PS-G03 Guidelines on consumer protection safeguards for DPT services

Guidelines PS-G03 19 September 2024

GUIDELINES ON THE PROVISION OF CONSUMER PROTECTION SAFEGUARDS BY DIGITAL PAYMENT TOKEN SERVICE PROVIDERS 2 April 2024 (last revised on 19 September 2024)

CONTENTS Contents

INTRODUCTION 1.1

Purpose of the Guidelines

1.2 Effective date of the Guidelines

1.3 Application of the Guidelines

INTERPRETATION

2.1 Definitions

2.2 Modifications to definition of “accredited investor” (opt-in regime)

2.3 Transitional provisions for the accredited investor opt-in regime

SAFEGUARDING OF CUSTOMERS’ ASSETS

3.1 Introduction

3.2 Segregation of customers’ assets

3.3 Maintenance of trust account with a safeguarding person

3.4 Risk management controls

3.5 Disclosures to customers

3.6 Statement of account

3.7 Additional considerations for retail customers’ assets

CONSUMER ACCESS MEASURES

4.1 Introduction

4.2 Risk Awareness Assessment

4.3 Restrictions on offering incentives

4.4 Restrictions on credit and leverage

CONFLICTS OF INTEREST

5.1 Introduction

5.2 Identification and mitigation of conflicts of interest

5.3 Safeguarding personnel for customers’ assets

5.4 Vertical integration of DPT trading activities

5.5 Issuing own or related tokens

31 2

OTHER BUSINESS CONDUCT MEASURES

6.1 Introduction

6.2 DPT listing and governance policies

6.3 Complaints handling and dispute resolution

ANNEX 1 – ILLUSTRATIONS

Safeguarding of customers’ assets

Restrictions on offering incentives

Types of DPT trading activities

Guideline No Issue Date

: PS – G03 : 2 April 2024 (last revised on 19 September 2024)

GUIDELINES ON THE PROVISION OF CONSUMER PROTECTION SAFEGUARDS BY DIGITAL PAYMENT TOKEN SERVICE PROVIDERS 1

INTRODUCTION

1.1 Purpose of the Guidelines

1.1.1 The Monetary Authority of Singapore (“MAS”) seeks to develop an innovative and responsible digital asset ecosystem in Singapore.The innovative combination of tokenisation and distributed ledgers offers transformative economic potential, by allowing anything of value to be represented in digital form, fractionalised, and to be stored and exchanged on a distributed ledger that keeps immutable records of all transactions.

This can potentially facilitate more efficient transactions, enhance financial inclusion and unlock economic value.

1.1.2 While cryptocurrencies play a supporting role in the broader digital asset ecosystem, their prices and demand have been heavily speculated upon despite their lack of economic fundamentals or underlying economic value.

1.1.3 MAS adopts a risk-focused approach to regulating the digital asset ecosystem. To facilitate innovation in digital assets, regulations need to be clear and proportionate to the risks posed. These regulations are periodically reviewed to ensure that they remain relevant, given the pace of innovation.

1.1.4 MAS aims to anchor high quality and credible players with strong risk management practices and clear value propositions that support the development of the digital asset ecosystem in Singapore.

MAS also aims to mitigate the risks of consumer harm arising from dealing in cryptocurrencies (also referred to here as “digital payment tokens” or “DPTs”) and strengthen consumer education to equip them with the relevant knowledge on the risks of cryptocurrencies and their related services.

1.1.5 The Guidelines are issued by MAS pursuant to Section 101 of the Payment Services Act 2019 (“PS Act”) and apply to all DPT service providers (the “Guidelines”). The aim of the Guidelines is to 4

promote the adoption of sound and robust practices for DPT service providers. The Guidelines set out the expectations of MAS on the measures that a DPT service provider should have in place to address consumer protection risks. 1.2

Effective date of the Guidelines

1.2.1 Chapters 1, 2 (other than paragraphs 2.3.1 to 2.3.7), 3 and paragraph 5.3 of the Guidelines take effect on 4 October 2024. Paragraphs 2.3.1 to 2.3.7, and Chapters 4, 5 (other than paragraph 5.3) and 6 of the Guidelines take effect on 19 June 2025.

1.3 Application of the Guidelines

1.3.1 The extent and degree to which a DPT service provider implements the Guidelines should be commensurate with the level of risk and complexity of the services offered and the technologies supporting such services. In supervising a DPT service provider, the degree of observance of the spirit of the Guidelines by the DPT service provider is an area of consideration by MAS.

1.3.2 The Guidelines provide general guidance and are not intended to be comprehensive nor replace or override any legislative provisions. They should be read in conjunction with the provisions of the PS Act, the Payment Services Regulations 2019 (“PS Regs”), as well as other subsidiary legislation, written directions, notices, codes and guidelines that MAS may issue from time to time pursuant to the relevant legislation and subsidiary legislation.

1.3.3 While the Guidelines may refer to provisions from the PS Act or PS Regs, the Guidelines do not reproduce the provisions in their entirety. DPT service providers should refer to the Singapore Statutes Online website for the full provisions.

INTERPRETATION

2.1 Definitions

2.1.1 In these Guidelines— “accredited investor” means any of the following persons, if the person has opted to be treated by a DPT service provider as an accredited investor for all the consent provisions – a) an individual mentioned in section 4A(1)(a)(i) of the Securities and Futures Act 2001;b) a corporation mentioned in section 4A(1)(a)(ii) of the Securities and Futures Act 2001;

c) a trustee mentioned in section 4A(1)(a)(iii) of the Securities and Futures Act 2001 read with regulation 2(1) and 2(3) of the Securities and Futures (Classes of Investors) Regulations 2018;and d) a person mentioned in section 4A(1)(a)(iv) of the Securities and Futures Act 2001 read with regulation 2(2) of the Securities and Futures (Classes of Investors) Regulations 2018;“consent provisions’’ mean: a) before 19 June 2025, paragraphs 3.7.1 and 3.7.2;

b) on or after 19 June 2025, paragraphs 3.7.1, 3.7.2, 4.2.1, 4.2.5, 4.2.6, 4.3.2, 4.4.1 and 6.3.3 of these Guidelines;“customer” means any person to whom a DPT service provider provides a DPT service;“DPT” means digital payment token;“DPT service provider” means any of the following persons: a) a payment service provider that is licensed to provide a DPT service;b) an exempt payment service provider mentioned in section 13 of the PS Act that provides a DPT service;

“institutional investor” has the meaning given by section 4A(1)(c) of the Securities and Futures Act 2001;“leveraged DPT transaction” refers to a transaction to purchase or sell DPTs, where one counterparty provides to the other counterparty money, DPTs, property, or other collateral which represents only a part of the value of the transaction;“related corporation” has the meaning given by section 4(1) of the Companies Act 1967;

“relevant money” has the meaning given by section 23(14) of the PS Act;“retail customer” means any customer other than: a) an accredited investor;6

b) an institutional investor; c) a DPT service provider; and d) an entity that carries on a business of providing the equivalent of a DPT service outside of Singapore and is regulated by a financial regulatory authority; “senior managers” refer to individuals who are employed by, or acting for or by arrangement with, a DPT service provider, and are principally responsible and accountable for the day-to-day management of the DPT service provider. 2.1.2

For the purposes of the definition of “accredited investor” in these Guidelines, an individual, corporation, trustee or person (called in this paragraph as “A”) opts to be treated by a DPT service provider as an accredited investor for all the consent provisions if1 — a)

A is, and has been assessed by the DPT service provider to be any of the persons specified in sub-paragraphs (a) to (d) of the “accredited investor” definition in paragraph 2.1.1;

the DPT service provider has provided to A the following statements in writing: i)

a statement that the DPT service provider has assessed A to be a person mentioned in sub-paragraphs (a) to (d) of the “accredited investor” definition in paragraph 2.1.1;

ii)

a statement that A may consent to being treated by the DPT service provider as an accredited investor for the purposes of all of the consent provisions;

iii) a statement that, if A consents in accordance with the statement mentioned in subparagraph (ii), A may at any time withdraw his or her consent, upon which the DPT service provider must not (after the period of time specified in the statement) treat A as an accredited investor for the purposes of all of the consent provisions; iv) the general warning set out in paragraph 2.1.5 of these Guidelines; v)

c) a clear explanation in plain language of the effect under the applicable consent provisions of A being treated by the DPT service provider as an accredited investor, in sufficient detail as to enable A to make an informed decision whether to opt to be treated by the DPT service provider as an accredited investor;

A, having been provided with the statements mentioned in sub-paragraph (b), has given the

Paragraphs 2.1.2 to 2.1.6 of these Guidelines are adapted from Regulations 3(3), 3(6), 3(7) and (3)(8) of the version of the Securities and Futures (Classes of Investors) Regulations 2018 that is in force as of 2 April 2024.

