Ethics, Professionalism, Data Protection & Cyber Hygiene

Insurance intermediaries in Singapore are expected to act with honesty, integrity and fair dealing at all times. Ethical conduct is not merely about following rules — it is about placing the client's legitimate interests ahead of one's own and never exploiting an information advantage.

6 sections~4 min read

Must-know for the exam

The PDPA 2012 is enforced by the Personal Data Protection Commission (PDPC); it sets nine core Data Protection Obligations.
The nine obligations: Consent, Purpose Limitation, Notification, Access & Correction, Accuracy, Protection, Retention Limitation, Transfer Limitation, and Accountability (Openness).
The Accountability Obligation requires organisations to appoint a Data Protection Officer (DPO) and make data protection policies available.
Mandatory data breach notification: notify PDPC of a notifiable breach (significant harm, or 500+ individuals) as soon as practicable, within 3 calendar days of assessing it is notifiable.
The DNC Registry has three registers — No Voice Call, No Text Message, and No Fax Message — for Singapore telephone numbers.
Before marketing to a Singapore number, organisations must check the relevant DNC register unless clear and unambiguous consent is held; a DNC confirmation is valid for 30 days.
CDD requires identifying and verifying the customer and beneficial owner; Enhanced Due Diligence (EDD) applies to Politically Exposed Persons (PEPs) and higher-risk clients.
Suspicious transactions must be reported via an STR to STRO, and 'tipping off' the customer is an offence.
MAS Guidelines on Fair Dealing require suitable products, competent advice, clear information and prompt, independent complaint handling.
Cyber hygiene basics: strong unique passwords, 2FA/MFA, patched software, encrypted files, and vigilance against phishing and OTP disclosure.

Ethics & Professional Conduct

The Guidelines on Fair Dealing issued by the Monetary Authority of Singapore (MAS) set five outcomes: (1) fair dealing is central to corporate culture, (2) products offered are suitable for the target segment, (3) representatives are competent and give quality advice, (4) clients receive clear, relevant information to make informed decisions, and (5) complaints are handled independently and promptly.

Suitability is a cornerstone duty. A recommendation must be based on a proper fact-find (needs analysis) covering the client's financial situation, objectives and risk profile. Recommending a product that is unsuitable — or 'churning' policies to earn fresh commission — is a serious breach.

Conflicts of interest must be avoided or, where unavoidable, disclosed and managed. Intermediaries must disclose that they are earning remuneration/commission, and must not make misleading statements or withhold material information to close a sale.

Codes of Conduct & Regulatory Framework

Financial advisers and their representatives are regulated primarily under the Financial Advisers Act (FAA) and, for insurers, the Insurance Act, both administered by MAS. Representatives providing financial advisory services must be appointed and fit and proper, and must meet minimum entry and continuing education (CPD) requirements.

Industry bodies such as the Life Insurance Association (LIA) and the General Insurance Association (GIA) publish codes of practice governing market conduct, advertising and claims. GIA administers the Agents' Registration Board (ARB) for general insurance agents.

Breaches can lead to warnings, fines, suspension, revocation of appointment, and — for dishonesty offences — criminal prosecution. Twisting (inducing a client to replace a policy through misrepresentation) and rebating (passing part of one's commission to the client as an inducement) are prohibited practices.

Premium

Every note. Every question. One pass.

4 more sections of this note are part of Premium.

Every section of every study note
13,000+ questions across every CMFAS module
Full timed mock exams
A worked explanation on every question
Your full mistake bank and weak-area review

Unlock with Premium

From ≈$14.83/mo on the 6-month pass

Traps that cost marks

MAS regulates insurers and advisers, so candidates wrongly assume it also enforces the PDPA.
The original core count is nine; note that mandatory data breach notification and data portability were added later, so current PDPC materials list more than nine.
It also touches Notification/Consent, but the best fit for using data beyond the original purpose is Purpose Limitation.
Membership of ASEAN or the age of the data is irrelevant; what matters is comparable protection.
Notification is to the individual, not routine notification to the PDPC (which relates to breaches).
The scale threshold is 500, not 50 or 1,000.
The 3-day clock runs from the assessment that the breach is notifiable, not from any complaint.
Good cyber hygiene is how an organisation meets the Protection Obligation.

Ready to test yourself?

Drill exam questions on Ethics, Professionalism, Data Protection & Cyber Hygiene and lock it in, or sit the free CMFAS mock exam with no sign-up.

Practise this topic →

Exam-style questions

Which statement about consent under the PDPA is CORRECT?Answer explained →An insurer wishes to transfer policyholder data to a cloud server located overseas. Under the Transfer Limitation Obligation, this is permitted only ifAnswer explained →Before sending a marketing text message to a Singapore telephone number, an organisation must generallyAnswer explained →An individual who previously gave consent for marketing decides they no longer wish to receive it. Under the PDPA theyAnswer explained →The Accuracy Obligation is MOST clearly engaged whenAnswer explained →

← PreviousReinsurance & Co-Insurance

← All study notes

BCP — Basic Insurance Concepts & Principles