The Answer in 60 Seconds

The Singapore SME has just discovered internal fraud, for example by a long-serving finance officer over several years. Discovery can come on departure (resignation or termination), at audit, or from a whistleblower report. The 8-step Day-One workflow: (1) preserve evidence (image laptops, suspend cloud accounts, preserve email archives, do not interrogate the employee yet); (2) secure systems access (change passwords, revoke approvals, suspend bank signatory rights); (3) engage external forensic accountant under privilege via external solicitors; (4) engage legal counsel (criminal counsel for CAD interface, civil counsel for recovery, employment counsel for HR action); (5) report to the Commercial Affairs Department (CAD), as some fidelity wordings require immediate notice to the police; (6) report to insurer within the policy notification window (the wording sets the period, and it can be short: the MSIG SUMO Fidelity Guarantee section requires written notice within seven days); (7) civil recovery (proprietary tracing claim, Mareva injunction, Anton Piller order, Norwich Pharmacal orders against banks); (8) HR action (disciplinary inquiry, termination for cause, final-pay computation). Penal Code 1871 sections 405-409 (criminal breach of trust) and 415-420 (cheating) are the principal charging provisions. Section 408 (CBT by employees) carries up to 15 years imprisonment and fine; section 409 (CBT by director, officer, partner, key executive, or fiduciary) carries up to 20 years and fine - expanded by the Criminal Law Reform Act 2019 effective 1 January 2020, overturning the narrow reading of "agent" in Public Prosecutor v Lam Leng Hung [2018] SGCA 7. Limitation Act 1959 section 29 can postpone the 6-year contract limitation in section 6, where the claim is based on the fraud or the right of action was concealed by fraud, until the fraud is discovered or could with reasonable diligence have been discovered, per SW Trustees Pte Ltd v Tesemma [2023] SGHC 273. Fidelity Guarantee and Commercial Crime trigger architecture covered in the loss-discovered vs loss-sustained comparison; this article focuses on the Day-One operational workflow.

The Sourced Detail

Internal fraud discovery is the most operationally demanding crisis category for Singapore SMEs. The combination of criminal liability for the dishonest employee, civil recovery against the employee personally, insurance claim under Fidelity Guarantee or Commercial Crime cover, director duty-of-diligence exposure under Companies Act 1967 section 157, employment-law action under the Employment Act 1968, and (where the fraud distorted financial statements) restatement and tax exposure under the Income Tax Act 1947 creates a multi-front response requiring coordinated specialist counsel and rapid evidence preservation.

The structural rule: the first 72 hours determine the success of every downstream workflow stream. Lost or contaminated evidence prejudices the criminal prosecution, the civil recovery, and the insurance claim simultaneously.

What just happened

The trigger event is the SME's discovery of internal fraud, for example through one of these four pathways:

Resignation handover discovery. A new hire (or interim cover for a departing employee) identifies anomalies during transition: fictitious vendors in the accounting system, unfamiliar bank accounts in payment files, transactions outside policy authority.

External audit discovery. Year-end audit identifies reconciliation gaps, unexplained variances, or vendor-master irregularities. The auditor may flag a "control deficiency" that prompts internal investigation, or may identify the fraud directly in management letter findings.

Whistleblower report. Internal or external whistleblower (employee, supplier, customer) reports suspected misconduct through formal channels or anonymous tip-off.

Bank reconciliation anomaly. Bank reconciliation identifies unauthorised transfers, unexpected balances, or transactions to unfamiliar payees.

In the pattern this article addresses, the dishonest employee is a long-serving finance officer (CFO, finance manager, accounting head) with system access, banking authority, and the trust required to operate without effective second-pair-of-eyes review.

Penal Code charging provisions

The principal Singapore Penal Code provisions for internal fraud:

Section 24 - "Dishonestly" provides the foundational definition: doing anything with the intention of causing wrongful gain or wrongful loss.

Section 405 - Criminal Breach of Trust defines CBT: "Whoever, being in any manner entrusted with property, or with any dominion over property, dishonestly misappropriates or converts to his own use that property, or dishonestly uses or disposes of that property in violation of any direction of law … or of any legal contract …, commits 'criminal breach of trust'." The offence needs entrustment of, or dominion over, property, and its dishonest misappropriation, conversion, use or disposal in one of the ways section 405 describes. The capacity in which the property was entrusted matters for the heavier punishments in sections 407 to 409.

Section 406 punishes plain CBT with imprisonment up to 7 years, or a fine, or both.

