A Departing Developer Took Our Production Keys With Him — the 7-Step Singapore Offboarding Checklist I Now Run in the 30 Days Before the Last Day

The keys in the title were literal: an SSH key pair and a long-lived cloud access token that a senior backend developer at a Singapore logistics client had generated for himself two years earlier, outside the identity provider, to make a deployment script work. His GitHub and Google Workspace accounts were disabled on his last day, correctly, by an HR checklist. The key and the token were not on the checklist, because nobody knew they existed. He did nothing with them; we found them four months later in an audit, still valid. The same offboarding had also paid his final salary six days late and filed his IR21 two weeks after his last day, which cost the finance team a letter from IRAS. None of that was malice. It was a process that started on the last day instead of the first. The seven steps below are the 30-day version we now run for every developer who resigns from a client in Singapore.

Why Developer Offboarding in Singapore Is a 30-Day Job

Three clocks start when a developer resigns in Singapore, and they run at different speeds. The tax clock is the slowest and the earliest: for a non-citizen employee IRAS requires the employer to seek tax clearance at least one month before the last day of employment, and to withhold all monies due to the employee from the moment the departure is known. The pay clock is the shortest: MOM requires final salary on the last day of employment when the employee resigns with notice. The pass clock runs after the last day: the Employment Pass must be cancelled within one week. Behind all three sits the engineering clock — knowledge transfer and access revocation — which has no statutory deadline and is the one companies leave until it is too late.

The official references are short and worth reading once: MOM on paying salary and on cancelling an Employment Pass, and IRAS on tax clearance for foreign and SPR employees. None of it replaces your payroll provider or counsel; all of it is what they will check.

Step 1: Day 0 — Acknowledge the Resignation and Fix the Dates

Reply in writing the same day, stating the notice period, the last working day and whether any part of the notice will be garden leave. The notice period is whatever the contract says; if the contract is silent, the Employment Act minimums apply — one day for under 26 weeks of service, one week for 26 weeks to under two years, two weeks for two to under five years, four weeks for five years or more. Get the last day agreed before anything else, because every other deadline in this article is counted from it.

Then open one offboarding ticket in whatever system engineering already uses, with the seven steps as sub-tasks and an owner on each. The failure mode in the opening paragraph was three checklists in three departments, none of which saw the others. If a developer with production or customer-data access is joining a competitor, decide on garden leave now; it does not change any statutory deadline, but it changes when Step 4 happens.

Step 2: Days 1 to 3 — File Form IR21 and Withhold Monies for a Non-Citizen

If the developer is not a Singapore citizen, IRAS expects Form IR21 at least one month before the last day of employment, and expects you to withhold all monies due — final salary, leave encashment, bonus, notice pay — from the date you become aware of the departure, until IRAS tells you how much tax to remit and how much to release. On a thirty-day notice that means filing in the first three days. Most e-filed forms are processed in about 21 days, so a prompt filing usually clears before the last day; a late one does not, and the developer waits for their money.

• Exemptions to check before filing: the employee worked 60 days or less in the calendar year (not for directors); or worked at least 183 days and earned less than S$21,000; or is transferring within the same group in a merger or restructuring notified to IRAS.
• Singapore Permanent Residents: no IR21 is needed if the PR is staying in Singapore and gives you a Letter of Undertaking saying so; keep the letter on file.
• If you cannot withhold enough — for example because the last salary was already paid — state the reason on the form; otherwise the employer can be held liable for the employee’s tax.
• Reconcile with the IR8A you will file for the same employee at year end; our IR8A guide for foreign developers covers that side.

Step 3: Week 1 — Build the Ownership Map and the Knowledge-Transfer Plan

Ask the developer and their lead to produce, together, a single table: every service, repository, pipeline, cron job, dashboard, vendor relationship and undocumented decision the developer owns or is the only person who understands. For each row, name a successor and a transfer method — a recorded walkthrough, a pairing session, a written runbook, or a decision note. Schedule all of them in weeks two and three. The final week is for questions, not for first explanations.

Two rules make this work. The successor must exist: if the role is being backfilled, the successor is the incoming hire or, until they arrive, the lead. And the map is reviewed by someone who did not write it, because the things that get left off are precisely the ones the leaver thinks are obvious. The SSH key in the opening paragraph would have appeared on this table under “how the deployment script authenticates”, had anyone asked.