DPT service provider a statement in writing, or signed a statement recorded by the DPT service provider in writing, the effect of which is that — i)

A knows and understands the consequences of consenting to being treated by the DPT service provider as an accredited investor for the purposes of all of the consent provisions;

ii)

A consents to being treated by the DPT service provider as an accredited investor for the purposes of all of the consent provisions; and

iii) A knows that A may at any time withdraw his or her consent given under subparagraph (ii), upon which the DPT service provider must not (after the period of time specified in the statement mentioned in sub-paragraph (b)(iii)) treat A as an accredited investor for the purposes of any consent provision; and d)

A— i)

has not notified the DPT service provider that he or she withdraws his or her consent under sub-paragraph (c)(ii); or

ii)

has notified the DPT service provider that he or she withdraws his or her consent under sub-paragraph (c)(ii), but the period of time specified in the statement mentioned in sub-paragraph (b)(iii) has not passed.

2.1.3 To avoid doubt, any notification of withdrawal of consent mentioned in paragraph 2.1.2(d)(ii) does not affect any transaction entered into before the period of time specified in the statement mentioned in paragraph 2.1.2(b)(iii) has passed.

2.1.4 To avoid doubt, for the purposes of the definition of ‘’accredited investor’’ in these Guidelines, a person may opt to be treated by one DPT service provider as an accredited investor for all the consent provisions but opt not to be treated by another DPT service provider as an accredited investor for all the consent provisions.

2.1.5 The general warning mentioned under paragraph 2.1.2(b)(iv) is as follows: “Accredited investors are assumed to be better informed, and better able to access resources to protect their own interests, and therefore require less regulatory protection. Customers who agree to be treated as accredited investors are reminded to exercise utmost caution when dealing in digital payment tokens.”

2.1.6 For the purposes of paragraph 2.1.2(b)(v), a mere reproduction, restatement, paraphrase or translation of all or any of the consent provisions is not a clear explanation in plain language of the effect under the applicable consent provisions of a person being treated by a DPT service provider as an accredited investor.

2.1.7 The expressions used in these Guidelines shall, except where expressly defined in these Guidelines or where the context otherwise requires, have the same meanings as in the PS Act and the PS Regs.

2.2 Modifications to definition of “accredited investor” (opt-in regime)

2.2.1 Retail customers are generally regarded as less able to access professional advice and have less resources to protect their interests, as compared to institutional investors and accredited investors. In these Guidelines, MAS has set out certain expectations that are specific to DPT service providers’ dealings with retail customers, such as restrictions on the facilitation of lending and staking of assets belonging to a retail customer and other consumer access measures.

2.2.2 In defining a “retail customer”, MAS drew reference from the classification of customers under the Securities and Futures Act 2001.Under the opt-in regime for accredited investors, all customers other than institutional investors would by default be treated as retail customers2.A customer who meets any of the criteria stipulated in the “accredited investor” definition would have the choice of electing for “retail customer” or “accredited investor” status.

For example, an individual is eligible to be treated as an accredited investor if the individual has over S$2 million in net personal assets (where the net value of the individual’s primary residence is capped at S$1 million), or has over S$1 million in net financial assets, or has over S$300,000 in income over the preceding 12 months.

2.2.3 For the purposes of determining the value of an individual’s net personal assets for determining eligibility as an accredited investor, a DPT service provider should adopt a prudent methodology3 by – a)

applying a haircut of at least 50% to the market value of the individual’s holdings of DPTs; and

Where relevant, a DPT service provider should consider the guidance set out in the Frequently Asked Questions on The Definition of Accredited Investor and Opt-In Process.3 MAS intends to amend these Guidelines to reflect its policy intent as set out in paragraph 2.

11 of the Response to Public Consultation on Proposed Regulatory Measures for Digital Payment Token (Part 2) (link) after the amendments to the PS Act in relation to MAS’ regulatory approach for stablecoin-related activities have come into effect.

taking the value of the individual’s holdings of DPTs to be the lower of the following: i)

the value calculated under paragraph 2.2.3a); and

ii)

S$200,000 4.

2.2.4 For the purposes of determining the value of net assets of a corporation or entity (as the case may be) for determining eligibility as an accredited investor, a DPT service provider should refer to the latest audited financial statements of the corporation/entity, which should be prepared based on generally accepted financial reporting standards.

If no audited financial statement is available, then the DPT service provider should adopt the same approach for valuing the customer’s holding of DPTs as described in paragraph 2.2.3.

2.2.5 A DPT service provider should disclose its valuation methodology (e.g., haircuts and caps) and apply it fairly to all its customers. The DPT service provider should also conduct a periodic review on the valuation methodology, and any changes to its customers’ qualification as an accredited investor, on at least a yearly basis.

2.2.6 MAS may review and amend the haircut and cap described in paragraph 2.2.3 as it deems fit.

2.3 Transitional provisions for the accredited investor opt-in regime

2.3.1 With the addition of Chapters 4 and 6 of the Guidelines, DPT service providers should review their internal processes in relation to the accredited investor opt-in regime to ensure that it remains appropriate in respect of its treatment of persons who have opted to be treated by the DPT service provider as an accredited investor for the additional consent provisions in 4.2.1, 4.2.5, 4.2.6, 4.3.2, 4.4.1 and 6.3.3.

2.3.2 Despite paragraph 2.3.1, but subject to paragraphs 2.3.3, 2.3.4 and 2.3.5, a customer (called in this section 2.3 as “B”) who is an accredited investor and an existing customer of a DPT service provider before the effective date of Chapters 4 and 6 of the Guidelines (called in this section 2.

3 as the “specified date”) may be treated on or after the specified date as having opted to be treated by the DPT service provider as an accredited investor for all consent provisions if – a)

before the specified date, B had opted to be treated by the DPT service provider as an accredited investor for all the consent provisions as defined in the previous version of these Guidelines before the specified date; and

To avoid doubt, a DPT service provider may choose to apply a lower cap than S$200,000.

immediately before the specified date, B had not notified the DPT service provider that B does not consent to be treated by the DPT service provider as an accredited investor for the purposes of all the consent provisions as defined in the previous version of these Guidelines before the specified date.

2.3.3 If the DPT service provider does not give B all the statements mentioned in paragraph 2.3.6 before the specified date, then paragraph 2.3.2 only applies until that date.

2.3.4 If, before B gives any notification mentioned in paragraph 2.3.5 to the DPT service provider, the DPT service provider gives B all the statements mentioned in paragraph 2.3.6, then paragraph 2.3.2 only applies – a)

so long as B has not notified the DPT service provider that B does not consent to be treated as an accredited investor for the purposes of all the consent provisions; or

where B has notified the DPT service provider that B does not consent to being treated as an accredited investor for the purposes of all the consent provisions, until the expiry of the processing period by the DPT service provider of such notification,

and if the DPT service provider has recorded in writing the fact mentioned in sub-paragraph (a) or (b), as the case may be. 2.3.5

2.3.6 If, before the DPT service provider gives B all the statements mentioned in paragraph 2.3.6, B notifies the DPT service provider pursuant to the statement mentioned in paragraph 2.1.

2(b) of these Guidelines that was provided by the DPT service provider before the specified date, that B does not consent to being treated by the DPT service provider as an accredited investor for the purposes of all the consent provisions in the previous version of these Guidelines before the specified date, then paragraph 2.3.2 only applies until the earlier of the following dates: a)

the specified date; or

the last day of the processing period.

For the purposes of paragraphs 2.3.3 to 2.3.5, the statements are as follows: a)

a statement that the DPT service provider intends to continue to treat B as an accredited investor for the purposes of all the consent provisions starting on the specified date;

a statement that B may at any time notify the DPT service provider that B does not consent to being so treated by the DPT service provider, upon which the DPT service provider will 11

not (after the processing period specified in the statement) treat B as an accredited investor for the purposes of all the consent provisions; and c)

2.3.7 a statement setting out a clear explanation in plain language of the effect of B being treated by the DPT service provider as an accredited investor for the purposes of the Guidelines, in sufficient detail as to enable B to make an informed decision whether to give the notification of no consent mentioned in sub‑paragraph (b).