Section 407 punishes CBT of property entrusted for transportation for hire or for storage for rent or charge (for example by a carrier or warehouse operator) with up to 15 years and fine.

Section 408 - CBT by Employees. Up to 15 years and fine. This is the typical charge for finance officers and accounting heads embezzling from their employer.

Section 409 - CBT by Public Servant, Banker, Merchant, Agent, Director, Officer, Partner, Key Executive, or Fiduciary. Up to 20 years and fine. The provision was expanded by the Criminal Law Reform Act 2019 (effective 1 January 2020) to specifically include directors, officers, partners, key executives, and fiduciaries. The expansion was a legislative response to Public Prosecutor v Lam Leng Hung [2018] SGCA 7 (the City Harvest Church case), which had narrowly read "agent" in the legacy section 409.

Section 415 - Cheating. Definition.

Section 416 - Cheating by personation.

Section 416A - Illegally obtained personal information (relevant where fraud involves data exfiltration).

Section 417 - Punishment for cheating: up to 3 years and/or fine.

Section 418 - Cheating with knowledge that wrongful loss may be caused to a person whose interest the offender is bound to protect: enhanced punishment.

Section 419 - Cheating by personation: up to 5 years.

Section 420 - Cheating and Dishonestly Inducing Delivery of Property. Up to 10 years, and liable to a fine or caning or both (caning added from 30 December 2025). This is a frequent charge for invoice-redirection and procurement frauds.

The choice between section 408, section 409, and section 420 depends on the relationship between the dishonest employee and the SME, and on the operational mechanism of the fraud. The Public Prosecutor (through the Attorney-General's Chambers) determines the charge.

Limitation Act fraud postponement

The Limitation Act 1959 section 6 imposes a 6-year limitation for actions founded on contract and tort. Section 29 postpones the limitation period in cases of fraud or mistake: time runs from the date the plaintiff discovered the fraud or could with reasonable diligence have discovered it.

For multi-year embezzlement, the section 6 limitation would otherwise time-bar the earliest portions of the fraud. Section 29 can postpone the limitation period for the SME's claims against the dishonest employee where a claim is based on the employee's fraud, or the employee concealed the right of action by fraud, subject to the reasonable-diligence test (if the SME could with reasonable diligence have discovered the fraud earlier, time runs from then).

The doctrinal architecture for section 29(1)(a) (action based on the defendant's fraud) and section 29(1)(b) (right of action concealed by fraud) was analysed in SW Trustees Pte Ltd (in compulsory liquidation) v Teodros Ashenafi Tesemma [2023] SGHC 273, available on elitigation.sg. The decision confirms that the postponement runs from discovery or reasonable-diligence threshold, and that the burden is on the plaintiff to establish the threshold was not met earlier.

The section 29 protection is the legal foundation that makes civil recovery viable in long-running employee fraud cases. Without section 29, multi-year embezzlement would substantially time-bar the SME's claim.

The 8-step Day-One workflow

Step 1 - Preserve evidence. Image laptops, mobile devices, and any work-from-home equipment. Suspend cloud accounts (Microsoft 365, Google Workspace, accounting platform, banking platform) without deleting (preservation, not termination of access trails). Preserve email archives. Instruct IT to preserve audit logs from all relevant systems. Do not interrogate the employee yet. Premature confrontation alerts the employee to remove evidence or transfer assets out of jurisdictional reach.

Step 2 - Secure systems access. Change passwords on all systems the employee had access to. Revoke approvals in workflow systems. Suspend signatory rights at banks via written notice. Recall corporate credit cards. Suspend procurement-system access. Block remote-access tokens.

Step 3 - Engage external forensic accountant under privilege. Engage through external solicitors to maximise legal privilege over forensic findings. Do not engage the SME's external auditors (independence and conflict-of-interest issues). The forensic accountant's scope: identify the fraud pattern, quantify the loss, identify all affected periods, trace the proceeds, identify any co-conspirators or external facilitators.

Step 4 - Engage legal counsel. Three parallel work streams require specialist counsel:

  • Criminal counsel for CAD interface and any prosecution interaction.
  • Civil counsel for recovery action (proprietary tracing, Mareva injunction, Anton Piller order, Norwich Pharmacal orders).
  • Employment counsel for HR action (disciplinary inquiry, termination, final pay, notice forfeiture).

Step 5 - Report to the Commercial Affairs Department (CAD). The CAD is the specialist commercial-crime unit of the Singapore Police Force. Some fidelity wordings require the police to be told: the MSIG SUMO Fidelity Guarantee section requires the insured, on becoming aware of a loss, to give immediate notice to the Police. CAD investigative powers are exercised under the Criminal Procedure Code 2010 (production orders under section 20) and the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 (CDSA). A formal police report can be filed at any Neighbourhood Police Centre.

