Consultation on proposed regulatory measures for digital payment token services

CONSULTATION PAPER P008 - 2022 October 2022

Proposed Regulatory Measures for Digital Payment Token Services

Contents 1

Preface

1.1 This consultation paper sets out proposed regulatory measures for licensees and exempt payment service providers1 that carry on a business of providing a digital payment token (DPT) service under the Payment Services Act 2019 (“PS Act”) (collectively known as “DPT service providers” or DPTSPs).1.

2 Alongside this consultation paper, the Monetary Authority of Singapore (MAS) has also published a consultation paper on the proposed regulatory approach for stablecoinrelated activities.1.3

MAS invites interested parties to provide their comments and feedback.

Please note that all submissions received will be published and attributed to the respective respondents unless they expressly request MAS not to do so. As such, if respondents would like: (i)

their whole submission or part of it (but not their identity), or

(ii) their identity along with their whole submission, to be kept confidential, please expressly state so in the submission to MAS. MAS will only publish non-anonymous submissions. In addition, MAS reserves the right not to publish any submission received where MAS considers it not in the public interest to do so, such as where the submission appears to be libellous or offensive.

1.4 Please submit written comments through the link below by 21 December 2022: https://go.gov.sg/mas-cp-dpt-services-2022

1.5 Should you encounter any technical difficulties in your submission, please send your enquiry to capital_markets@mas.gov.sg.

These include persons who are currently operating under the transitional exemption as they have been providing DPT services before the commencement of the PS Act and have notified MAS pursuant to the Payment Services (Exemption for Specified Period) Regulations 2019. These entities are not licensed under the PS Act but are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.

Introduction Digital Asset Ecosystem and Cryptocurrencies

2.1 MAS seeks to develop an innovative and responsible digital asset ecosystem in Singapore.The innovative combination of tokenisation and distributed ledgers offers transformative economic potential, by allowing anything of value to be represented in digital form, fractionalised, and to be stored and exchanged on a ledger that keeps an immutable record of all transactions.

Many items can potentially be tokenised and traded such as financial assets like cash and bonds, real assets like artwork and property, and even intangible items like carbon credits and computing resources.This can potentially facilitate more efficient transactions, enhance financial inclusion, and unlock economic value.2.2 A digital asset ecosystem needs credible and reliable mediums of exchange to facilitate transactions.

MAS sees good potential for stablecoins to fulfil that role of a credible and reliable means of exchange, provided they are securely backed by high quality reserves and well regulated.MAS has proposed measures2 to enhance standards of stablecoin-related activities.2.3 However, support for a digital asset ecosystem does not mean support for cryptocurrency speculation.

Even though cryptocurrencies play a supporting role in the broader digital asset ecosystem, they are heavily speculated upon, with prices that are not associated with any underlying economic value.

Risks of Consumer Harm 2.4 MAS strongly discourages speculation in cryptocurrencies by consumers. Since 2017, MAS has consistently warned the public of the hazards of cryptocurrency speculation, including through joint advisories with the Singapore Police Force (SPF). (a)

Cryptocurrencies can be highly volatile as their prices are typically not related to any economic fundamentals and are hence highly risky and not suitable for consumers3. The recent cryptocurrency market turmoil saw the market capitalisation of cryptocurrencies falling from its peak of about US$3 trillion in November 2021 to less than US$1 trillion in July 2022. The collapse of several cryptocurrency firms also resulted in billions of dollars owed to customers.

See separate consultation paper on “Proposed Regulatory Approach for Stablecoin-Related Activities” published on 26 October 2022. 3

Answers by Mr Tharman Shanmugaratnam, Senior Minister and Minister in charge of MAS, in response to Parliamentary Questions filed on 5 February 2018, 5 April 2021, 10 May 2021, 4 July 2022 and 1 August 2022.

(b) Despite the high risks involved, cryptocurrencies continue to attract much speculative consumer interest.This is due in part to the saliency of alleged “success stories” of spectacular gains made over a short period of time, celebrity endorsements encouraging consumers to participate in the market, and playing on fears of missing out on good opportunities to make outsized returns.

