Internal Investigations in Singapore: What a Company Should Do When It Suspects Fraud, Diverted Business or Bribery (2026)
If a company in Singapore suspects that a director, shareholder or employee is misappropriating money, diverting business or paying bribes, it should act quickly but carefully: secure the evidence, involve lawyers early so the investigation is protected by legal privilege, avoid alerting the suspect too soon, and then decide whether to report to the authorities and how to recover its losses. Mistakes in the first few days, such as confronting the suspect or deleting data, often cost more than the fraud itself.
This guide is written for business owners, directors and boards. It explains the warning signs, the first steps to take, how to run an internal investigation, the company’s reporting obligations, and the legal tools available to freeze assets and recover money in Singapore.
Key Takeaways :
Act quickly, but avoid confronting the suspect too early. Secure company records, communications, devices, financial information and system access before alerting anyone under investigation.
Involve lawyers at an early stage. Structuring the investigation through legal counsel may help protect confidential communications and investigation materials through legal privilege.
Preserve evidence carefully. Companies should secure emails, messages, accounting records, bank statements, contracts, access logs, CCTV and other relevant documents while maintaining proper records of how the evidence was obtained.
Conduct the investigation fairly and systematically. Define the scope, appoint an independent investigation team, analyse the financial trail, interview witnesses and give the person under investigation a fair opportunity to respond.
Consider whether the matter must be reported. Depending on the circumstances, suspected bribery, fraud, money laundering or proceeds of crime may involve reporting to authorities such as CPIB, the Singapore Police Force or STRO.
Urgent court remedies may help protect assets and evidence. Singapore courts may grant freezing injunctions, proprietary injunctions, search orders and disclosure orders where the circumstances justify them.
Directors can be personally accountable for diverted business or misuse of company assets. Companies may pursue claims for breach of fiduciary duty, recover losses or profits and seek injunctions against continuing misconduct.
Employee investigations must still follow a fair process. Evidence should be secured before disciplinary action, and employees should be informed of the allegations and given a reasonable opportunity to respond.
Prevention is often more effective than recovery. Dual payment approvals, vendor checks, conflict declarations, whistleblowing channels, anti-bribery policies and regular audits can significantly reduce the risk of internal fraud.
Quick answers
Question | Short answer |
What should I do first if I suspect fraud? | Secure documents and devices, restrict the suspect’s access quietly, and speak to a lawyer before confronting anyone. |
Should I confront the suspect immediately? | Usually not. Early confrontation can lead to deleted evidence and moved assets. |
Will the investigation report be confidential? | It can be protected by legal privilege if it is commissioned through lawyers for legal advice or anticipated litigation. |
Do I need consent under the PDPA to review staff emails? | Generally not, if the review is necessary for an investigation, though you should limit it to what is needed. |
Must the company report bribery or fraud? | Sometimes. There are legal reporting duties in certain cases, and reporting to CPIB or the police is often in the company’s interest. |
Can the company freeze the wrongdoer’s assets? | Yes. The court can grant a freezing (Mareva) injunction where there is a real risk of dissipation. |
Can we sue a director for diverting business? | Yes. Directors owe fiduciary duties and can be ordered to repay losses or hand over profits. |
What are the warning signs of fraud, diverted business or bribery?
Most internal fraud is discovered through a tip-off, an audit query or an unexplained change in the numbers. Common red flags include:
Type of wrongdoing | Warning signs |
Misappropriation of money | Unexplained payments to new vendors; invoices just below approval limits; missing receipts; personal expenses charged to the company; one person controlling both payments and bank reconciliations |
Diverting business opportunities | Falling sales from long-standing customers; a director or employee linked to a new competing company; customers being told to pay a different entity; confidential pricing or client lists sent to personal email |
Bribery and corruption | Unusual “consultancy” or “commission” payments; suppliers chosen without competitive quotes; gifts or entertainment for procurement staff; cash payments or payments to offshore accounts |
Concealment | Reluctance to take leave or share duties; missing or altered records; resistance to audits; lifestyle out of line with salary |
No single sign proves wrongdoing. The aim at this stage is to recognise a pattern that justifies a proper investigation.
What should a company do in the first 48 hours after discovering suspected fraud?
The first two days often decide whether evidence and money can be recovered.
Do:
- Speak to a lawyer immediately, so that the investigation is set up under legal privilege from the start.