Step 6 - Report to insurer. Fidelity Guarantee and Commercial Crime policies set their own trigger and notice period (see how the two policy triggers differ); the MSIG SUMO Fidelity Guarantee section, written on a loss-sustained basis, requires written notice within seven days. Notification too late can prejudice or void the claim.

Step 7 - Civil recovery. Coordinated civil action runs in parallel with the criminal investigation. The principal civil remedies:

  • Proprietary tracing claim where the employee converted SME property.
  • Mareva injunction (worldwide freezing order) to preserve the employee's assets pending judgment.
  • Anton Piller order (search-and-seizure) to preserve documentary evidence at the employee's premises.
  • Norwich Pharmacal orders against banks to obtain account information for tracing.
  • Personal action against the employee under Companies Act section 157 (where employee is also a director or officer) and under general fiduciary-duty principles.

Step 8 - HR action. Disciplinary inquiry under the employment contract and any collective agreement. Termination for cause typically based on serious misconduct findings. Final-pay computation: under the Employment Act 1968, where an employee is dismissed for misconduct, salary owing must be paid on the last day of employment or, if that is not possible, within 3 working days of the dismissal, but where dishonest conduct is established, the SME may have set-off rights against accrued bonus, unused leave, or notice pay. The SME should obtain employment-counsel advice before withholding any final pay.

Director personal exposure

The SME's directors face personal exposure under Companies Act 1967 section 157 for failure to implement reasonable internal controls. The duty-of-diligence claim is typically made via the statutory derivative action under section 216A (a shareholder, with leave of court, brings the action in the company's name against the directors).

Defensive elements:

  • Documented internal control framework (segregation of duties, dual approvals, four-eyes review).
  • Periodic internal-audit review.
  • Whistleblower hotline or equivalent tip-off mechanism.
  • Risk-assessment cycle including fraud-risk consideration.
  • Board oversight of management-letter findings from external audit.

D&O Side A cover typically responds to defence costs in section 157 / section 216A litigation, subject to conduct exclusions (final adjudication of dishonesty by the director typically voids cover).

Tax and financial-statement consequences

Where the fraud distorted financial statements, the SME may need to:

  • Restate prior-period financials if the misstatements are material.
  • Consider IRAS voluntary disclosure if tax filings were affected (voluntary disclosure may attract reduced penalties under the Income Tax Act 1947 framework).
  • Notify the external auditor of the discovered fraud, triggering audit-procedure adjustments under International Standards on Auditing.
  • Update internal control assertions in any required management certifications.

Claim-time worked example

SME Pte Ltd, S$15 million revenue. Finance Manager (tenure 6 years, fiduciary access to bank tokens, sole-signatory authority on operating account up to S$50,000 per transaction) discovered to have diverted S$1.2 million via a fictitious-vendor scheme over 5 years.

Discovery: Day 0, resignation handover audit by the new finance manager. The new hire spots a vendor in the accounting system with no recent invoices, no contracts on file, and a bank account matching the departing employee's personal bank.

Crime policy: S$2 million limit, S$25,000 retention, Discovery basis trigger, 60-day notification window from Discovery, police-report condition precedent, retroactive date 3 years pre-policy.

Day-One actions:

  • Day 0: preserve evidence; suspend cloud accounts; secure systems access.
  • Day 1: engage external forensic accountant via solicitors; engage criminal counsel, civil counsel, employment counsel.
  • Day 2: file police report with CAD; obtain case reference number.
  • Day 3: notify insurer; provide police-report reference; preserve claim notification window.
  • Day 5: HR disciplinary action; termination for cause.

Civil recovery sequence:

  • Week 2: ex parte Mareva injunction against the employee personally, worldwide.
  • Week 2: Norwich Pharmacal orders against the relevant banks for account information.
  • Week 3 to 8: tracing exercise; identification of bank balances, real estate, and other assets.
  • Week 12 to 24: civil action commenced; default judgment if employee does not contest.

Insurance claim sequence:

  • Week 4: insurer accepts the claim within standard handling period.
  • Retroactive date analysis: the earliest part of the fraud, before the retroactive date, accounts for S$300,000 of the total loss. Remaining S$900,000 within retroactive period. Insurer pays S$900,000 less S$25,000 retention.
  • Insurer subrogates to the civil recovery action for the S$875,000 indemnified amount.
  • SME retains the S$300,000 pre-retroactive-period loss; pursues civil recovery for the entire S$1.2 million.