These include taglines or phrases that trivialise the risks of DPT trading, and misleading claims4.A significant part of the public discourse, usually through promotional activities and social media posts by proponents, irresponsibly draws little attention to the inherent risks of DPTs.This has led to many consumers purchasing DPTs without having fully understood the risks involved.

For example, the “algorithmic stablecoin" TerraUSD, which purported to maintain its stability by allowing users to redeem TerraUSD for an associated token Luna, was reportedly represented as a potential savings option and marketed to consumers as such 5 .These consumers were misled into purchasing TerraUSD under the mistaken impression that TerraUSD was a safe “investment” and were promised returns of up to 20% per year, which were unsustainable.

(c) Due to the pseudonymous nature of transactions, cryptocurrencies also carry a higher risk of being misused for illicit purposes. Even when stolen cryptocurrencies are traced to a wrongdoer’s blockchain address, it is typically not possible to compel the return of the stolen cryptocurrencies. In particular, consumers risk losing their cryptocurrencies to: (i)

theft, which is mainly through security breaches where hackers gained access to victims’ private keys, as well as code exploits where smart contracts contained vulnerabilities which were exploited by the hackers6. In 2021, US$3.2 billion in cryptocurrencies were stolen. As of the time of writing, another US$3 billion in cryptocurrencies had been stolen in 20227. Earlier this year, around US$300 million were allegedly

For example, in relation to the claim ““£5 in #Bitcoin in 2010 would be worth over £100,000 in January 2021. Don’t miss out on the next decade”, the UK Advertising Standards Authority found that it implied there would be a similar guaranteed increase in Bitcoin value over the next decade and did not make clear that past performance was not necessarily a guide for the future. 5

The Straits Times, 25 September 2022. “More consumer safeguards and industry rules needed”.

Chainalysis, 2022. “The 2022 Crypto Crime Report”.

Bloomberg, 12 October 2022. “Crypto hackers set for record year after looting over $3 billion”.

misappropriated through unauthorised trades from a cryptocurrency trading platform8. (ii)

scams and frauds, where scammers had taken US$7.7 billion in cryptocurrencies from victims in 2021. In one case, customers of a foreign cryptocurrency trading platform, whose CEO disappeared soon after it halted withdrawals, lost access to more than US$2 billion of their cryptocurrencies. In Singapore, the number of police reports of cryptocurrency scams has increased sharply in recent years9.

(d) Access to cryptocurrencies through private keys, coupled with the immutability of blockchain transactions, increases the risk that consumers may permanently lose access to their cryptocurrencies. For example, consumers may have their private keys stolen through phishing attacks or may have misplaced a hardware storage device that stored their private keys.

(e) Inadequate business practices and opacity of business operations further exacerbate the risks faced by consumers. Alongside the high business risks involved, establishing the credibility of cryptocurrency firms could be difficult. Consumers are also at risk of suffering financial harm caused by manipulative behaviour of bad actors, such as through pump-and-dump schemes and insider trading.

Impetus for Considering Proposed Regulatory Measures 2.5 Alongside the abovementioned warnings by MAS, Singapore’s national financial education programme, MoneySense, has also launched campaigns to raise public awareness of investment scams involving cryptocurrencies and online trading10.2.6 Earlier this year, MAS also took a decisive step to restrict DPTSPs from promoting cryptocurrency services at public spaces11.

MAS had observed that a number of DPTSPs were actively promoting their services through online and physical advertisements, or through the provision of physical automated teller machines (ATM) in public areas, which could encourage consumers to trade cryptocurrencies on impulse.

The Straits Times, 23 August 2022. “Torque creditors to get interim returns as liquidators end probe”.

Today, 20 October 2022. “Police reports of cryptocurrency scams jumped over 5-fold to 631 last year since 2019”. 10

Please refer to Annex A for some of the key hazards and risks highlighted by MoneySense.

PS-G02 Guidelines on Provision of DPT Services to the Public.

