A full set of policies and procedures

The requirements do not come neatly packaged in one document. They sit across the Payment Services Act, regulations, MAS notices, guidelines and circulars. These bits and pieces can be confusing for a new compliance officer who may not know where to look.

For a firm providing digital payment token (DPT) services, we recommend covering at least the following areas:

  • AML/CFT, KYC, customer onboarding and ongoing due diligence.
  • Transaction monitoring, blockchain analytics and sanctions screening.
  • Travel Rule and value-transfer requirements.
  • Safeguarding, custody and protection of customer assets.
  • Consumer access, risk disclosures, complaints handling and marketing controls.
  • Technology risk and cybersecurity.
  • Enterprise-wide money laundering and terrorism financing risk assessment.
  • Risk management framework and risk register.
  • Product risk management and token-listing governance.
  • Conflicts of interest.
  • Outsourcing and third-party risk management.
  • Business continuity and incident response.
  • Record keeping, staff screening and training.

This is a practical starting point, rather than an exhaustive list for every business model. The firm’s licensed activities, customers and risks determine what else it needs. MAS’s payments regulations and guidance

A policy sets out the high-level framework, responsibilities and expectations. The procedures explain what employees should actually do on a day-to-day basis to follow it. You may combine related topics where that makes sense, but the controls and responsibilities still need to be clear.

Compliance officers should work through the applicable requirements and tailor the procedures to the firm’s size, nature and risks. That does not mean deleting mandatory obligations because they are inconvenient. MAS Notice PSN02, paragraph 17.2

Some of these P&Ps, particularly those covering AML/CFT and consumer protection, will already have been reviewed by an independent external auditor during the licensing process, with the auditor’s assessment report signed off and submitted to MAS. The compliance function should ensure the remaining areas are covered, and that the documents continue to reflect how the business operates. Reviews and material changes should be documented and brought to senior management for approval. MAS’s independent assessment requirements, section 4.1

We recommend an annual policy review as a practical baseline, with earlier updates when regulations, products, systems or risks change. Some reviews have their own expectations: the enterprise-wide AML/CFT risk assessment should be reviewed at least every two years, and sooner when material changes arise. PSN02 risk-assessment guidance, paragraph 4-18

A real example is USDC temporarily losing its US dollar peg in March 2023, after Circle disclosed that US$3.3 billion of its reserves were held at the failed Silicon Valley Bank. Circle later confirmed that these reserves would become available following action by the US authorities. Circle’s update, Federal Reserve analysis

For a firm supporting USDC, this is the kind of event that should prompt a review of its token-risk assessment and operating procedures: who monitors price deviations, when the issue reaches senior management, what customers are told and how disrupted conversion or redemption arrangements are handled. If the policy simply assumes a stablecoin will always be worth US$1, staff have little guidance when that assumption stops holding. An annual date stamp alone will not fix that.

MAS reporting obligations and your compliance calendar

For DPT service providers, the core regulatory returns include monthly and half-yearly submissions. The calendar should cover the firm’s actual licensed activities, rather than copying a quarterly timetable from another licensing regime.

Obligation Frequency and deadline
PSN04 Form 6A: DPT service return Monthly, within 30 days after month-end.
PSN04 Form 6B: DPT service return Half-yearly, within 30 days after 30 June and 31 December.
PSN04 Form 9: Profit/Loss Statement and Capital Annual, within 30 days after calendar year-end.
Form 4: statutory external audit report Annual, submitted within six months after financial year-end.
Independent AML/CFT audit Regular assessments, with frequency and scope reflecting the firm’s risks, size and complexity.

The return deadlines are set out in MAS Notice PSN04. The annual audit deadline is explained in MAS’s Form 4 guidance. The independent AML/CFT audit requirements are separate. PSN02 audit requirements, PSN02 audit guidance

Thirty days after 31 December means 30 January, so do not casually pencil in the end of January. Other licensed payment activities may add further returns. These are also separate from a monthly or quarterly compliance report prepared for management.