In this section 2.3, “processing period” means the period specified in the statement mentioned in paragraph 2.1.2(b)(iii) of these Guidelines that was provided to B.

SAFEGUARDING OF CUSTOMERS’ ASSETS

3.1 Introduction

3.1.1 The guidance in this Chapter applies to any asset received by a DPT service provider from, or on account of, a customer.

3.1.2 To facilitate transactions in DPTs and other assets, customers commonly entrust their DPTs and other assets to DPT service providers.

Effective and robust arrangements by the DPT service providers, for the identification and segregation of customers’ assets, are key to mitigating the risk of loss or misuse of customers’ assets during the DPT service provider’s ordinary course of business, as well as facilitate the return of customers’ assets in the event of the DPT service provider’s insolvency.

3.2 Segregation of customers’ assets

3.2.1 A DPT service provider may choose to maintain the trust account for safeguarding customers’ assets itself or engage the services of another person5 (“safeguarding person”) to maintain the trust account.MAS does not mandate that the trust account must be maintained with another person.

Nonetheless, a DPT service provider may choose to do so, as a means of segregating customers’ assets from its own assets and ensuring effective controls that mitigate potential conflicts of interest arising from the arrangement in safeguarding of customers’ assets.

A DPT service provider should periodically review its arrangements for safeguarding customers’ assets, including the degree to which the safeguarding person (if any) should be independent from the DPT service provider.

3.2.2 To avoid doubt, and unless expressly mentioned otherwise, paragraphs 3.2.3 to 3.7.4 apply to the DPT service provider regardless whether the trust account is maintained itself or with a safeguarding person. Further guidance on the maintenance of a trust account with a safeguarding person is set out in paragraphs 3.3.1 to 3.3.4 below.

3.2.3 Where a DPT service provider maintains the trust account itself, the DPT service provider should put in place operational processes that enable the DPT service provider to comply with the segregation requirements in Regulation 18B of the PS Regs. For example, the DPT service provider should use different blockchain addresses for the storage of customers’ assets from the blockchain addresses used to store the DPT service provider’s own assets (see Illustration 1).

Including an affiliate or a related corporation of the DPT service provider.

3.3 Maintenance of trust account with a safeguarding person

3.3.1 Before opening a trust account with a safeguarding person, a DPT service provider should assess, and satisfy itself of, the suitability of the safeguarding person. In particular, the DPT service provider should, at a minimum, consider the following:

3.3.2 a)

the legal, regulatory requirements or market practices6 relating to the holding of customers’ assets that could adversely affect customers’ rights during business as usual and in the event of a default of the DPT service provider or the safeguarding person;

the financial condition, expertise and market reputation of the safeguarding person, and the extent to which the safeguarding person has put in place the measures set out in Regulation 18G of the PS Regs and risk management controls set out in paragraph 3.4 of these Guidelines;

c) protection (or lack thereof) attendant upon the regulatory status of the safeguarding person; and

d) the need for diversification and mitigation of risks, where appropriate, by placing customers’ assets with more than one safeguarding person.

A DPT service provider should also include the following in writing in the terms and conditions that would apply to the safeguarding person’s safeguarding of the customers’ assets: a)

the personnel from the DPT service provider who is authorised to provide instructions to the safeguarding person;

that the safeguarding person must hold and record the customers’ assets in accordance with the DPT service provider’s instructions, and the customers’ assets must be kept separate from any assets belonging to the safeguarding person;

c) that the safeguarding person must provide sufficient information to the DPT service provider on a timely basis as the DPT service provider may reasonably require to comply with its record-keeping obligations under any written law;

d) that the safeguarding person must not permit any withdrawal of the customers’ assets from

These considerations include, among others, the prevailing regulatory and legal status relating to the customers’ assets, and the use of certain technological methods (e.g., separate wallet addresses for each of the safeguarding person’s customers where a third-party safeguarding person is involved) to safeguard customers’ assets.

the trust account, except for delivery of the customers assets to the DPT service provider or to any other person upon receipt of the DPT service provider’s written instructions; e)

the extent of the safeguarding person’s liability in the event of any loss of the customers’ assets maintained in the trust account caused by fraud or negligence on the part of the safeguarding person or any of the safeguarding person’s agents; and

f) the applicable fees and costs for the safeguarding of the customers’ assets.

3.3.3 A DPT service provider should, before depositing its customer’s assets in a trust account maintained with a safeguarding person, disclose to the customer the terms and conditions agreed with the safeguarding person (further described in paragraph 3.5.1 below).

3.3.4 Where a DPT service provider maintains the trust account with a safeguarding person outside Singapore7, the DPT service provider should disclose in writing to its customer – a)

the fact that the laws and practices relating to trust accounts in the jurisdiction under which the safeguarding person is licensed, registered or authorised may be different from the laws and practices in Singapore relating to trust accounts; and

the fact that any such differences may affect the ability of the customer to recover the customer’s assets deposited in the trust account.

3.4 Risk management controls

3.4.1 A DPT service provider should put in place adequate risk management systems and controls to safeguard customers’ assets. These systems should be managed by senior managers who have the requisite expertise, experience and authority to oversee, operate and maintain the systems, as well as manage technology risks.

3.4.2 A DPT service provider should ensure that the systems and controls mentioned in paragraph 3.4.1 at the minimum: a)

restrict any individual from being able to solely authorise and effect the movement, transfer or withdrawal of customers’ assets;

control the movement or transfer of customers’ assets between the DPT service provider’s

This is permissible provided that the DPT service provider is satisfied that the safeguarding person meets the standards set out in the PS Regs and these Guidelines on the safeguarding of customers’ assets.

storage systems and devices; and c)

prevent unauthorised access to or loss of the DPT instruments associated with the customers’ assets that are held or managed by the DPT service provider.

3.4.3 In managing the technology risks associated with the safeguarding of customers’ assets, a DPT service provider should refer to the guidance set out in the Technology Risk Management Guidelines, and apply the principles of “never alone”, “segregation of duties”, and “least privilege” mentioned in paragraph 9.1.1 of the Technology Risk Management Guidelines.

3.4.4 A DPT service provider should ensure that the DPT instruments relating to at least 90% of customers’ assets (which have been deposited in trust account(s)) are stored at all times in systems that are not connected to the Internet or any other form of wireless communication (“cold wallets”) (see Illustration 2).

A DPT service provider should conduct periodic reviews and consider keeping a higher than 90% proportion of customers’ assets in cold wallets, while taking into account their business and operational needs and other security controls that can mitigate the risk of loss of customers’ assets.

3.4.5 A DPT service provider should put in place controls to secure the storage and transmission of customers’ assets.For example, if a DPT service provider stores the means of access (e.g., the DPT instruments) to customers’ assets in a physical device (e.g., a computing device), the device should be secured (e.g., through restricted access) to mitigate the risk of loss of customers’ assets.

If a DPT service provider uses multi-party computation for the storage and transmission of customers’ assets, the key shares should be held by different parties and no one party should be able to authorise and effect the movement of customers’ assets (e.g., if there are 3 key shares, 2 out of 3 parties holding the key shares should be required to authorise a transaction).

3.4.6 A DPT service provider should disclose to customers its policy on storage arrangements for customers’ assets, including information on the circumstances under which the DPT service provider keeps the customers’ assets in systems that are not cold wallets, the DPT service provider’s considerations for doing so, and the measures that the DPT service provider has put in place to mitigate the risk of loss of the customers’ assets due to cyber attacks.

The DPT service provider should provide disclosures that are accurate and not false or misleading to enable each customer to make an informed decision about having its assets safeguarded by the DPT service provider.

3.4.7 A DPT service provider should disclose in writing to customers its processes for handling any losses of customers’ assets arising from fraud or negligence on the part of the DPT service provider. These can include having a compensation framework, specifying the type of losses 16

covered, the steps that a customer should take when such losses arise, the investigation or resolution process of the DPT service provider and if insurance is provided, the scope of coverage and the claims process.

The customers of the DPT service provider should be able to access such information easily, for instance such information may be provided on the public-facing platform of the DPT service provider such as the FAQ section of its website or app, or upon request by its customers.3.4.8

To mitigate the risk of dissipation of customers’ assets, a DPT service provider should put in place robust and effective measures to ensure that the senior managers and personnel who control the movement of customers’ assets are resident in Singapore (see Illustration 3).8 These senior managers and personnel should have the capability, knowledge, experience, and authority to facilitate the return of customers’ assets where required by MAS or in court proceedings.