2.7 While the above measures have served the market well up to this point, the rapid proliferation of cryptocurrency trading platforms and offerings have also made cryptocurrency trading easily accessible to consumers.Surveys show that consumers are increasingly still trading in cryptocurrencies, enticed by the prospect of sharp price increases in cryptocurrencies without duly considering the associated risks.

In this regard, a more comprehensive set of regulatory measures is needed to reduce the risk of consumer harm in Singapore12.2.8 In this consultation paper, MAS sets out our observations, policy considerations, and proposed regulatory measures in key areas: (a) consumer access;(b) business conduct;and (c) technology.This consultation paper also discusses several good industry practices to address market integrity risks.2.

9 MAS has considered whether to prohibit the offering of cryptocurrency services to consumers entirely, an option that has been considered by a few jurisdictions.However, the fact remains that cryptocurrency trading and services are cross-border in nature, and such a prohibition is unlikely to be effective in limiting consumer harms.

Local consumers can easily access cryptocurrency trading platforms overseas, which may be unlicensed, to buy or sell any number of cryptocurrencies easily through their computers or mobile devices 13 .On balance, MAS considers it appropriate to put in place targeted regulatory measures, including imposing requirements on limiting consumer access and improving business conduct, to address the risks posed to consumers in Singapore.2.

10 Despite MAS’ proposed regulatory measures, cryptocurrencies will remain inherently risky.MAS’ proposed regulatory measures do not and cannot protect consumers from the many inherent risks of trading in cryptocurrencies.Regulation does not shield consumers from the risk of their cryptocurrency holdings losing value, or if DPT service providers collapse due to unsustainable business models, fraud or excessive risk taking.

As with all financial decisions, consumers must take primary responsibility to understand the choices they wish to make, obtain the needed information, and exercise utmost caution before deciding where to put their money.2.11 Furthermore, not all types of cryptocurrency activities fall within MAS’ regulatory 14 ambit .For example, cryptocurrency staking and lending are not regulated by MAS.DPTSPs

DPTSPs are currently only regulated under the PS Act primarily for money laundering and terrorism financing (ML/TF) risks, and technology and cyber risks. To ensure that MAS is equipped to address new risks in a timely manner, the PS Act was amended in January 2021 to empower MAS to impose measures on licensed DPT service providers, where it is in MAS’ view necessary or expedient in the interest of the public. 13

MAS, 29 August 2022. “Yes to Digital Asset Innovation, No to Cryptocurrency Speculation”.

MAS' regulatory ambit pertaining to digital payment tokens is set out in the PS Act.

are also not subject to prudential regulation to ensure their financial safety and soundness, and do not have additional safety nets like deposit insurance or policy protection, unlike retail banks and insurance companies.2.12 MAS will adopt a risk-focused approach to regulating the digital asset ecosystem.To facilitate innovation in digital assets, regulations need to be clear and proportionate to the risks posed.

These regulations should be periodically reviewed to ensure that they remain relevant, given the pace of innovation.2.13 As part of MAS’ vision to grow an innovative and responsible digital asset ecosystem in Singapore, MAS seeks to anchor high quality players with strong risk management and value propositions, mitigate the risks of consumer harm, and educate consumers on the risks of cryptocurrencies and their related services.

Consumer Access Measures

3.1 As consumer interest in cryptocurrencies has continued to grow, MAS has assessed a need to consider introducing additional 15 consumer access measures. These proposed consumer access measures are meant to complement MAS’ existing consumer education efforts, and to ensure DPTSPs provide consumers with the relevant risk disclosures to make informed decisions regarding cryptocurrency trading.

Scope of Consumer Access Measures 3.2 MAS is concerned that retail customers may not have the financial wherewithal to withstand large losses that are likely to ensue from speculative trading of markets that they do not fully understand.To address these concerns, MAS intends to introduce consumer access measures for retail customers.3.

3 Retail customers are generally regarded as less able to access professional advice and have less resources to protect their interests, as compared to institutional investors or more well-resourced customers.

