Economy That Ignores Borders. That piece makes the same point about jurisdiction-wide screening.

Treating a category as the unit of risk, instead of the behaviour inside it, is the same mistake. This guidance and that argument was both built to correct it.

The post Wolfsberg’s New Risk-Based Playbook appeared first on Bizruption Asia.