The short answer
- Register every account to a role-based company email (finance@, admin@), never a personal inbox.
- Use a company-owned mobile number for OTPs, held by the finance function, with a named backup.
- Some access cannot be shared by design: Singpass, bank digital tokens and Corppass are personal. Give two people their own access instead.
- Keep a register of every account, its login email, OTP number and the two people who can access it.
The principle
The company owns the account. People get access to it. Every login, OTP and recovery route should point to something the company controls, and at least two people should be able to get in.
- Create role-based addresses on your own domain: finance@, admin@, payroll@, compliance@
- Make them shared mailboxes or aliases that deliver to two people
- Use them for banks, utilities, card issuers, software, ACRA and IRAS notices
- Never register a company account to a personal Gmail or Hotmail
- Turn on two-factor authentication for the email system itself
Phone numbers and OTPs
- Buy a company SIM or business line for OTPs, kept by finance, not a personal phone
- Where an account allows two numbers, add the backup
- Prefer authenticator apps over SMS where the provider offers them
- Note which accounts still send SMS codes to an individual, and plan the handover
What should stay personal, on purpose
| Access | Why personal | How to make it resilient |
|---|---|---|
| Singpass | It is a person's identity | Never shared. Give two people their own Corppass roles |
| Corppass | Built on Singpass | Two Admins, users added per e-service |
| Bank digital tokens and approvals | Tied to authorised signatories | Two signatories, a dual approval matrix, and a maker-checker split |
| Corporate cards | Issued to named cardholders | Card per person, limits per card, cancel on exit |
The access register
One spreadsheet, owned by finance, reviewed every quarter: account, provider, login email, OTP phone or app, the two people with access, last review date. When someone leaves, this is the list you work through on their last day.
Opening utility, bank and card accounts
- Utilities and telcos: usually the simplest. Register with the role email and company phone from the start.
- Banks: signatories and token holders are individuals by design. Plan two from day one.
- Cards and payment platforms: the company account sits with an admin user. Add a second admin before you need one.
The leaver checklist
When someone with access leaves, work through this on their last day, not the week after:
- Remove their Corppass roles and any myTax Portal approver rights.
- Change bank mandates and digital token holders, and confirm the second signatory still works.
- Cancel their company cards and any virtual cards in their name.
- Reassign role mailboxes and remove their access to finance@ and similar addresses.
- Move any accounts still registered to their mobile number to the company phone.
- Update the access register and record the date.
Most of the lock-out cases we see trace back to one missed step here, often months earlier. The cost is rarely money. It is a filing deadline missed because nobody could log in.
Questions people ask
Which email should company accounts be registered to?
A role-based address on your own domain, such as finance@, delivered to at least two people. Never a personal inbox.
How should OTPs be handled?
Use a company-owned phone number held by finance, add a backup number where possible, and prefer authenticator apps over SMS.
Talk it through with an adviser
Tell us your structure and deadlines. We reply with what applies to you and a fixed-fee proposal.
Sources
General information only, last reviewed 11 November 2026. It is not advice for your situation. Laws and practice change, and the official sources linked above prevail. Speak to a qualified adviser before you act.