A useful reference for defining the scope of this “retail customer” group is the current framework in place for the classification of customers under the Securities and Futures Act 2001 (SFA), where enhanced distribution safeguards are put in place for retail investors, namely those who are not accredited investors (AI) or institutional investors.Likewise, MAS proposes that DPTSPs put in place consumer access measures for retail customers.

DPTSPs need not do so for AIs or institutional investors, who are generally regarded as better able to access professional advice.3.4 MAS has also considered the criteria and thresholds to be applied in determining whether a customer is an AI, in relation to DPT holdings.MAS is of the view that the current SFA definitions and thresholds16 for determining whether a customer is an AI are relevant.

MAS understands that some financial institutions may have their own internal frameworks to determine which types of assets would count towards determining AI eligibility, and proprietary models or methodologies for valuing those assets.3.5 For DPTs, MAS is considering the merits of more clearly defining whether and how the value of DPT holdings should be taken into account in a customer’s net personal assets

Currently, PSN08 Notice on Disclosures and Communications requires DPTSPs to warn consumers that: (a) they may not be able to recover their monies or DPTs placed with the DPTSP should the DPTSP’s business fails; and (b) consumers transacting in DPTs should be familiar with the risks and be prepared to lose all of their monies put in. 16

Under section 4A of the SFA, an individual is eligible to be treated as an AI if the individual has over S$2 million in net personal assets (where the net value of the individual’s primary residence is capped at S$1 million), or has over $1 million in net financial assets, or has over S$300,000 in income over the preceding 12 months.

when determining AI eligibility.MAS acknowledges that there is no fool-proof formula for ascertaining this, but notes that the extreme volatility and highly speculative nature of DPTs, which is not underpinned by economic fundamentals, necessities a more prudent treatment of DPT holdings.MAS is therefore considering possible options for applying a more conservative regulatory treatment to the value of DPT holdings.3.

6 One option is to impose a suitably calibrated maximum cap, for example of S$200,00017, on the value of DPT holdings that can be counted towards the AI threshold.

While this option will still expose the AI determination to the extreme price volatility of DPTs, having a cap will limit any price impact and serve as a check that DPT holdings do not make up a significant component of the customer’s net personal assets, which may result in a skewed reflection of the customer’s financial position.3.7 Another option is to fully exclude the value of DPT holdings from the value of net personal assets.

This will ensure that the value of net personal assets used in the assessment of AI status will not be subject to the risk of a sudden drop in value due to the collapse in prices of volatile DPT holdings, providing a more stable and accurate reflection of the customer’s financial position.3.8 Nonetheless, MAS is considering allowing MAS-regulated single-currency pegged stablecoins 18 to count towards AI determination without being subject to any caps.

Such stablecoins will be subject to additional requirements to uphold the promise of the peg and stability in value of single-currency pegged stablecoins.3.9 DPTSPs should periodically assess the customer’s eligibility as an AI, as the composition and amount of an AI’s assets, whether in DPTs or other assets, will vary over time.MAS recognises that the periodic assessment of customers as AI will entail additional implementation and monitoring cost and effort.

In this regard, some DPTSPs could prefer not to put in place processes to classify customers as AI or otherwise, and instead choose to apply the proposed consumer access measures to all customers.3.10 On a related note, the same considerations guiding the treatment of DPT holdings for the purposes of determining AI eligibility by DPTSPs should similarly apply to the determination of AI under the SFA.

MAS will therefore also be reviewing the AI definition in the SFA and engaging stakeholders, including the capital markets industry, separately.

An individual is eligible to be treated as an AI if the individual has S$2 million in net personal assets. Imposing a maximum cap of S$200,000 on DPT holdings would imply that DPT holdings can contribute no more than 10% in the calculation of the value of net personal assets. 18

See separate consultation paper on “Proposed Regulatory Approach for Stablecoin-Related Activities” published on 26 October 2022.

3.11 The proposed consumer access measures should minimally apply to consumers resident in Singapore.MAS notes that international regulatory practices in this area are still evolving, with differing approaches taken in various jurisdictions.Given that regulatory expectations are still developing globally, MAS is considering whether it is appropriate for the consumer access measures to be applied to consumers outside Singapore as well.