3.4.9 Where the customers’ assets are stored in devices located outside of Singapore, the movement of customers’ assets should remain controlled by senior managers and personnel who are resident in Singapore.The senior managers of a DPT service provider in Singapore are ultimately responsible and accountable for the operations of the DPT service provider in Singapore.

A DPT service provider should also clearly disclose to its customers the fact that the customers’ assets are stored in devices located in a foreign jurisdiction, the fact that the laws and practices in the foreign jurisdiction may be different from the laws and practices in Singapore, and the fact that any such differences may affect the ability of customers to recover the customers’ assets (such as a prolonged delay in the recovery process).

3.5 Disclosures to customers

3.5.1 The terms and conditions that a DPT service provider discloses to a customer, before depositing the assets belonging to the customer in the trust account, should include — a)

the arrangements for the giving and receiving of instructions by or on behalf of the customer in respect of the DPT service including, where applicable, the arrangements for the giving of authority by the customer to another person and the extent of that authority and any limitation thereto;

the circumstances under which the DPT service provider may realise the assets held as collateral to meet the customer’s liabilities to the DPT service provider;

c) where the assets belonging to the customer are to be held with a safeguarding person, the

Where a DPT service provider maintains the trust account with a safeguarding person, the DPT service provider should be satisfied that the safeguarding person meets this expectation, in determining the suitability of the safeguarding person.

liability of the DPT service provider in the event of default by the safeguarding person; d)

where the DPT service provider intends to commingle the assets belonging to the customer with those of other customers and maintain such assets with a safeguarding person, a statement that the customer’s interest in the assets may not be identifiable by separate physical documents or electronic records, and a condition that the DPT service provider must maintain records of the customer’s interest in the assets that have been commingled;

e) the arrangements in relation to claiming and receiving entitlements accruing to the customer, and the exercise of any right and power arising from ownership of the assets belonging to the customer;

f) the arrangements for the provision of information to the customer relating to the safeguarding of the assets belonging to the customer; and

g) all applicable fees and costs for the safeguarding of the assets belonging to the customer.

3.5.2 A DPT service provider should make available the written disclosures mentioned in paragraph 3.5.1 on its public-facing platform (e.g., under the FAQ section of its website or app, or upon request by its customers).

3.6 Statement of account

3.6.1 Subject to paragraph 3.6.2, a DPT service provider should, on a monthly basis, furnish to each customer a statement of account containing, where applicable, the following particulars9: a)

transactions to purchase or sell assets entered into by the customer and the price at which the transactions are entered into;

the status of every asset in the DPT service provider’s custody held for the customer, including any asset deposited with a safeguarding person;

c) the movement of every asset of the customer, the date of and reasons for such movement, and the amount of the asset involved;

d) the movement and balance of relevant money received from, or on account of, the

This is in addition to the requirement under paragraph 9 of MAS Notice PSN07 for a DPT service provider to issue a receipt containing the information set out in Annex B of MAS Notice PSN07 for every transaction it accepts, processes, or executes to a customer in accordance with the circumstances specified in paragraph 9.

customer in respect of the provision of a DPT service; and e)

3.6.2 a detailed account of all financial charges and credits to the customer’s account during the monthly statement period, unless the detailed account of financial charges and credits has been included in any contract note or tax invoice issued by the DPT service provider to the customer.

Paragraph 3.6.1 does not apply where — a)

there is no change to any of those particulars since the date on which the last statement of account was made up to;

the DPT service provider has made available to the customer, on a real-time basis, those particulars in the form of electronic records stored on an electronic facility and the customer has consented to those particulars being made available to him in this manner; or

c) the customer has requested, in writing, not to receive the statement of account on a monthly basis from the DPT service provider.

3.6.3 Despite paragraph 3.6.2, where the DPT service provider receives a request from a customer for the statement of account (current and/or historical), the DPT service provider should provide the customer with the requested statement of account(s) as soon as practicable.

3.7 Additional considerations for retail customers’ assets

3.7.1 A DPT service provider should not entice a retail customer, or carry out any transaction on behalf of a retail customer that allows the retail customer, to:

3.7.2 a)

mortgage, charge, pledge or hypothecate any assets belonging to the retail customer;

lend, or arrange to lend, any assets belonging to the retail customer; or

c) stake, or arrange to stake, any assets belonging to the retail customer.

A DPT service provider should, prior to carrying out any transaction mentioned in paragraph 3.7.1 on behalf of a customer who is not a retail customer, provide clear written disclosures of the risks of such transactions to the customer and obtain the customer’s written acknowledgment of the risks.

3.7.3 An arrangement to “stake” the assets of a customer includes, but is not limited to, any arrangement under which the assets of the customer are locked as collateral in smart contracts (including in connection with the validating of transactions on a blockchain network) and from which the customer is entitled to receive fees, rewards, or returns.

3.7.4 To avoid doubt, the transfer by a DPT service provider of assets belonging to a customer to a DPT account specified by the customer does not constitute an arrangement to lend or stake the customer’s assets by the DPT service provider mentioned in paragraph 3.7.1(c).

CONSUMER ACCESS MEASURES

4.1 Introduction

4.1.1 This Chapter provides guidance on consumer access measures that a DPT service provider should implement in relation to its dealings with all retail customers10. These measures aim to provide retail customers with an appropriate level of risk awareness before a DPT service provider provides any DPT service to a retail customer.

4.2 Risk Awareness Assessment

4.2.1 A DPT service provider should provide a retail customer with information on the risks of the DPT services that it provides to the retail customer 11 .In addition, a DPT service provider should conduct a risk awareness assessment (including but not limited to the risk areas set out in paragraph 4.2.

2) (“Risk Awareness Assessment”) to assess whether a retail customer, who is an individual, has sufficient knowledge of the risks of such DPT services before providing those DPT services to the retail customer.The DPT service provider should inform the retail customer of the outcome of the Risk Awareness Assessment.

4.2.2 Retail customers who have insufficient knowledge of the risks of DPT services may unintentionally take on risks, which could result in losses that they do not have the financial resources to bear.A DPT service provider should thus ensure that the Risk Awareness Assessment it administers is appropriate12 and relevant to the nature and type of DPT services that it provides to such retail customers.

The DPT service provider should update the Risk Awareness Assessment where appropriate to reflect changes in risks due to developments in the industry and any material changes in the DPT services it provides 13 .The Risk Awareness Assessment should include all of the relevant risk areas, including but not limited to the following: a)

prices of DPTs are highly volatile and subject to sharp fluctuations, including the possibility of a total loss of value;

To avoid doubt, the consumer access measures apply to all retail customers, regardless of the customer’s residency.To avoid doubt, the objective of providing such information is to provide greater transparency to retail customers and should not be seen as allowing DPT service providers to discharge any obligations or liabilities which it owes or may owe to a retail customer.

12 For example, where appropriate and relevant, assessments need not be limited to the use of multiple-choice questions, or educational materials may be interspersed with the assessment questions during the assessment.

13 To avoid doubt, in a situation where the DPT service provider intends to offer a new DPT service, which is in addition to the existing DPT services it provides, the DPT service provider should assess whether retail customers have sufficient knowledge of the risks of the new DPT service before providing that new DPT service to retail customers.11

customers may have difficulty selling their DPTs due to illiquid market conditions, system outages or other operational risks (for example, cyber-attacks);

c) customers may lose their DPTs in the event of fraud, theft, sabotage or technological/operational issues (for example, loss of private keys or cyber-attacks);

d) risks associated with the custody of customers’ assets14 by the DPT service provider or the safeguarding person;

e) business conduct risks arising from different combination(s) of DPT trading activities conducted by the DPT service provider (for example, conflicts of interest); and

f) additional risks of dealing with any person, that is incorporated outside of Singapore, not regulated by any financial regulatory authority, and who provides any DPT services to customers from outside Singapore (for example, heightened risks of fraud or malfeasance given a lack of regulatory oversight, and challenges in seeking recourse).

4.2.3 DPT service providers should conduct the Risk Awareness Assessment in a manner that ensures that the risks of DPT services are brought to the attention of retail customers, and not trivialise them.Where a retail customer is assessed to not possess sufficient knowledge of the risks of DPT services, the DPT service provider should not provide any DPT service to that retail customer.