The statutory external audit is mandatory every year. We recommend planning an annual internal audit as a practical starting point, with more frequent reviews where the risks warrant them. It should provide independent challenge, rather than the compliance team marking its own homework.

The calendar also needs event-driven obligations, including applicable notifications or approvals for corporate and licence changes, material suspicious activities or fraud, and reportable technology incidents. These cannot wait for the next scheduled return. MAS’s ongoing requirements, PSN03, technology incident requirements

A good compliance function knows these obligations in advance, sets reminders and coordinates the necessary data, reviews and approvals before the deadline. Repeatedly late or inaccurate submissions can raise questions about the firm’s oversight. Finance or operations may prepare parts of a return, but someone must own the submission and retain evidence of approval.

What senior management should see

We recommend monthly risk committee meetings where the compliance function highlights matters requiring senior management’s attention and a decision. The agenda could include:

  • Overdue CDD reviews and the plan to clear them.
  • Staffing gaps or a lack of capacity to complete required work.
  • A rise in the proportion of higher-risk customers being onboarded.
  • Transaction-monitoring alerts increasing beyond expected business levels.
  • Sanctions escalations.
  • Outstanding actions from internal or external audit, or MAS.

Each issue should come with a named owner, a proposed solution and a target date. If the team needs additional resources or a management decision, make that clear. Recording “noted” in the minutes does not clear an overdue review or close an audit finding. Urgent issues should be escalated as they arise, rather than waiting for the next monthly meeting.

Day-to-day DPT compliance operations

Naturally, much of the day-to-day work involves client onboarding, KYC, screening, periodic reviews, transaction monitoring, Travel Rule checks, blockchain analytics, sanctions and incident escalation.

We will not go into every operation here, but the compliance function should oversee them with systems and responsibilities that work like a well-oiled machine. Some tasks will sit with operations, technology or treasury. Compliance should monitor, challenge and escalate issues, rather than being treated as the one person responsible for doing everything.

Customer reviews should follow a documented, risk-based schedule. Higher-risk customers need more frequent reviews, often annually, and relevant changes may trigger an earlier review. If your policy sets an annual deadline, the team should not let it drift because nobody has the bandwidth. PSN02 ongoing-monitoring guidance, paragraphs 6-11-4 to 6-11-6

Transaction-monitoring alerts must be investigated and resolved in accordance with the P&Ps. Suspicious transaction reports must be submitted promptly to the Suspicious Transaction Reporting Office (STRO), part of the Singapore Police Force, with a copy provided to MAS upon request. Separate MAS notifications may also apply to material suspicious activities or fraud. PSN02, paragraph 16.2, PSN03

Leaving alerts unresolved or repeatedly missing risk flags suggests that the firm is losing control of its compliance operations.

Compliance also needs to look at customer and related accounts across business units, sharing relevant information with appropriate confidentiality safeguards. When an AML alert needs investigation, colleagues who deal with the customer may know about unusual requests, evasive responses or changes in business activity that the screening result alone cannot explain. PSN02 holistic-monitoring guidance, paragraphs 6-11-10 to 6-11-11

In a previous payments role, we worked with a bubble-tea merchant whose typical retail payments were around S$5-S$50 through its point-of-sale (POS) system. If a S$10,000 transaction suddenly came through that same system, it would deserve a closer look. Compliance should work with the business unit to understand the purpose of the payment, the customer’s dealings and the supporting records. The amount needs to be understood against the merchant’s usual activity before the alert can be properly resolved.

Although this is a merchant-payments example, the same principle applies to DPT customers: an unusual transfer needs to be understood in the context of the customer’s business and expected activity.

We have seen a case where MAS questioned how a sanctioned individual had remained in the customer database after a screening alert was dismissed. The system had raised a possible match involving differences in name order and name components. A junior compliance officer treated it as a false positive. The compliance manager then approved that assessment without properly challenging it, and the case was closed.