- Limit who knows. Form a small team, usually a non-conflicted director, the lawyer and, where needed, a forensic accountant.
- Preserve evidence. Take forensic copies of laptops, phones and email accounts that belong to the company; secure paper records, bank statements and access logs; suspend automatic deletion of emails and chat messages.
- Protect the company’s money and data. Quietly change bank signatories and payment approvals, and restrict system access, where this can be done without alerting the suspect too early.
- Record what you know, including when and how the concern arose and who raised it.
Don’t:
- confront or interview the suspect before the evidence is secured
- search personal devices or private accounts without legal advice
- discuss the suspicion widely, by email or in group chats
- make public statements or accusations, which can expose the company to a defamation claim
- tell the suspect that a report has been or will be made to the authorities, which can amount to tipping-off
How do you conduct an internal investigation in Singapore?
A well-run investigation follows a clear sequence. It should be fair to the person under suspicion, defensible if challenged in court, and focused on the facts the company needs to decide what to do next. In smaller companies, where the suspect may be a co-founder or a 50% shareholder, it can be hard to find a neutral decision-maker. In these cases, early legal advice on how to make decisions validly under the company’s constitution is especially important.
- Set the scope. Agree in writing what is being investigated, the period covered, and who is in charge. Where a director is implicated, that director should be excluded from overseeing the investigation.
- Appoint the team through lawyers. External lawyers should engage any forensic accountants or IT specialists, so that their work is covered by privilege.
- Collect and preserve documents. Accounting records, bank statements, invoices, contracts, emails, chat messages, access logs and CCTV. Keep a record of how each item was collected.
- Analyse the money trail. Trace payments, compare vendors against employee and director details, and check company registry records for links to competing businesses.
- Interview witnesses, starting with those who are not suspected. Keep notes, and tell interviewees that the investigation is confidential.
- Interview the suspect last, once the evidence is secure. Put the key allegations and documents to them and give them a fair chance to respond.
- Report the findings. The lawyers prepare a report for the board or a committee of non-conflicted directors, with recommendations on discipline, reporting and recovery.
- Decide and act. The board decides on next steps: disciplinary action, reporting to the authorities, civil proceedings, or a combination.
Is an internal investigation confidential? Privilege, the PDPA and employee rights
Legal privilege. Singapore law recognises two forms of privilege that can protect an investigation:
- Legal advice privilege covers confidential communications between the company and its lawyers for the purpose of giving legal advice.
- Litigation privilege covers documents created for the dominant purpose of litigation that is reasonably anticipated. The Court of Appeal applied this test in Skandinaviska Enskilda Banken AB (Publ) v Asia Pacific Breweries (Singapore) Pte Ltd [2007] 2 SLR(R) 367, a case arising from a major internal fraud.
In practice, the company should instruct lawyers at the outset, have the lawyers engage forensic experts, mark documents as privileged and confidential, and limit circulation of drafts. An investigation run entirely by management or auditors, without lawyers, may have to be disclosed to the other side in later proceedings. Privilege does not protect communications made to further a crime or fraud.
Personal data (PDPA). The Personal Data Protection Act 2012 allows organisations to collect, use and disclose personal data without consent where this is necessary for an investigation or proceedings. The exception is limited to what is necessary, and in Piper v Singapore Kindness Movement [2025] SGHC 173 the High Court emphasised that this is judged objectively. Review company email, devices and systems in a targeted way, and get advice before accessing personal devices or private accounts.
Employee rights. Employees under investigation are entitled to a fair process. Under the Employment Act, an employee can be suspended during an inquiry for up to 1 week on at least half pay, longer only with the Commissioner for Labour’s approval. Interview notes and the final decision should show that the employee was told the allegations and given a fair chance to respond.
Does a company have to report fraud or bribery to the authorities?
In some cases, yes; in others, reporting is optional but often wise. The main routes are:
Wrongdoing | Where to report |
Bribery and corruption, in the public or private sector | Corrupt Practices Investigation Bureau (CPIB), which enforces the Prevention of Corruption Act |
Criminal breach of trust, cheating, forgery and other fraud | Singapore Police Force; larger or complex cases are handled by the Commercial Affairs Department |
Suspected proceeds of crime or money laundering | Suspicious Transaction Reporting Office (STRO), by filing a suspicious transaction report |
Legal duties to report. Three duties are most relevant to companies:
- Suspicious transaction reports. Under section 45 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992, a person who, in the course of their business or employment, knows or has reasonable grounds to suspect that property is connected to crime must report it to STRO. Failing to report is an offence.
