For information and reference only – not to be submitted as your own work.

This model extract shows one way to structure the GSP216 TMA. Use it to understand the approach, then write your own answer in your own words and follow SUSS academic integrity and GenAI rules.

Brief: GSP216 TMA July 2026 question · Full walkthrough: GSP216 TMA compliance function guide

Question 1a: Roles and responsibilities of the Compliance function in ABC Bank (extract)

The Compliance function at ABC Bank exists to identify, assess, advise on, monitor and report on the bank’s compliance risk, which the Basel Committee on Banking Supervision (2005) defines as the risk of legal or regulatory sanctions, financial loss or reputational damage from failing to comply with laws, rules and codes of conduct. Led by the Chief Compliance Officer (CCO), it sits in the second line of the bank’s governance model, with a degree of independence from the business units that own the risk (Institute of Internal Auditors [IIA], 2020).

The digital-growth dilemma tests these roles directly. Rather than acting as a final gate, Compliance can join product squads early (“compliance by design”), so that requirements are built in rather than discovered late.

Some lower-risk controls, such as enhanced dashboards or periodic thematic reviews, may reasonably follow launch as post-implementation controls, provided the residual risk is documented and approved. Controls that protect customers from day one, such as identity verification and fraud safeguards, should never be deferred.

Finally, the CCO should translate requirements into short, plain-language checklists for each business unit. Clear communication shortens review cycles, which answers the business leaders’ concern without lowering regulatory standards.

Question 1b: How DocuSign and SingPass support the Compliance function (extract)

SingPass, Singapore’s national digital identity, supports Compliance mainly at onboarding. Through Myinfo, customers can pre-fill government-verified personal data into bank applications instead of uploading copies of documents, a model first piloted with DBS, OCBC, UOB and Standard Chartered (GovTech, 2017). For ABC Bank this strengthens customer due diligence, reduces document fraud and creates a reliable record of the data source.

DocuSign supports the evidence side of compliance. When combined with Sign with Singpass, signers authenticate in the Singpass app and the signature is linked to a verified identity; DocuSign also records a certificate of completion and audit trail with time stamps (Docusign, n.d.). For loan agreements, wealth-product acknowledgements and consent forms, this gives Compliance tamper-evident proof of who signed what, and when.

Question 1c: Two technology risks and their impact (extract)

Risk of impersonation and fraud

Impersonation fraud occurs when criminals pose as the bank or the customer to take over accounts. In December 2021, 790 OCBC customers lost a total of S$13.7 million after entering log-in details and one-time PINs on phishing sites (OCBC, 2022). For banks, the impact is financial loss, regulatory scrutiny and reputational damage; for customers, it is lost savings and reduced trust in digital banking.

Since 16 December 2024, the Shared Responsibility Framework requires banks to provide measures such as a 12-hour cooling-off period, real-time alerts and a “kill switch”, and a bank that breaches these duties bears the loss (Rajah & Tann Asia, 2024).

Increased vulnerability of customer data to cyberattacks

Digital banking concentrates large volumes of personal and financial data, making it a target for ransomware and data theft. A breach exposes ABC Bank to regulatory action under the MAS Technology Risk Management Guidelines (MAS, 2021) and to penalties under the Personal Data Protection Act, capped at up to 10% of annual Singapore turnover for larger organisations since 1 October 2022 (Allen & Gledhill, 2022). Customers face identity theft and targeted scams using leaked data.

Extract ends here. The full model answer develops each point with further course readings and a short conclusion.

Related resources

• FIN383 financial technologies and innovations sample
• FIN573 financial crime compliance essay brief
• APA citation and referencing check

References

Allen & Gledhill. (2022, March 11). Financial penalty cap for data breaches by organisations under Personal Data Protection Act 2012 to increase from 1 October 2022. https://www.allenandgledhill.com/sg/publication/articles/20284/financial-penalty-cap-for-data-breaches-by-organisations-under-personal-data-protection-act-2012-to-increase-from-1-october-2022

Basel Committee on Banking Supervision. (2005). Compliance and the compliance function in banks. Bank for International Settlements. https://www.bis.org/publ/bcbs113.htm

Docusign. (n.d.). Docusign eSignature and Singpass makes signing simple and secure for Singaporeans. https://www.docusign.com/en-sg/blog/docusign-esignature-and-singpass-makes-signing-simple-and-secure-singaporeans

GovTech. (2017, May 3). Opening bank accounts becomes more seamless and convenient for MyInfo users. https://www.tech.gov.sg/media/opening-bank-accounts-becomes-more-seamless-and-convenient-for-myinfo-users/

Institute of Internal Auditors. (2020). The IIA’s Three Lines Model: An update of the Three Lines of Defense. https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf

Monetary Authority of Singapore. (2021). Technology risk management guidelines (issued 18 January 2021). https://www.mas.gov.sg/regulation/guidelines/technology-risk-management-guidelines

Monetary Authority of Singapore. (2024). Notice 626: Prevention of money laundering and countering the financing of terrorism – Banks (revised 28 March 2024). https://www.mas.gov.sg/regulation/notices/notice-626

OCBC. (2022, January 30). Media statement on phishing scam. https://www.ocbc.com/group/media/release/2022/media-statement-30-jan-phishing-scam

Rajah & Tann Asia. (2024, November 28). MAS and IMDA set out duties and liability of financial institutions and telcos in mitigating digital scams. https://www.rajahtannasia.com/viewpoints/mas-and-imda-set-out-duties-and-liability-of-financial-institutions-and-telcos-in-mitigating-digital-scams/