In such instances, the DPT service provider may conduct a re-assessment after explaining the relevant and potential risks to that retail customer.For example, the DPT service provider may direct such retail customers to, or provide them with, reliable educational information 15 that explains the nature of the services that are provided by the DPT service provider, and the associated risks involved in those activities.

To avoid doubt, the DPT service provider may choose not to conduct a re-assessment for a particular retail customer, and if so, the DPT service provider should not provide any DPT services to that retail customer.

4.2.4 A DPT service provider should put in place adequate written policies and procedures to ensure that the content of the Risk Awareness Assessment is relevant and kept current, and that the Risk Awareness Assessment is conducted in a fair and robust manner. The policies and

These may include the following risks: (i) where the customers’ assets will be deposited and commingled with assets belonging to other customers of the DPT service provider or of the safeguarding person, the risks arising from such commingling, and the risks related to the adequacy of the measures put in place by the DPT service provider to secure the storage and transmission of customers’ assets, and (ii) any differences between the laws and practices relating to the provision of custodial services in the jurisdiction where the safeguarding person may be providing the custodial services (whether licensed, registered, authorised, or unregulated) with the laws and practices in Singapore relating to the provision of custodial services.

15 These may include relevant publications by MAS or MoneySense.

procedures should provide, among others, that: a)

the risks covered in the Risk Awareness Assessment are clear, appropriate and relevant to the DPT services provided by the DPT service provider;

the questions in the Risk Awareness Assessment are not posed in a manner that trivialises the risks associated with DPT services, or promotes specific DPTs or DPT services;

c) there is a sufficiently diverse question bank for the Risk Awareness Assessment, and a system to generate different questions when conducting re-assessments of a retail customer; and

d) there is proper governance in reviewing and updating the Risk Awareness Assessment, taking into account new emerging risks associated with the DPT services that the DPT service provider provides, and assessing if an existing retail customer should be required to undertake the updated Risk Awareness Assessment, or any part thereof.

4.2.5 Subject to paragraph 4.2.6, a DPT service provider should, prior to the effective date of Chapter 4 of these Guidelines (as specified in paragraph 1.2.1), conduct the Risk Awareness Assessment on all existing retail customers before providing, or continuing to provide, DPT services to the existing retail customers.

4.2.6 Where a DPT service provider has not conducted the Risk Awareness Assessment on an existing retail customer, the DPT service provider may only provide DPT services to the existing retail customer if: a)

it is on the instructions of the existing retail customer;

the DPT service(s) provided reduces the amount of DPTs in the existing retail customer’s DPT account as of the effective date of Chapter 4 of these Guidelines (as specified in paragraph 1.2.1); and

c) the DPT service(s) provided is/are any of the following: i)

selling of DPTs in the existing retail customer’s DPT account in exchange for fiat currency; or

ii)

transmitting of DPTs from the existing retail customer’s DPT account to another DPT account that is not maintained with the DPT service provider. 23

4.3 Restrictions on offering incentives

4.3.1 The provision of any incentive or gift by a DPT service provider may unduly influence the decision of a retail customer to engage in DPT services, without fully considering the risks involved.

4.3.2 A DPT service provider should not offer any incentive: a)

to entice any retail customer to engage the DPT services provided by the DPT service provider; or

to any person (e.g., existing customers or celebrities) to promote and/or refer the DPT service provider’s DPT services to any prospective or existing retail customer.

4.3.3 Whether a benefit constitutes an incentive or gift would depend on the specific circumstances of each case.A DPT service provider should carefully assess and ensure that any benefit offered to its retail customers, and the circumstances under which such benefit is provided, does not contravene paragraphs 4.3.1 and 4.3.2.

Examples of such incentives include benefits to incentivise sign-ups, referrals and trading, as well as benefits offered through “learn and earn” programmes (see Illustrations 4, 5 and 6).

4.3.4 There may be cases of benefits given or accrued to customers which were not initiated or offered by the DPT service provider.

Such benefits, if merely intermediated by the DPT service provider, would generally not be considered an incentive provided by the DPT service provider, because the DPT service provider has limited or no control over the benefit that is conferred to holders of the DPT, other than to onward distribute the benefits to its customers as holders of the DPT.

An example of a benefit which would generally not be considered an incentive is where the issuer of a DPT that is also not the DPT service provider distributes benefits to all holders of that DPT through air drops.

4.4 Restrictions on credit and leverage

4.4.1 As prices of DPTs are highly volatile, the use of any form of credit, leverage, or instrument (for example, derivatives contracts that reference DPT(s) as underlying assets16 (“DPT Derivatives Contracts”)) may lead to magnification of losses and could cause a retail customer to lose more than the whole amount originally put in by the retail customer. Therefore, a DPT service provider should not:

This includes contracts-for-differences and future contracts. This is consistent with the Guidelines on Provision of Digital Payment Token Services to the Public (PS-G02) at Section 4.

a) provide any credit facility, or loan of DPTs, to a retail customer to facilitate the retail customer’s purchase or continued holdings of DPTs;

enter into any leveraged DPT transaction17 with a retail customer;

c) facilitate or induce a retail customer to enter into any leveraged DPT transaction with any other person;

d) enter into any DPT Derivatives Contracts with a retail customer18;

e) facilitate or induce a retail customer to enter into any DPT Derivatives Contracts; or

f) in connection with the provision of any DPT service to a retail customer, accept any payments made by such retail customer using a credit card or charge card which is issued by a bank or a person licensed to carry on the business of issuing credit cards or charge cards in Singapore under section 57B of the Banking Act 1970 19.

4.4.2 These Guidelines acknowledge that section 20(1) of the PS Act prohibits licensees from carrying on a business of granting of credit facilities to individuals in Singapore. To avoid doubt, the expectations in paragraph 4.4.1 do not override the existing prohibition in section 20(1) of the PS Act20 and instead applies in addition to section 20(1) of the PS Act.

4.4.3 Subject to paragraph 4.4.4, paragraph 4.4.1 shall apply to all transactions on or after the effective date of Chapter 4, as specified in paragraph 1.2.1, of these Guidelines.

4.4.4 For leveraged DPT transactions and DPT Derivatives Contracts, which were entered into prior to the effective date of Chapter 4 of the Guidelines (“existing positions”), a DPT service provider may allow a retail customer to hold on to existing positions, but should not facilitate any alteration of the existing positions, unless it is to exit or terminate the existing positions.

For example, leveraged DPT transactions includes trading of DPTs on margin.In addition, DPT services providers should refer to section 4 of the Guidelines on Provision of Digital Payment Token Services to the Public (PS-G02) (link) in relation to the provision of services related to DPT Derivatives Contracts.

19 As an example, DPT service providers should not accept such credit card or charge card payments from retail customers to top-up accounts held with the DPT service provider, which may then be used to purchase DPTs.20 Section 20(1) of the PS Act provides that a licensee under the PS Act must not carry on a business of granting any credit facility to any individual in Singapore.18

CONFLICTS OF INTEREST

5.1 Introduction

5.1.1 This Chapter provides guidance on how a DPT service provider should identify and mitigate conflicts of interest, as well as the specific mitigating measures based on the DPT services or DPT trading activities it conducts. The guidance takes into consideration existing legislation in conventional capital markets, and regulatory proposals introduced in other jurisdictions.

5.2 Identification and mitigation of conflicts of interest

5.2.1 A DPT service provider should, in a manner that is commensurate with the nature, scale and complexity of its business, establish and implement effective written policies and procedures to identify, manage and mitigate any potential or actual conflicts of interest that may arise in the course of providing a DPT service to its customers (“Conflicts of Interest Policies and Procedures”).

5.2.2 To mitigate the risk of conflict between its duties relating to the customer and the DPT service provider’s business interests or interests of its personnel, a DPT service provider should refer to the guidance set out in paragraphs 2.4.1 to 2.4.3 of the Guidelines on Risk Management Practices – Internal Controls.

5.2.3 A DPT service provider should put in place mechanisms to monitor the effectiveness of the Conflicts of Interest Policies and Procedures (“Monitoring Mechanisms”).The board of directors and/or senior managers of the DPT service provider should approve and review the effectiveness of the Conflicts of Interest Policies and Procedures and Monitoring Mechanisms on a periodic basis, or at least annually.

An example of a Monitoring Mechanism is an incident reporting framework to highlight to the board of directors and/or senior managers any areas/issues pertaining to the effectiveness of the Conflicts of Interest Policies and Procedures.