- Tipping-off. Once a report has been made or an investigation is under way, it is an offence to disclose information likely to prejudice it, including warning the suspect.
- Certain serious offences. Section 424 of the Criminal Procedure Code 2010 requires anyone aware of the commission of certain listed offences to report them to the police, unless they have a reasonable excuse. Whether this applies depends on the specific offence.
Separately, a company’s auditors must report to the authorities if they believe a serious offence involving fraud or dishonesty has been committed against the company by its officers or employees.
Why reporting can help the company. A prompt report shows the board acted responsibly, can support later civil claims, and may help recovery through criminal restitution or confiscation. If the company itself may be exposed, for example because an employee paid bribes to win business for it, voluntary disclosure and cooperation can be mitigating factors. Singapore also allows deferred prosecution agreements for companies. Because the company’s own exposure must be assessed first, the timing and content of any report should be decided with legal advice.
How can a company recover misappropriated money in Singapore?
The Singapore courts offer strong tools to stop further loss and trace and recover money, often before the wrongdoer knows a claim is coming.
Urgent court orders
Order | What it does | When it is used |
Freezing (Mareva) injunction | Stops the wrongdoer from dealing with their assets up to the value of the claim; can extend to assets overseas | Where there is a real risk that assets will be moved or spent |
Proprietary injunction | Preserves specific money or property that belongs to the company, and anything bought with it | Where the company can trace its own money |
Search order | Allows the company’s lawyers to enter premises and seize evidence | Where there is a real risk that evidence will be destroyed |
Disclosure orders against banks and third parties | Requires banks or others to reveal where money went or who is involved | To trace payments and identify recipients |
Injunction against competing business | Stops a former director or employee from using confidential information or soliciting customers | Where business is being diverted |
These applications are usually made urgently, sometimes without notice to the other side, and require full and frank disclosure by the company.
Civil claims. Depending on the facts, the company may sue for:
- breach of fiduciary duty by a director or senior employee, including an account of profits made from diverted business
- breach of contract, including confidentiality and non-compete terms
- knowing receipt or dishonest assistance, against third parties who received the money or helped the wrongdoer
- conspiracy, where several people acted together to harm the company
- recovery of bribes and secret commissions, which belong to the company
Time limits. Most claims must be brought within 6 years, but limitation periods for fraud can run from when the fraud was discovered, and some claims for fraudulent breach of trust are not time-barred at all. Even so, delay makes tracing harder, so act promptly.
What can you do if a director or shareholder is stealing from the company or diverting business?
Directors owe the company strict duties. Under section 157 of the Companies Act 1967, a director must act honestly and use reasonable diligence, and must not misuse their position or company information for personal gain. Directors also owe fiduciary duties at common law: to act in the company’s best interests, to avoid conflicts of interest, and not to make secret profits. Section 156 requires a director to declare any interest in a transaction with the company.
A director who takes company money, steers customers to their own business, or takes a bribe from a supplier is likely to be in breach of these duties. The company can then:
- sue the director for the loss caused, or for the profits they made
- seek urgent injunctions to stop the diversion and freeze assets
- remove the director. In a public company, shareholders can remove a director by ordinary resolution under section 152. In a private company, removal depends on the constitution, which often allows the same.
- report to the authorities, including CPIB or the police
When the wrongdoer controls the company. A shareholders’ agreement with clear reserved matters, information rights and exit terms makes all of this easier to enforce. Problems arise when the wrongdoing director also controls the board or is a major shareholder, so the company will not sue. Minority shareholders then have two main options:
- Statutory derivative action (section 216A). A shareholder can ask the court for permission to sue in the company’s name. The shareholder must give the directors notice, act in good faith, and show that the claim appears to be in the company’s interests.
- Oppression claim (section 216). A shareholder can claim that the company’s affairs are being run oppressively or in a way that unfairly disregards their interests. The court has wide powers, including ordering a buy-out of the shareholder’s shares.
What should you do if an employee is suspected of fraud or taking bribes?
With employees, the company has to balance two goals: stopping the harm quickly, and following a fair process so that any dismissal cannot be challenged as wrongful.
- Secure evidence and restrict access before the employee is told.
- Suspend if necessary. Under the Employment Act, suspension during an inquiry is limited to 1 week on at least half pay, unless the Commissioner for Labour approves a longer period.
