Your provider filed late. The duty was never theirs to carry.

Your provider missed a CPF deadline, or filed AIS late, and the first instinct is to treat it as their mistake to fix. It is their mistake to fix commercially. It is not their mistake as far as CPF Board or IRAS are concerned, because neither regulator was ever dealing with the vendor in the first place. They were dealing with you.

That distinction is the whole answer to the question in the headline. Outsourcing payroll moves the work: the calculations, the submission, the reconciliation. It does not move the statutory duty behind that work. CPF Board’s own guidance is direct about this: contribution obligations “remain the employer’s responsibility” whatever arrangement is in place to process them, and that is not eligible for reimbursement from the regulator’s side. The same logic runs through the Income Tax Act on the filing side. A company that hands payroll to a vendor has changed who does the job. It has not changed whose name is on the obligation.

Why can a vendor never be the liable party?

Because the statute was never written to reach them. CPF contributions are a duty the CPF Act places on the employer, and CPF Board’s compliance guidance is explicit that a third party processing payroll does not step into that duty. The same is true on the tax side: the employer, not whoever prepared the filing, is the party the Income Tax Act names in connection with reporting employment income and meeting the Auto-Inclusion Scheme deadline.

A payroll vendor is, in the regulator’s eyes, simply not a party to the obligation at all. It has no registered relationship with CPF Board or IRAS as the entity responsible for your staff’s contributions. It is your appointed processor, operating under a private contract with you. When something goes wrong, CPF Board and IRAS have exactly one relationship to act against: yours. This is worth saying plainly because it runs against the intuition most finance leaders bring to outsourcing. In almost every other function, from IT support to facilities, the vendor absorbs consequences for its own failures. Statutory payroll duties are a genuine exception, and treating them like an ordinary vendor relationship is the mistake this whole question is really about.

It is not a one-off oddity, either. The same structure turns up in data protection: under the PDPA, an organisation that hands personal data to a third party to process on its behalf remains responsible for what that third party does with it. The data intermediary does the work; the engaging organisation still answers for it. Once you notice the pattern, it stops looking like a payroll-specific quirk and starts looking like how Singapore’s regulators generally treat outsourced compliance work: the duty stays anchored to the party the law names, and appointing someone else to do the task does not reassign the name on the obligation.

What does an indemnity or accountability clause actually do?

It reallocates cost, not duty. A well-drafted service contract can require your provider to cover the interest, penalty or damage caused by its own error: an indemnity clause, a service-level credit, a right to invoice the vendor for a documented mistake. That is a legitimate and useful thing to negotiate, and it is worth having in writing before you sign, not after the first missed deadline.

What it cannot do is stand between you and the regulator. CPF Board does not read your service contract before deciding who to pursue for late interest. IRAS does not check whether your AIS delay was your vendor’s fault before applying section 94(1) of the Income Tax Act 1947 to a late or incorrect filing. The contract clause settles who eventually pays, between you and the vendor, after the regulator has already acted against you. It is downstream compensation, not upstream protection. Employers who confuse the two tend to discover the difference at the worst possible moment: when a fine has already landed and the “our provider handles that” explanation carries no weight with the regulator asking for payment.

There is also a practical limit worth naming honestly. Even a generous indemnity clause is only as good as the vendor’s ability to actually pay out on it, and most service agreements cap liability at a multiple of fees paid, which can be a modest sum next to a director’s personal exposure or a run of interest across a whole payroll. An indemnity clause is real protection for the ordinary case, a missed deadline, an input error, and it is worth negotiating properly rather than accepting boilerplate. It is not a substitute for choosing a provider whose process makes the mistake unlikely to happen at all.

What does this actually cost if it goes wrong?

On the CPF side, the mechanism is interest, not a flat fine, and it starts sooner than most people assume. Contributions are due on the last day of the calendar month. Interest of 1.5% a month, with a minimum of S$5, runs from the day after that due date, not from the enforcement date of the 14th of the following month. CPF Board’s own worked example makes the arithmetic concrete: a S$3,000 contribution paid 19 days late comes to S$3,000 x 1.5% x 19/30, which is S$28.50, rounded down to S$28. Small and slow rather than dramatic, until it compounds across a workforce and a run of missed months, or the amount involved is a full payroll rather than one example.

On the tax side, AIS is the sharper exposure. Once an employer has five or more employees, annual filing through IRAS’s Auto-Inclusion Scheme is compulsory, due by 1 March. Late or incorrect filing is an offence carrying a fine of up to S$5,000 under section 94(1) of the Income Tax Act 1947. If the employer goes further and ignores IRAS’s own notice to file, the exposure becomes personal: directors, precedent partners or key management personnel can face up to S$10,000 and up to 12 months’ imprisonment. Read our breakdown of what CPF late payment actually costs and the full AIS enrolment cycle for the fuller ladder of penalties on each side.

None of this is theoretical enforcement that sits unused. IRAS reported that over 900 employers were prosecuted for AIS non-compliance for Year of Assessment 2023 alone, with penalties exceeding S$1 million in total. That is a regulator that actually pursues employers over this, not one whose deadlines exist mostly on paper.

Does this mean outsourcing payroll is a bad idea?

No, and it would be a strange conclusion to draw from a fact that applies whether you outsource or not. The same duty sits on your business if you run payroll entirely in-house, with no vendor to point to at all. What changes with outsourcing is not whether you carry the liability. It is whether the process behind it is reliable enough that the liability stays theoretical.

That reframes what outsourcing is actually worth to you. It is not a way to hand off statutory exposure, because it cannot do that. It is a way to reduce the odds of a mistake happening at all, provided the provider you choose runs a process that is genuinely disciplined about deadlines, accurate about calculations, and transparent about what it actually submitted and when. A cheap provider that occasionally misses a deadline is not a bargain once you account for the fact that any resulting interest, penalty or director exposure lands on you regardless of what your contract with them says.

So what should actually change in how you pick a provider?

Given that the duty cannot move, the questions worth asking before you sign shift away from price alone and towards accountability and evidence.

Ask how the provider confirms a submission was actually accepted, not just processed on their end; a filing that left their system is not the same as one CPF Board or IRAS has acknowledged. Ask what their contract says happens if their own error causes a late payment: whether there is a real indemnity or service credit, or just an apology. Ask whether you will see the actual CPF and AIS confirmations yourself, rather than a summary report you have to trust at face value. And check their turnaround commitment against the regulator’s real deadline, with an actual buffer, not a schedule that only works if nothing ever slips on their side either.

None of that transfers your liability. It reduces the number of times you will ever need to think about it. Our payroll processing team builds submission confirmation and deadline discipline into the process for exactly this reason, and if you are still weighing providers against each other, our guide on how to choose a payroll provider covers the fuller list of questions worth asking before you commit.