Step 4: Weeks 2 to 4 — Inventory Access and Plan the Revocation Order

Treat access as a dependency graph. Start from the identity provider and enumerate outward: source control, cloud IAM roles and any long-lived keys, CI and deployment secrets, production and analytics databases, observability tools, SaaS with its own login, package registries, app store and domain registrar accounts, and any personal access tokens or keys the developer generated outside the identity provider. Ask the developer directly for the last category and write down the answer; it is the most honest inventory you will get.

Rotate first, revoke second. A revoked account cannot use a shared secret it memorised or saved; a rotated secret cannot be used by anything. Schedule the whole sequence for the last day, in one sitting, with a second engineer confirming each layer, and put a thirty-day access review in the calendar for whatever survived. If the developer handled personal data, the Personal Data Protection Act obligations on your side — the leaver’s access ends, your retention and protection duties do not — are a good reason to keep the export in Step 4 of the diagram to the successor only.

Step 5: Last Day — Pay Final Salary and CPF on Time

MOM’s timelines are precise and payroll teams get them wrong in both directions. When the employee resigns and serves notice, final salary is due on the last day of employment. When the employer terminates or dismisses, it is due on the last day or, if that is not possible, within three working days. When the employee resigns without notice, it is due within seven days of the last day. The final pay includes salary to the last day, encashed annual leave where the contract or policy provides for it, and any pro-rated bonus the contract promises; the employer’s and employee’s CPF contributions for the final month are made as usual for citizens and PRs.

The one legitimate reason to pay less than the full amount on the due date is the IR21 withholding, and it should be explained in writing on the payslip. If clearance has already arrived, remit the tax to IRAS and pay the balance on the last day like any other final salary.

Step 6: Within One Week — Cancel the Employment Pass and Related Passes

For pass holders, MOM requires the employer to cancel the Employment Pass within one week after the last day of notice. Three consequences follow that are easy to forget. Cancelling the EP cancels every dependant and long-term visit pass issued to the developer’s family, and they cannot be reinstated. If the developer is staying in Singapore to look for a new job or to wind up their affairs, you can request a Short-Term Visit Pass at cancellation, valid for up to 90 days from the application date; agree that with them in advance so their family’s status is not a surprise. And the physical card should be returned, cut in half and discarded.

If the developer is moving to another Singapore employer, the new employer applies for a fresh pass and the timing of your cancellation can matter to their start date; our note on notice periods and buyouts in Singapore hiring covers that from the hiring side. Whatever happens next, the tax clearance in Step 2 should have been sought before the cancellation, not after.

Step 7: Day 0, in Parallel — Start the Backfill and Run the Exit Interview

Every step above is easier when the successor exists. Open the replacement role the day the resignation lands, not after the last day; the difference is whether the knowledge transfer in Step 3 goes to a person or to a document. Our 14-day hiring cycle is built for exactly this window, and the onboarding process that follows should mirror the offboarding: the same ownership map, read the other way.

• Exit interview in the final week, run by someone other than the direct manager, with three fixed questions: what would have kept you, what should the successor know that is not written down, and what access do you still have that we may not know about.
• References and alumni terms in writing: who gives references, what they will confirm, and whether the developer may be contacted after leaving for questions the map missed. Pay for that time if you use it.
• Non-compete and confidentiality reminders where the contract has them; our guide to non-compete clauses for engineers in Singapore explains how far they actually reach.

If You Also Run Teams in Dubai

The same 30-day logic applies in the UAE with different paperwork: a labour-law notice period of 30 to 90 days, end-of-service gratuity instead of tax clearance, and a work permit and residence visa cancellation instead of an Employment Pass. Our Dubai colleagues have written up how to offboard a remote developer in the UAE; if your engineering org spans both hubs, the access revocation order and the ownership map are identical, and can live in one template.

Within Singapore, the practical next move is to open your last offboarding ticket, if there was one, and check three dates: when the IR21 was filed relative to the last day, when the final salary was paid, and when the pass was cancelled. If any of them is wrong, the next resignation is where it will show. Our Node.js and TypeScript benches include Singapore-based developers who can start inside a notice period, which is the only way to make Step 3 a conversation rather than a document.

FAQ — Offboarding a Developer in Singapore