- Hold a due inquiry. Give the employee the allegations in writing, a fair chance to respond, and an unbiased decision-maker.
- Decide on the outcome. If misconduct is proven, the company may dismiss without notice. Keep the inquiry minutes and a written decision.
- Recover losses. The company can claim the money taken, deduct amounts only where the law allows, and pursue the employee and anyone who helped them in the civil courts.
- Protect business relationships. Contact affected customers or suppliers carefully, sticking to facts, to avoid defamation.
A dismissal for fraud that skips the due inquiry can lead to a wrongful dismissal claim, even where the fraud was real. For more on this, see our employer’s guide to wrongful dismissal.
How can a company prevent fraud and bribery?
Prevention is cheaper than recovery. Controls that make the biggest difference for Singapore SMEs and family businesses include:
- Dual approval for payments above a set amount, and separation of the people who approve, pay and reconcile.
- Vendor checks, including ACRA searches to spot links between suppliers and staff or directors.
- A written anti-bribery policy, with clear rules on gifts, entertainment and commissions, and annual staff confirmation.
- A whistleblowing channel that allows confidential reports, with protection against retaliation.
- Conflict-of-interest declarations from directors and key staff, updated annually.
- Contracts with protective terms: confidentiality, non-solicitation and, where reasonable, non-compete clauses for senior staff.
- A shareholders’ agreement for companies with more than one owner, with information rights and clear procedures for removing a director.
- Regular audits, including surprise checks on high-risk areas such as procurement and cash.
- Insurance. Fidelity or crime insurance and directors’ and officers’ cover can offset losses and legal costs; check notification requirements as soon as fraud is suspected.
How Netto & Magin helps companies investigate and recover losses
Netto & Magin LLC is a Singapore law firm advising companies, boards and shareholders on internal investigations, fraud and commercial disputes. Early advice protects privilege, preserves evidence and keeps recovery options open.
We can help you:
- plan and run a privileged internal investigation, working with forensic accountants and IT specialists
- apply urgently for freezing injunctions, search orders and disclosure orders against banks and third parties
- bring claims against directors, employees and third parties for breach of duty, fraud and conspiracy
- advise on reporting to CPIB, the police or STRO, and on the company’s own exposure
- act for minority shareholders in derivative actions and oppression claims
- conduct employee disciplinary inquiries and terminations
- put in place anti-bribery, whistleblowing and conflict-of-interest policies
To speak to our litigation team in confidence, call +65 6338 3020, WhatsApp +65 9852 5856, or contact us.
This article provides general information on Singapore law as at October 2026 and is not legal advice. Every case depends on its own facts. Please contact us for advice on your situation.
Frequently Asked Questions
Secure the company’s records and bank access, avoid confronting your partner, and speak to a lawyer. Depending on the evidence, the company can freeze assets, sue for breach of directors’ duties, remove the director, and report to the police.
Yes. A director who diverts customers or opportunities breaches their fiduciary duties and section 157 of the Companies Act. The company can claim its losses or the profits the director made, and seek an injunction to stop the diversion.
Not always, but there are legal duties to report in some cases, including suspicious transaction reports under the CDSA. Reporting to CPIB is often in the company’s interest, but the company’s own exposure should be assessed first with legal advice.
Generally yes. The PDPA allows personal data to be collected and used without consent where necessary for an investigation. Keep the review targeted, and get advice before accessing personal devices or private accounts.
Not if it is protected by legal privilege. Reports prepared through lawyers for legal advice, or for the dominant purpose of anticipated litigation, are generally privileged.
Yes. The court can grant a freezing (Mareva) injunction, including over overseas assets, where there is a real risk that assets will be dissipated. Applications are usually made urgently and without notice.
The shareholder can apply for permission to bring a derivative action in the company’s name under section 216A of the Companies Act, or bring an oppression claim under section 216.
Most claims must be brought within 6 years, but time may run from when the fraud was discovered, and some fraudulent breach of trust claims have no time limit. Acting quickly gives the best chance of tracing the money.
Netto & Magin LLC
Netto & Magin LLC is a boutique law firm in Singapore, boasting over 50 years of proven experience. Our specialized expertise covers Family Law, Corporate Law, Employment Law, Fraud Law, and Commercial and Civil Litigation. With a dedicated team of industry-leading experts located strategically in Singapore's central business district, we stand ready to serve as your trusted legal partner.
Contact us for a free consultation.