5.2.4 A DPT service provider should: a)

put in place proper checks and balances with periodic reviews to assess the effectiveness of the overall risk management framework, including prior to the provision of any new DPT service(s) or activities;

ensure adequate segregation of duties to guard against the risk of unauthorised transactions, fraudulent activities and manipulation of data about the DPT service provider’s customers for personal gain, or for concealment of irregularities or financial 26

losses; and c)

5.2.5 5.2.6

conduct periodic reviews of the responsibilities of personnel responsible and accountable for their respective functions, to mitigate the risk of conflicts of interest identified, and ensure that there are independent checks for proper segregation of duties to mitigate any potential or actual conflicts of interest.

A DPT service provider should also clearly explain and disclose21 to each customer, in its terms and conditions, all potential or actual conflicts of interest that may arise in the course of providing a DPT service to its customers, and the relevant measures and controls that the DPT service provider has put in place to mitigate these conflicts of interest. The disclosures should include, but are not limited to: a)

the DPT services or business practices of the DPT service provider that give rise to, or which may give rise to, any potential or actual conflicts of interest;

the nature of the conflicts of interest identified;

c) the risks associated with the conflicts of interest identified;

d) the steps and measures taken to prevent or mitigate the identified conflicts of interest; and

e) the residual risks of conflicts of interest which cannot be prevented or mitigated by any steps or measures mentioned in sub-paragraph (d) above.

The disclosures described in paragraph 5.2.5 should be sufficiently detailed, specific and clear, to enable the customer to assess whether and how the conflicts of interest described could impact the customer’s interest, whether these risks have been appropriately mitigated by the measures taken by the DPT service provider, and whether to proceed or continue to deal with the DPT service provider.

Where there are material changes to the business model of the DPT service provider or to the DPT services provided by the DPT service provider and sources of conflicts of interest, the DPT service provider should update these disclosures in paragraph 5.2.5 and inform the customer on a timely basis.

To avoid doubt, the objective of providing such information is to provide greater transparency to customers and should not be seen as allowing DPT service providers to discharge any obligations or liabilities to its customers.

5.3 Safeguarding personnel for customers’ assets

5.3.1 A DPT service provider which safeguards customers’ assets should put in place effective controls to mitigate any conflicts of interest that may arise between the personnel responsible and accountable for safeguarding customers’ assets (“safeguarding personnel”), and the duties of personnel who make investment decisions, trading decisions or other discretionary decisions resulting in the transfer or disposal of customers’ assets.

5.3.2 A DPT service provider which safeguards customers’ assets should put in place clear reporting lines for safeguarding personnel, up to a senior manager who is resident in Singapore.The safeguarding personnel should not be able to make investment decisions, trading decisions or other discretionary decisions resulting in the transfer or disposal of customers’ assets.

A DPT service provider should have arrangements that ensure that safeguarding personnel have direct access and reporting channels to the board of directors and senior managers of the DPT service provider, on matters relating to the safeguarding of customers’ assets.

5.4 Vertical integration of DPT trading activities

5.4.1 It has been observed that some DPT service providers operate vertically integrated business models by conducting multiple types of DPT trading activities through a single legal entity, or through an affiliated group of entities that is part of a wider group structure.A DPT service provider that operates such vertically integrated business models may give rise to serious conflicts of interest which can lead to significant consumer harm.For the purposes of sections 5.

4 and 5.5, Illustrations 7 to 9 set out examples of what constitutes “operates a market”, “acts as a broker or agent” and “conducts an OTC business from its own account”.

5.4.2 The table below sets out three possible combinations of DPT trading activities, as well as the corresponding potential consumer harm: Combination Types of DPT trading activities conducted

Potential consumer harm

The DPT service provider may not be acting in its customer’s best interests. For example, the DPT service provider may place orders on the market it operates, instead of sourcing for the best price to fulfil an order for its customer.

A DPT service provider operates a market and also acts as a broker or agent on the market that it operates.

5.4.3 A DPT service provider operates a market and also conducts an over-the-counter (“OTC”) business from its own account on the market that it operates.

The DPT service provider has significant opportunity and incentive to misuse information related to its customers’ orders (e.g., front-running which may result in less favourable terms for its customers).

A DPT service provider acts as a broker or agent and also conducts an OTC business from its own account.

The DPT service provider is susceptible to unfair trading practices, such as frontrunning of its customer’s orders.

Depending on the combination of DPT trading activities conducted by a DPT service provider as described in paragraph 5.4.2, the DPT service provider should put in place specific mitigating measures set out in paragraphs 5.4.4 to 5.4.9, and clearly disclose the role and capacity that it is acting in when conducting those activities for its customers.To avoid doubt, the DPT service provider should also put in place the measures set out in paragraphs 5.2.1 to 5.2.6.

Combination 1 – DPT service provider operates a market and also acts as a broker or agent on the market that it operates

5.4.4 A DPT service provider should not operate a market and also act as a broker or agent in the same legal entity. Should the DPT service provider decide to conduct, or continue to conduct, these two trading activities via separate legal entities, each legal entity should have appropriate controls22, including separate employees and management teams.

5.4.5 A DPT service provider which operates a market should minimally:

5.4.6 a)

ensure that any related corporation can only participate on its market as a broker or agent; and

put in place procedures to restrict the access of customer information by, and prevent the disclosure of customer information to, any other entity.

A DPT service provider which operates a market should ensure that all its market participants,

The DPT service provider should include controls ensuring that: (a) an employee of the legal entity operating a market should not be employed by the separate legal entity acting as a broker or agent, and vice versa;(b) an employee of the legal entity operating a market should not be seated in the same room with an employee in the separate legal entity acting as a broker or agent;

and (c) customer orders are kept confidential to the appropriate employees on a strict need-to-know basis.

including any related corporation that acts as a broker or agent on the market that it operates, are treated fairly and subject to the same rules of participation which may be set out in its terms and conditions.

The DPT service provider should establish a disciplinary process for any breach of such rules of participation, stipulating that the final decision pertaining to any disciplinary process towards that related corporation be taken by person(s) assessed by the DPT service provider to be independent of the related corporation.Combination 2 – DPT service provider operates a market and also conducts an OTC business from its own account on the market that it operates 5.4.7

A DPT service provider which operates a market should not conduct an OTC business from its own account on the market that it operates, unless for the purposes of settling off-market or off-platform back-to-back transactions23.

5.4.8 A DPT service provider which operates a market may be part of a wider group structure that operates globally.Because of the potential consumer harms set out in paragraph 5.4.2, a DPT service provider which operates a market should not allow any related corporation to conduct an OTC business from its own account on the market that the DPT service provider operates.

Combination 3 – DPT service provider acts as a broker or agent and also conducts an OTC business from its own account

5.4.9 A DPT service provider which acts as a broker or agent and also conducts an OTC business from its own account should implement adequate policies and procedures with effective controls in order to distinctly segregate the function that is acting as a broker or agent from the function that is conducting an OTC business from its own account (“functional segregation”).

Such policies and procedures to achieve functional segregation should include independent governance structures and separate reporting lines for the employees whose duties or functions pertain to the DPT service provider’s business of acting as a broker or agent, and the employees whose duties or functions pertain to conducting an OTC business from the DPT service provider’s own account, alongside effective controls, for example, through the use of information barriers24.

This is otherwise referred to as “matched principal trading” in paragraph 3.4 of the consultation response paper (link here).This refers to a transaction whereby a DPT service provider operating a market interposes itself between the buyer and seller to the transaction in such a way that the DPT service provider is never itself exposed to market risk throughout the execution of the transaction.

Both sides of the transaction are executed simultaneously, and the transaction is concluded at a price where the DPT service provider makes no profit or loss, other than a previously disclosed commission, fees or charge for the transaction.

24 The DPT service provider should include controls ensuring that: (a) an employee whose duties or functions pertain to the DPT service provider’s business of acting as broker or agent (“employees in broker or agent business”) is not involved in the

5.5 Issuing own or related tokens

5.5.1 MAS has observed that a DPT service provider may offer DPTs issued by itself (“own tokens”) and/or DPTs25 issued by related corporation(s) of the DPT service provider (“related tokens”) for trading with its customers. This presents significant conflicts of interest because the DPT service provider would have the means and incentive to influence the value and activities relating to these tokens (e.g., pump-and-dump).

