What is the MAS Notice PSN02?

The background of PSN02 lies in the Monetary Authority of Singapore’s (MAS_ commitment to maintaining the integrity and security of the financial system against money laundering and terrorism financing risks. By implementing the notice, MAS aims to strengthen the overall resilience of Singapore’s financial system and maintain its reputation as a trusted global financial center.  

What is PSN02?

The MAS Notice PSN02 is a crucial regulatory framework that outlines the obligations and requirements for payment service providers (PSPs) in Singapore. It is an update to Singapore’s anti-money-laundering (AML) and counter-terrorist financing (CTF) laws. Along with PSN01, these regulations have been defined in Singapore’s Payment Systems Act (PSA) and Money-Changing and Remittance Businesses Act (MCRBA). The updates were necessary because not all financial services were regulated under these acts previously.

In October 2021, the Financial Action Task Force (FATF) updated its 2019 Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (VASPs). Following FATF’s recommendations, legislators worldwide drafted new rules to regulate the (largely unregulated) cryptocurrency business. Before the introduction of PSN02, digital payment token (DPT) service providers did not have to comply with the same strict know your customer (KYC), customer due diligence (CDD), and AML/CTF regulations that other financial institutions had to comply with. In Singapore, MAS uses the term Digital Token (DT) for cryptocurrency.

What are the Key Differences Between PSN01 and PSN02?

PSN01 was much broader and generally addressed requirements for PSP. PSPs were legally obliged to set up a risk management framework as part of their overall requirements to detect and prevent money laundering and to counter terrorist financing. Financial institutions (FIs), including PSPs, had to implement KYC processes and procedures as part of CDD and assess potential risks to prevent financial crime.

PSN02  is more focused and specifically addresses requirements for DPTs, VASPs, or any service provider exchanging cryptocurrency. In June 2018, MAS published an AML/CTF Guide for DPT service providers, which was incorporated into MAS Notice PSN02 and validated in March 2022. MAS Notice PSN02 Guidelines provide detailed information on what is expected from FIs, PSPs, and DPT service providers.

Key Objectives of MAS Notice PSN02:

• Optimize the security of financial institutions that operate in Singapore, specifically PSPs and DPT service providers.
• Detect and prevent financial crime, fraud, money laundering, and terrorist financing.
• Identification and verification of customers, senders, receivers, and UBOs of legal entities.
• Improve operational resilience by reducing the risk of system downtime and other disruptions caused by cyber threats.
• Mitigate cyber risk.
• Enhance data protection.
• Strengthen user authentication.
• Foster trust and confidence among customers, investors, and other stakeholders through the FIs commitment to security and risk management.

What are Some Challenges that FIs May Face in Complying with PSN02?

When striving to comply with PSN02, some common challenges firms may encounter include:

• Limited capabilities due to legacy technology. Financial institutions may still have legacy systems that do not support all the requirements mentioned above. 
• Resource allocation. Implementation can be time-consuming and costly, especially when solutions must be developed in-house. This is particularly challenging for smaller PSPs and DPT service providers. Compliance with MAS Notice PSN02 requires careful planning and implementation. 
• Complex regulations. PSPs and DPT service providers may struggle to correctly interpret and implement all the requirements. 
• Skill gaps. FIs must invest in innovative technology and trained staff to implement the necessary controls and monitor transactions effectively. This is why FIs increasingly partner with a specialized regulatory technology (regtech) solutions provider.

What are the Penalties for Non-Compliance with MAS Notice PSN02?

Non-compliance with MAS Notice PSN02 can result in heavy penalties and reputation damage. The Monetary Authority of Singapore can take regulatory action against financial institutions that fail to comply with PSN02. Financial institutions operating in Singapore should take MAS Notice PSN02 seriously and ensure they follow the PSN02 guidelines to avoid potential penalties and reputational damage.

Here are some of the penalties that financial institutions may face for non-compliance:

• Financial damage (fines).
• Reputation damage.
• Legal action.
• Revocation of license.

How can Financial Institutions Comply with the Updated MAS Notice?

Under PSN02, FIs must implement a robust risk management system that includes:

• Risk assessment and risk mitigation.
• Customer due diligence; onboarding/customer acceptance.
• Identify and verify the ultimate beneficiary owner (UBO) of a legal entity.
• Politically exposed persons (PEP) and sanctions list screening as part of AML/CTF.
• Enhanced Due Diligence (EDD).
• Ongoing transaction monitoring.
• Record-keeping: accurate customer and transaction data records for at least five years.
• Compliance reporting: report their AML/CFT compliance activities, including suspicious transaction reports, to MAS.
• Reliance on third parties.
• Correspondent accounts and wire transfers.
• Monitor and analyze log files.
• Two-factor authentication (2FA).
• Regular controls to prevent unauthorized access.
• Identify both the sender and recipient of cryptocurrency, as recommended by FATF’s Travel Rule.
• Train employees and update them about MAS PSN02 requirements.

Future Outlook

What can be expected after MAS Notice PSN02? MAS will likely continue to update and strengthen its regulations and guidelines in response to constantly evolving global threats, money laundering scandals, and rising fraud figures. Singapore is a very mature fintech hub. As new threats emerge, MAS may expand the scope of PSN02, emphasize the need for technological innovation, and on the added value of artificial intelligence (AI) and machine learning (ML) empowered solutions. Regulators may collaborate with industry stakeholders to develop common standards and guidelines to increase payment security. In the future, PSN02 may be integrated with other regulations and guidelines, such as the Personal Data Protection Act (PDPA) and the Cybersecurity Bill to provide a more comprehensive framework.

MAS Notice PSN02 creates a regulatory framework to prevent money launderers, fraudsters, and terrorists from abusing FIs in Singapore. PSPs, including DPTSPs, must implement the required AML/CFT controls and processes to comply with MAS regulations. Compliance with these rules can be challenging due to high costs, regulatory complexity, and technological requirements. Non-compliance could have severe consequences, including heavy fines, reputational damage, and loss of business. Therefore, FIs, PSPs, and DPT service providers must prioritize compliance to protect their business.