Criminal proceedings: CAD investigation concludes; Public Prosecutor charges the employee under Penal Code section 408 (CBT by employees). Sentence delivered following plea or trial.

Section 157 director analysis: shareholders consider whether to bring a section 216A derivative action against the directors for failure to implement internal controls. The directors' defence: documented control framework (the framework was in place but the employee circumvented it through the long-trusted position); documented audit reviews (none of the prior audit cycles identified the fraud, suggesting the controls were reasonable for the SME's scale); documented response post-discovery (the SME took every reasonable step to recover the loss).

Common Mistakes / What Goes Wrong

  1. Interrogating the employee on Day 1. Premature confrontation alerts the employee to remove evidence or transfer assets out of jurisdiction. The structurally correct sequence is preserve evidence first, then engage counsel, then engage the employee through formal disciplinary process.

  2. Engaging the SME's external auditors for the forensic investigation. Independence and conflict-of-interest issues. Forensic should be a separate firm engaged through external solicitors for privilege.

  3. Delaying the police report and missing the insurance notification window. Fidelity and crime wordings set their own notice period, which can be short (seven days for written notice in the MSIG SUMO Fidelity Guarantee section), and some require immediate notice to the police. Delayed reporting can void the claim.

  4. Failing to preserve evidence properly. Forensic image of devices must be done by qualified forensic technicians (not the SME's IT team) to maintain evidentiary chain of custody. Logs must be preserved before any system-access changes.

  5. Releasing the employee's final pay without legal advice. Set-off rights against accrued bonus, unused leave, and notice pay may be available, but require careful legal analysis under the Employment Act 1968 and the employment contract. Improper withholding can ground a salary claim by the employee.

  6. Underestimating Limitation Act section 29 timing. The 6-year contract limitation can be postponed by section 29 where its conditions are met, but time then runs from when the fraud was discovered or could with reasonable diligence have been discovered. Delay in civil action after Discovery can time-bar parts of the claim.

  7. Missing the Crime policy retroactive date analysis. Multi-year fraud may predate the retroactive date in part. The policy responds only to discovered acts within the retroactive period, subject to the wording's specific architecture. Pre-retroactive-date loss is the SME's exposure.

  8. Not coordinating criminal and civil counsel. Statements made to CAD can be used in civil proceedings and vice versa. Coordinated counsel ensures privilege is maintained and witness statements are consistent.

  9. Failing to notify IRAS if tax filings were affected. Voluntary disclosure under the Income Tax Act 1947 framework may attract reduced penalties. Late discovery by IRAS results in higher exposure.

  10. Treating the matter as a personal HR issue rather than a corporate-governance event. Director duty-of-diligence claims under Companies Act section 157 / section 216A flow from the fraud and the SME's response. Board minuting of the response decisions is the evidentiary backbone.

What This Means for Your Business

For a Singapore SME that has just discovered internal fraud, the 8-step Day-One workflow is the structurally important framework: preserve evidence, secure access, engage forensic and counsel, report to CAD, report to insurer, commence civil recovery, take HR action. The first 72 hours determine the success of every downstream workflow stream.

For an SME without internal fraud, the prevention framework is documented internal controls (segregation of duties, dual approvals, four-eyes review on bank transactions, vendor-master lockdown with periodic review, whistleblower hotline). The Fidelity Guarantee or Commercial Crime cover should be sized against credible cumulative exposure for multi-year fraud, and on Discovery basis with appropriate retroactive date (see worked examples of what it excludes).

For directors, the section 157 duty-of-diligence defence requires documented decision-making on internal-control framework, periodic audit review, and post-discovery response. Board minutes are the evidentiary backbone.

Questions to Ask Your Adviser

  1. Is our Fidelity Guarantee or Commercial Crime cover on Discovery basis, with retroactive date covering our full exposure period?
  2. What is the notification window from Discovery, and is the police-report condition precedent clearly stated?
  3. For long-serving finance staff, is the cover limit sized against credible cumulative multi-year fraud exposure?
  4. Do we have a documented internal-control framework with segregation of duties, dual approvals, and four-eyes bank-transaction review?
  5. Do we have a whistleblower hotline or equivalent tip-off mechanism?
  6. For directors' protection against section 157 / section 216A claims, is our D&O Side A limit adequate for derivative-action defence?
  7. In the event of fraud discovery, do we have pre-identified forensic accountants, criminal counsel, civil counsel, and employment counsel?

Related Information