The CRS/OECD only means that banks are obligated to pass on certain information. They only need to pass on your full name, citizenship, any tax file number information and account balance. They do not pass on individual transactions and the origin of these transactions. Perhaps if overseas authorities sense something fishy they may be permitted to ask a bank for further information but I'm not sure about this and this would be up to the discretion of the bank anyways as specific information is not covered by the CRS/OECD.
I also believe a foreigners bank account balance is only recorded and passed on at certain intervals which i understand to be a year. In a practical sense however tax authorities just operate automatically. A computer just takes a person on their word when a tax return is received and its only when red flags are raised that a human comes in and investigates a persons individual tax return.
In the case of overseas accounts a red flag would only really be when a large amount of money is reported in their account that cannot be accounted for within the bounds of their reported salary. Im uncertain if what you are saying is that your Singaporean friend doesnt even report their salary however. If this is the case then I would say he is definitly walking a tight rope. Perhaps it is just small money so no red flags are waved. Certainly this seems to be the case so far. I agree with traineeinvestor however that these systems will evolve and become more sophisticated over time. He may get caught out in the future.