5.5.2 A DPT service provider referred to in paragraph 5.5.1 should implement control measures with effective monitoring mechanisms on activities relating to own tokens or related tokens, including but not limited to, surveillance on its employees responsible for dealing in such tokens, monitoring unusual trade volumes (e.g., a spike) or activities in those tokens, and other new potential areas of conflicts of interest (e.g.

, with other DPT services that it may provide) that should be addressed on a timely basis.

5.5.3 In addition, the DPT service provider should clearly explain and disclose to customers the relevant areas of concerns, including: a)

the nature of the conflicts of interest arising from own token listing and/or related token listing;

the risks associated with the conflicts of interest to the customer arising from own token listing and/or related token listing;

c) the steps and measures taken to prevent or mitigate the identified conflicts of interest, including whether there is any form of segregation between the DPT service provider’s surveillance function and its function(s) whose duties and responsibilities pertain to the DPT service provider’s business of operating a market, acting as a broker or agent, or conducting an OTC business from its own account, as the case may be; and

d) at the point of listing a DPT, whether the DPT service provider has any proprietary holdings of that DPT26.

duties or functions pertaining to the DPT service provider’s conduct of OTC business from its own account (“employees in OTC business from own account”), and vice versa;(b) the employees in broker or agent business are not seated in the same room as the employees in OTC business from own account;and (c) customer orders are kept confidential to appropriate employees on a strict need-to-know basis.

25 MAS intends to amend these Guidelines to reflect its policy intent to include MAS-regulated stablecoins, after the amendments to the PS Act in relation to MAS’ regulatory approach for stablecoin-related activities have come into effect.26 A DPT service provider may also consider further disclosures, such as the quantum or size of such proprietary holdings, and provide suitable frequency of periodic updates of the same following the listing of that DPT.

OTHER BUSINESS CONDUCT MEASURES

6.1 Introduction

6.1.1 This Chapter provides further guidance on how a DPT service provider should conduct their business in other key areas of concern, taking into consideration industry best practices, existing legislation in conventional capital markets, as well as regulatory proposals introduced in other jurisdictions.

6.2 DPT listing and governance policies

6.2.1 A DPT service provider is accountable and responsible for its choice of DPTs which it intends to provide DPT services for. In this regard, greater clarity and transparency on the listing and governance policies and procedures by which a DPT service provider evaluates which DPTs to support, in the context of providing DPT services, would allow its customers to make more informed assessments of the robustness and rigour of these policies and procedures.

6.2.2 A DPT service provider should publish its policies and procedures related to how it evaluates the DPTs which it chooses to provide, or continues to provide, in a clear, easily understood and suitably concise manner.This will provide customers with clear and relevant information on the DPT service provider’s policies and procedures used to: (i) evaluate prospective DPTs that they intend to support;(ii) conduct periodic reviews on listed or supported DPTs;

and (iii) suspend, delist, or cease support for DPTs.

6.2.3 A DPT service provider should ensure that its published DPT listing and governance policies and procedures mentioned in paragraph 6.2.2 address the following where the DPT service provider has assessed to be relevant to their business of providing DPT services: a)

the criteria, due diligence and processes applied by the DPT service provider, and fees received (if any) by the DPT service provider to provide DPT services for DPTs27;

the conditions under which the DPT service provider may continue to provide DPT services, (such as trading of DPTs), or suspend, delist or cease to support for DPTs28;

This may include, but is not limited to, evaluating the founding team/developers, governance model, track record, market capitalisation, liquidity, volatility, legal characterisation, reputational status, enforcement of any rights extrinsic to the DPT (e.g., any rights to the underlying assets of the DPT), cybersecurity as well as the technical aspects of the underlying network (e.g., consensus mechanisms).

28 This may include, but is not limited to, the frequency of periodic reviews of listed or supported DPTs and/or criteria (e.g., liquidity thresholds) that leads the DPT service provider to suspend, delist or cease support for a DPT.

c) the processes by which the DPT service provider suspends, delists or ceases support for DPTs, and the rights/options available to customers in the event of the occurrence of such circumstances29;

d) how risks of unfair or disorderly trading of DPTs are addressed by the DPT service provider30; and

e) the settlement procedures of DPT transactions31.

6.2.4 A DPT service provider should consider whether any potential or actual conflict of interest may arise where it receives incentives (e.g., commission rebates) to provide DPT services in respect of certain DPTs.

This is because such incentives may unduly influence the DPT service provider’s commercial decisions to support or list certain DPTs when providing DPT services to customers, and may potentially interfere, or appear to interfere, with the independence and effectiveness of its DPT listing and governance policies and procedures.As part of the policies and procedures set out under paragraph a), the DPT service provider should consider and implement appropriate measures (e.g.

, customer disclosures, segregation of functions) to address such conflicts of interest.

6.2.5 The senior managers of a DPT service provider are ultimately responsible for the DPT listing and governance policies of the DPT service provider.Senior managers should exercise control and oversight over all DPT listing and governance decisions pertaining to the DPT services that the DPT service provider provides, or continues to provide, DPT services for.

This could be implemented through official committees comprising of key senior managers, business heads and/or subject matter experts, in areas such as regulatory compliance, and anti-money laundering and combating the financing of terrorism (AML/CFT).The senior managers are also ultimately accountable and responsible for any use of third-party outsourcing arrangements as part of its DPT listing and governance policies and procedures.

6.2.6 The DPT service provider should publish its DPT listing and governance policies and procedures in an objective manner which does not endorse, or appear to endorse, any specific DPT. For instance, while the DPT service provider may choose to include information regarding the risks related to certain DPTs made available for trading, it should not make available forward-looking

This may include, but is not limited to, matters related to the timeliness of informing customers of trading halts and the reasons for doing so, means for customers to request to withdraw their DPTs should there be a trading suspension, delisting, or cessation of support for a DPT, and the conditions under which the DPT service provider may unilaterally take action (e.g., sale, transfer of suspended/delisted/unsupported tokens) with regard to the DPT services offered.

30 This may include, but is not limited to, trading rules, mechanisms, or processes that ensure fair and orderly trading of DPTs.31 This may include, but is not limited to, the procedures to settle DPT transactions (whether off-chain or on-chain), finality of transactions, and arrangements to deal with settlement failures for trades executed on its platform.

price expectations that entice customers to favour the trading of certain DPTs. 6.3

Complaints handling and dispute resolution

6.3.1 Customer complaints are important indicators of the problems that customers face with a DPT service provider. The monitoring of complaints enables the DPT service provider to take timely remedial measures to address those problems. The handling of customer complaints in an independent, prompt, and effective manner provides assurance to customers that their concerns are dealt with in a fair and timely manner.

6.3.2 A DPT service provider should establish and maintain effective policies and procedures to handle customer complaints, which should include, but are not limited to:

6.3.3 a)

establishing a process for handling and resolving complaints in a fair and timely manner;

providing for the assessment of the merits of each complaint, and the criteria for determining whether to refer a complaint to senior managers;

c) setting reasonable timeframes for handling and resolving complaints, including devoting sufficient resources to attend to and resolve customer complaints within its stipulated turnaround times, without compromising the quality of review32;

d) documenting the basis for each complaint and the outcome of the assessment properly;

e) where the DPT service provider’s final response states that the DPT service provider rejects the customer’s complaint, providing the customer with written reasons for the rejection of the complaint; and

f) ensuring that information on its process for handling and resolving complaints, including its point of contact and timeframe for handling and resolving complaints, is publicly available, clear, accurate, up-to-date, and can be easily accessed by any member of the public.

A DPT service provider should, at the minimum, apply the policies and procedures mentioned in paragraph 6.3.2 to complaints made by any retail customer of the DPT service provider that contains any allegation of any conduct which, if true, may constitute a contravention of any written laws or notices, or non-observance of any codes or guidelines concerning the conduct of

For complex complaints that may require more time to review, the DPT service provider should provide a written interim response, informing the customer of an indicative timeframe within which the customer may expect to receive a formal reply.

the business of providing any DPT service, or an unfair practice33 in relation to the DPT service provider’s provision of a DPT service. To avoid doubt, the DPT service provider may choose to apply these policies and procedures to its dealings with all customers. 6.3.4

To address potential conflicts of interest related to complaints handling, a DPT service provider should establish a complaints handling unit, comprising officers and employees who are not directly involved in providing any DPT service, to: a)

handle and resolve any complaint received by the DPT service provider; or

supervise the handling and resolution of any complaint received by the DPT service provider by a person who is not a member of the unit.