In any case, DPTSPs should still ensure that they comply with the requirements of foreign jurisdictions in which they operate, including any consumer access measures required in those jurisdictions.3.12 In summary, MAS proposes that DPTSPs apply consumer access measures to any customer: (a)

who is not an AI or institutional investor; and

(b) who is resident in Singapore (in the case of an individual) or formed or incorporated in Singapore (in the case of a partnership or corporation).

Question 1. MAS seeks comments on the proposed scope of “retail customer” for consumer access measures. Question 2. MAS seeks comments on the options for the treatment of DPT holdings for the purpose of determining a customer’s eligibility as an Accredited Investor (AI).

Risk Awareness Assessment 3.13 MAS proposes that a DPTSP should assess that a retail customer has sufficient knowledge of the risks of DPT services before providing any DPT service to that customer.Many retail customers may not have sufficient knowledge of the risks of trading DPTs, leading them to take on higher risks than they would otherwise have been willing, or are able, to bear.

Consumers should only trade DPTs if they are fully aware of the nature of the DPT market and the myriad of risks associated with it.DPTSPs, being the key access point to the DPT market, have a responsibility to guard against consumers participating in a market that they do not fully understand.3.14 Adequate, accurate and clear risk disclosures are key to consumers making informed decisions.

This is even more important for trading of DPTs where the market is nascent and developing rapidly.In assessing whether a retail customer has sufficient knowledge of the nature of risks of DPTs and DPT services, as well as the possible consequences, MAS has

considered that it could be helpful for the DPTSP to assess the retail customer’s knowledge of the following risks19: (a)

sharp fluctuations in the prices of DPTs and the loss of all monies put into DPTs;

(b) inability to readily sell their DPTs, such as during illiquid market conditions or system outages;

(c) losing access to their DPTs in the event of a technological or operational issue, such as if private keys are lost or irretrievable; and

(d) losing their DPTs in the event of fraud, theft, sabotage or cyber attack.

3.15 For retail customers assessed not to have sufficient knowledge of the risks of DPT services, MAS is considering the possible next steps that the DPTSP could take. These may include: (a)

providing educational materials to the retail customer to strengthen the customer’s knowledge of the risks of DPT services. This should not be limited to those questions to which the retail customer answered incorrectly;

(b) having the appropriate processes to facilitate and encourage retail customers to review the educational materials and improve their knowledge of risks, such as cooling off periods between assessments20; and

(c) having the appropriate processes to ensure a fair and robust assessment, such as using a diverse question bank that generates different questions for subsequent assessments.

3.16 MAS understands that a number of industry players are supportive of some form of assessment on the retail customer’s knowledge of risks of trading in DPTs and have expressed interest to work together to develop a common assessment template. MAS agrees that a common template would facilitate consistency and robustness across the industry in

To ensure a robust assessment, MAS is considering that the DPTSP should also offer at least three choices of plausible answers for each question for the consumer to choose from. 20

While the DPTSP may inform the retail customer factually that the retail customer can retake the assessment, the DPTSP should not otherwise induce, encourage, or pressure the retail customer to do so.

conducting the risk awareness assessment.MAS welcomes industry players to take these efforts forward and continue to engage MAS closely in this regard.Question 3.MAS seeks comments on the proposal to assess the retail customer’s knowledge of the risks of DPT services, as well as the risks to be covered by the assessment.

MAS also seeks comments on possible next steps for DPTSPs, should the retail customer be assessed not to have sufficient knowledge of the risks of DPT services.

Restriction on Offering of Incentives 3.17 MAS currently expects financial institutions to ensure that any gift or incentive does not unduly influence the decision of the retail customer to purchase any financial product or service21.The offering of incentives to retail customers, such as free trading credits or DPTs, can entice retail customers to participate in DPT services without fully considering the risks involved.

