Compliance alone is “not enough”, says Singapore watchdog