6.3.5 A DPT service provider should appoint a senior manager, or a committee of senior managers, who are not directly involved in the provision of any DPT service to oversee the complaints handling unit mentioned in paragraph 6.3.4.The senior manager, or committee of senior managers, should approve the complaints handling policies and procedures mentioned in paragraph 6.3.

2, and be responsible for the implementation and monitoring of adherence to these policies and procedures, and for the detection and remediation of any deficiencies in the same.

6.3.6 A DPT service provider should establish a system or arrangement to record, track and manage complaints received by the DPT service provider, including the details of the complaint, all correspondence relating to the complaint, all materials and information reviewed by the DPT service provider in relation to the complaint and the outcome of the complaint.

This will allow the DPT service provider to track complaints data, analyse the information to seek out root causes and rectify them promptly.Areas of interest may include a significant rise in complaints about a specific issue, service or feedback from a particular customer segment.The DPT service provider should incorporate lessons learnt into their policies and procedures on complaints handling.

6.3.7 A DPT service provider should not unduly restrict the rights of retail customers to reasonably seek legal recourse34.In this regard, a DPT service provider should resolve disputes with retail customers using any of the principal modes of dispute resolution available in Singapore, such as available alternative dispute resolution fora, mediation, arbitration and litigation in the Singapore courts.This is because retail customers would be disproportionally disadvantaged in

A DPT service provider may take reference from Part 2 of, and Second Schedule to, the Consumer Protection (Fair Trading) Act 2003 on examples of unfair practices. 34 An example is when the DPT service provider sets a condition that all disputes with its retail customers should be resolved in an overseas jurisdiction.

terms of ease of access and costs involved in seeking legal recourse, if recourse avenues are unreasonably limited and difficult to access or likely to become protracted (e.g., requiring arbitration in a foreign jurisdiction in the first instance).

ANNEX 1 – ILLUSTRATIONS 1

The case studies below illustrate how the Guidelines may apply. MAS emphasises that these case studies are for the purpose of illustration only. They are not indicative or conclusive of how the Guidelines will apply to a particular case.

DPT service providers are encouraged to seek professional advice from qualified legal practitioners to ensure that their proposed activities are in compliance with all applicable laws, rules and regulations in Singapore.When applying the law to each case, DPT service providers and their legal advisers should look beyond labels and examine the features and characteristics of each arrangement.A.

Safeguarding of customers’ assets Illustration 1 – Storing of customers’ assets across a group in the same set of blockchain addresses Description of the arrangement: A DPT service provider is a subsidiary of an international group and maintains the trust account with a foreign affiliate (“safeguarding affiliate”).The safeguarding affiliate also custodises customers’ assets from affiliates in other jurisdictions.

The customers’ assets from across the group are stored in the same set of blockchain addresses.No proprietary assets of the group are stored within those blockchain addresses.

The operational processes of this arrangement achieves the intent of the segregation requirements, by ensuring that customers’ assets and proprietary assets are not stored in the same blockchain addresses and the DPT service provider’s customers’ assets remain whole as though they are safeguarded by the service provider itself and the foreign affiliate maintains proper records on the DPT service provider’s customers’ assets and there is periodic reconciliation and reporting in place to ensure that the DPT service provider’s customers’ assets remain whole at all times.

To avoid doubt, the senior managers and personnel of the DPT service provider who control the movement of the customers’ assets of the digital payment service provider should be resident in Singapore.These senior managers and personnel should have the capability, knowledge, experience, and authority to facilitate the return of customers’ assets where required by MAS or in court proceedings.Please refer to illustration 3 below for details.

Illustration 2 – Storing customers’ assets in an offline device Description of the arrangement: A DPT service provider stores DPT instruments, such as private keys which enable the movement of customers’ assets out of the blockchain addresses designated for customers’ assets, in a hardware device that is not connected to the Internet or any other form of wireless communication (“offline device”).

To perform a transaction, the DPT service provider authorises (or “signs”) the transaction using the private keys in the offline device.The signed transaction is then relayed, using a portable storage medium, into another system that is connected to the internet (“online system”).The online system is then used to broadcast the signed transaction to the blockchain.

The arrangement is an example of storing private keys in systems that are not connected to the Internet or any other form of wireless communication.

Illustration 3 – Controlling the movement of customers’ assets Description of the arrangement: A DPT service provider maintains the trust account with a foreign affiliate (“safeguarding affiliate”).The safeguarding affiliate stores the customers’ assets in a blockchain address, and divides the DPT instrument, such as a private key, into multiple key shares, which are held in offline devices that are geographically distributed across multiple jurisdictions.

The DPT service provider should ensure that sufficient key shares are controlled by a senior manager of the DPT service provider who resides in Singapore such that a transaction of the customers’ assets cannot be effected without the authorisation of the senior manager residing in Singapore.The arrangement is an example of ensuring that the movement of customers’ assets is controlled by senior managers and personnel who reside in Singapore.

It is not necessary for the senior manager and personnel in Singapore to be able to perform the transaction on their own (i.e., without the use of other key shares for authorisation).

B.Restrictions on offering incentives Illustration 4 – Provision of benefits to prospective retail customers Description of the arrangement: A retail customer (“A”) applies a promotion code given by another retail customer (“B”) to open an account with the DPT service provider (an “Account”).

Upon A’s successful account opening of an Account, the DPT service provider deposits trading credits into A’s Account, which A may use to offset trading fees payable to the DPT service provider for the provision of a DPT service, including for the first DPT transaction that A may transact with the DPT service provider.The DPT service provider will also deposit DPTs into B’s trading account upon A’s successful account opening.

The provision of the benefit to A by the DPT service provider is considered to be a sign-up incentive.The provision of the benefits to B by the DPT service provider upon A’s successful opening of an Account is considered to be a referral incentive.Both benefits are subject to the restrictions in paragraph 4.3 of these Guidelines.

Illustration 5 – Provision of time-bounded benefits to certain retail customers Description of the arrangement: A DPT service provider deposits trading credits into the Account of a retail customer ("A”) for completing a certain number of DPT transactions in a given period of time.These trading credits may only be used to offset trading fees arising from A's subsequent DPT transaction(s) with the DPT service provider.

This benefit, which the DPT service provider communicates to selected retail customers, is only available for a limited period of time.The benefit (i.e.trading credits) is only available in some specific circumstances and is not available to all retail customers of the DPT service provider.This arrangement would be subject to the restrictions in paragraph 4.3 of these Guidelines.

Illustration 6 – Tiered pricing models of a DPT service provider Description of the arrangement: A DPT service provider charges a customer trading fees based on a percentage of the trade value of the DPT transactions carried out by the customer in a given month (“Trade Value”). If 39

the Trade Value exceeds certain thresholds in a given month, the DPT service provider will charge lower trading fees. The pricing model, which is disclosed on the website of the DPT service provider, applies to all retail customers, and is not intended or specified to be for a limited period of time. The arrangement would not be subject to the restrictions in paragraph 4.3 of these Guidelines.

C.Types of DPT trading activities Illustration 7 – Operating a market Description of the arrangement: A DPT service provider operates an electronic platform that enables its customers to place buy or sell orders involving the exchange of DPT for fiat currency or another DPT.Such a platform regularly facilitates centralised interaction of bids and offers of various customers (i.e., manyto-many basis), leading to price formation.

Settlement may be undertaken subsequently between the two customers of the DPT service provider directly.The arrangement is an example of a DPT service provider operating a market.

Illustration 8 – Acting as a broker or agent Description of the arrangement: A DPT service provider operates an electronic platform to provide DPT services to its customers to trade in DPTs.Such customers may place buy or sell orders involving the exchange of DPTs for fiat currency or another DPT with the DPT service provider through the electronic platform.

The electronic platform then transmits the customers’ orders, without alteration of the information contained, to be appropriately fulfilled and executed by another DPT service provider.The arrangement is an example of a DPT service provider acting as a broker or agent.

Illustration 9 – Conducting an OTC business from its own account Description of the arrangement: A DPT service provider operates an electronic platform to provide DPT services to its customers for them to trade in DPTs.The DPT service provider’s customers may place buy or sell orders involving the exchange of DPT for fiat currency or another DPT.

The DPT service provider would indicate a price at which it is prepared to fulfil such buy or sell orders of its customers (“the indicative price”).If there is a matching order, the DPT service provider will fulfil the order by executing it against its own inventory.The arrangement is an example of a DPT service provider which is conducting an OTC business from its own account.