The Payment Services Act 2019 (“PS Act”) was enacted in 2020 to streamline the licensing and regulation of payment service providers and to provide for the oversight of payment systems in Singapore. It was intended to provide regulatory certainty and consumer safeguards, while encouraging innovation and growth of payment services and financial technology (“Fintech”).
Among other things, the PS Act established a regulatory framework for cryptocurrency dealing or exchange services. The PS Amendment Act, which was passed on 4 January 2021 but took effect on 4 April 2024, along with the changes to the Payment Services Regulations 2019 (“PSR”) and various related regulatory instruments, seeks to address the inherent risks associated with digital payment tokens (“DPTs”). The amendments expand the scope of the PS Act and impose additional measures on DPT service providers to mitigate money laundering / terrorism-financing risks and ensure the safeguarding of all customer assets.
Around the same time, or on April 2 2024 to be precise, the Monetary Authority of Singapore (“MAS”) expanded the scope of payment services regulated by MAS and introduced user protection and financial stability-related requirements on DPT service providers.
Significantly, this week, on 26 July 2024, the MAS also made clear that for the purposes of licensing, licensing applicant PSPs are required to pro-actively obtain and submit a legal opinion/assessment. The assessment should include a detailed and comprehensive analysis of how each regulated payment service is or is not applicable to each proposed service or product.
PSPs and their domain specialist lawyers should be mindful that the assessment should also consider all relevant Legislation, Notices, Guidelines, Circulars and FAQs. If the MAS finds the initial legal opinion unclear, the MAS may request for a second legal opinion. In the premises, KGP Legal and our team of associated financial services partners are prepared to assist.
The Amendment Act also broadens the definition of cross-border money transfer service to include facilitating transfers of money between persons in different jurisdictions, where money is not accepted or received by the service provider in Singapore, bringing such service providers under the regulatory ambit of the MAS. Notwithstanding these legal developments, this year alone 10 individuals were convicted and sentenced to jail terms ranging from 13 to 17 months for their involvement in a S$3 billion money laundering case. The case involved the laundering of millions of dollars earned from an illicit gambling ring based in Southeast Asia, with the money being funnelled through Singapore’s financial system.
The case has highlighted the need for stricter regulations and more effective monitoring of Singapore’s financial system to prevent money laundering. The authorities have taken steps to strengthen the system.
As mentioned, this week, the MAS published amendments to the Guidelines on Licensing for Payment Service Providers (PS-G01) (“Guidelines”). These amendments affect Standard Payment Institutions (“SPIs”) and Major Payment Institutions (“MPIs”), and will take effect from 26 August 2024.
PSPs will be required to submit a legal opinion as part of their new license application for a SPI or MPI licence.
PS Act licensees applying to vary their licence to add a digital payment token (“DPT”) service will also need to submit a legal opinion.
A generic opinion from an in-house lawyer will not suffice. Under the updated Guidelines, the required legal opinion should be issued by a law firm experienced in advising on the PS Act in Singapore, and should include the following:
(b) a clear and concise summary of the applicant’s business model, as well as each of the service(s) and product(s) the proposed PSP intends to offer (including asset/fund flows and parties involved for each service/product where applicable);
(c) an assessment on whether the applicant’s proposed service(s) and/or product(s) are regulated payment services under the PS Act;
(d) if any of the proposed service(s) or product(s) are assessed to be exempted or excluded from regulation, a detailed explanation of how the relevant exemption or exclusion applies; and
(e) an acknowledgement that the legal opinion will be disclosed to the MAS.
Applicants are also required to submit a qualified, independent external auditor assessment of its policies, procedures and controls in the areas of anti-money laundering/countering the financing of terrorism (“AML/CFT”) and Consumer Protection.
More than one External Auditor can be engaged to perform the independent assessment, such as one for an assessment in the area of AML/CFT and another in the area of Consumer Protection.
MPI Licence Financial requirements: Base capital of S$250,000.
SPI Licence Financial requirements: Base capital of S$100,000.
While there is no change to the base capital requirement for SPIs and MPIs under the updated Guidelines, the MAS had stated that the base capital of SPI or MPI licence applicants should be able to cover at least 6 to 12 months of the applicant’s operating expenses.
Applicants are also expected to have an effective monitoring process to ensure that they have the financial position and capital levels to meet the base capital requirement, and have contingency plans in place to address potential capital shortfalls or other financial stress scenarios.
Traditionally, PSPs’ Technology Risk Management generally involved establish technology risk governance and oversight, with a risk culture cultivated by the board of directors and senior management.
With effect from 6 November 2024, licensees providing DPT services are also required to comply with the Notice on Technology Risk Management (FSM-N13). This notice applies to all financial institutions under MAS’ purview, including banks, and insurance companies, and PSPs to manage technology risks and maintain robust technology governance.
This amendment signals that the Technology Risk Management Framework that is implemented by PSP should be commensurate with the level of risk and complexity of services offered, in line with potential risks emerging within the evolving digital asset ecosystem.
PSPs typically establish compliance arrangements that are commensurate with the nature, scale and complexity of its business. This may have taken the form of an independent compliance function or compliance support from holding company or overseas related entity. However, under updated Guideline 3.1, even if an entity conducting DPT services receives compliance support from an independent and dedicated compliance team at their holding company or related entity, they must still have an in-house compliance officer specifically designated for their DPT services.
In our view, this update was likely put in place on account of the heightened volatility, cybersecurity and legal risks involved in the conduct and business operations of DPT services.
After the initial application review process, a designated case officer will correspond with the applicant and might arrange for an interview with the applicant’s key executives and/or the in-house compliance officer. The responsibility of directly attending an interview with the MAS case officer cannot be delegated – indeed under the updated Guidelines, external consultants, legal counsel and other third parties are not permitted to attend the interview in applicant’s place.
During the review process, MAS may place an application on hold for six months if significant changes occur to one or more of the applicant’s key indicators readiness for a licence, such as:
During this six-month period, the applicant is expected to:
After the six-month period, MAS will:
This “Case-on-hold” process allows the MAS to ensure that payment service providers meet the necessary standards and requirements, even if significant changes occur during the review process. Where submissions are assessed as significantly incomplete or deficient, the MAS may reject such applications. If an applicant fails to respond to the MAS’ requests for information within the stipulated deadline, the MAS will consider the application to be withdrawn.
The updated Guidelines aim to ensure greater clarity, improve the quality of applications, facilitate application reviews and enhance the efficiency of the PSP licensing process. Nonetheless, the process to be a payment services provider in Singapore can seem challenging.
We can help PSP licence applicants together with their other stakeholders. We regularly advise e-commerce and payment service providers, and have assisted entities to apply for and obtain PSP and DPT service licences.
KGP Legal’s Financial Services & Regulatory Practice team comprises seasoned Fintech. and digital asset experts; former in-house advisers to big technology companies and payments platforms; and specialists in corporate investigations, government relations & regulatory affairs.