This presents a worrisome gap in maker-checker controls. A second approval is only useful if someone actually checks the reasoning. Alert closures need reliable evidence, documented reasons and meaningful review. Digital controls can enforce an approval workflow, but they cannot make a weak judgment sound. PSN02 screening guidance, paragraphs 6-15-3 to 6-15-9

We recommended amending the CDD procedures so that a manager approving a false-positive dismissal had to add their own written rationale, supported by the evidence reviewed. Differences in name order alone should not settle the assessment. Requiring the checker to explain why they agree encourages a second look and makes the decision traceable to the person who approved it. It becomes harder to push the blame around or say that the system got it wrong. The point is to make the maker-checker process an actual review, rather than a second click.

As the business grows, the compliance team should consider digital solutions to automate workflows. If transactions run into the thousands each month, manual spreadsheets and row-by-row checks can become difficult to manage. Manual tools may suit a smaller operation, but the systems should match the firm’s size and complexity. PSN02 transaction-monitoring guidance, paragraph 6-11-8

Screening, KYC and transaction-monitoring solutions can help organise cases, track overdue work and give management a clearer dashboard. They still need sensible settings, reliable data and people who know how to investigate the results. Advisors Assemble can help assess suitable solutions and guide implementation to reduce avoidable manual work and make better use of the team’s time.

Customer assets in practice

Consider an illustrative custody example. The customer ledger shows 100 units of a token, but the safeguarding records account for only 99. Operations should investigate whether this is a timing difference, an incorrect entry or an actual shortfall, and keep evidence of the explanation and any corrective action. Compliance should check that the exception is escalated and resolved, with a clear owner and a record of the outcome.

Transfers of customer assets also need appropriate authorisation and separation of duties. One employee should not be able to approve and move customer assets alone. A reconciliation that produces a report nobody reads is not much of a control. MAS’s DPT safeguarding and custody guidance, sections 3.2 and 3.4

Product compliance before a new token or service launches

During the licence application, your business plan will have described the intended DPT products, their mechanisms and associated risks. After licensing, the firm may explore new tokens, payment methods and services.

It is essential to complete the relevant product due diligence and risk assessment before launch. Document the assessment, controls, approval and reasons for proceeding. Consider token classification, custody arrangements, financial-crime risks, conflicts, customer disclosures and whether the existing systems can support the product. PSN02 new-product requirements, paragraphs 5.1-5.2, MAS’s DPT product-governance guidance

Tokenised real-world assets deserve particular care. A token representing a share, bond or fund interest may fall under capital markets regulation, rather than being covered simply because the firm holds a DPT licence. Stablecoin issuance also needs a separate assessment from exchange, transfer or custody services. Check the actual product and activity, including whether additional approvals or a licence variation are needed. MAS’s tokenisation guide, our DPT licensing guide

The compliance team should be involved early enough to influence the launch, rather than being handed a finished product and asked to approve it by Friday.

For an illustrative example, imagine a firm preparing to support a token on a new blockchain. Marketing is ready to launch, but the review finds that its blockchain analytics does not cover the network and there is no tested process for handling the required Travel Rule information. The firm should address those gaps, test the controls and document approval before going live. If it cannot manage the risks, it should delay or reconsider the launch. “The wallet supports the token” is not enough to show that the business is ready to support it. PSN02 new-product and value-transfer requirements

Signs your compliance function may need additional support

  • Policies are maintained but not actively tested.
  • The compliance calendar is mostly reactive.
  • Regulatory changes are being tracked informally.
  • Transaction-monitoring alerts are reviewed, but recurring themes are not reported to management.
  • The team is stretched between business-as-usual reviews and product launches.
  • There is no independent challenge of new DPT products or controls.

If this sounds familiar, contact Advisors Assemble to discuss support for your DPT compliance function, policy reviews, monitoring or preparation for audit.