Bans on the offering of incentives for DPT services have been contemplated in other jurisdictions.3.18 The issue is made more pertinent with the high volatility of DPTs and the risk of consumer harm often associated with them.MAS proposes that DPTSPs should not offer any monetary or non-monetary incentives: (a)

to retail customers to participate in a DPT service; or

(b) to any person (e.g., an existing customer or a celebrity) to refer a DPT service to retail customers.

Question 4. MAS seeks comments on the proposal to restrict DPTSPs from offering incentives to retail customers.

Restrictions on Debt-Financed and Leveraged DPT Transactions 3.19 DPT prices are highly volatile and subject to sharp price swings.The use of any form of credit or leverage in the trading of DPTs would result in the magnification of losses and could cause the customer to lose more than the whole amount put in.Regulators from other jurisdictions have also expressed concerns with these issues and proposed restrictions on the use of credit and leverage.3.

20 Given the inherent risks of DPTs, retail customers should not borrow to purchase DPTs.Hence, MAS proposes that DPTSPs should not:

FSG-G02 Guidelines on Standards for Marketing and Distribution Activities.

(a) provide to a retail customer any credit facility (whether in the form of fiat currencies or DPTs) to facilitate the retail customer’s purchase or continued holding of DPTs22;

(b) enter into any leveraged DPT transaction23 with a retail customer or facilitate a retail customer’s entry into any leveraged DPT transaction with any other person; nor

(c) accept any payments24 made by the retail customer using a credit card or charge card, in connection with the provision of any DPT service.

Question 5. MAS seeks comments on the proposed restrictions on debt-financed and leveraged DPT transactions.

Currently, a licensee under the PS Act is already prohibited from carrying on a business of granting any credit facility to any individual in Singapore. The proposal is wider in that it applies to DPTSPs which are not licensed under the PS Act (i.e., exempt and notified entities under the PS Act for conducting DPT services). 23

A “leveraged DPT transaction” means a transaction to purchase or sell DPTs, where one counterparty provides to the other counterparty money, DPTs, property, or other collateral which represents only a part of the value of the transaction. 24

Including payments made through electronic wallets that are topped up using credit cards.

Business Conduct Measures

4.1 Most jurisdictions that have proposed specific rules in the DPT sector have not fully operationalised the rules, including requirements on business conduct practices.For example, legislations on Markets in Crypto-Assets (MiCA) in the EU25 and Digital Assets Basic Act in Korea, are targeted for implementation in 1-2 years.

In the meantime, business conduct practices vary across the industry and do not appear adequate in ensuring that customers are treated fairly and properly.Several misconduct cases have been reported by international media, including where legal proceedings were commenced against entities that did not have sufficiently robust business conduct practices in place.Some examples include: (a)

a lack of segregation arrangements for customers’ assets which could result in losses to customers, in the event the entity becomes insolvent or otherwise fails to uphold its obligations;

(b) issues on conflicts of interest, given the multiple roles and activities performed by such entities26.For example, an entity may operate a market (trading venue) while at the same time conduct proprietary trading and/or market making services, allowing the entity to potentially front run customers’ orders.An entity may also list its own proprietary tokens or tokens which its related entities may have interests in.

In most cases, entities have not properly disclosed these conflicts of interest, nor implemented controls to address them;and

(c) unfair dispute resolution mechanisms that entities may have imposed on their customers, involving lengthy and onerous procedures, to bring a claim against the relevant entities.

4.2 MAS currently requires DPTSPs to adhere to conduct requirements in the keeping of transaction records, issuance of transaction receipts and display of exchange rates, as set out in PSN07 Notice on Conduct.While these requirements provide a minimum level of safeguards pertaining to the use of DPTs for payment transactions, they do not address other types of conduct risks posed by DPTSPs.4.

3 MAS notes the emerging efforts by industry associations to establish industry standards and codes of practice, with a view towards ensuring fair and responsible provision 25

Some business conduct requirements under EU MiCA include safekeeping of clients’ crypto-assets and funds, complaint handling procedure, identification, prevention, management and disclosure of conflicts of interest, outsourcing and custody and administration of crypto-assets on behalf of third parties. 26

Financial Times, 25 November 2021. “Crypto exchanges’ multiple roles raise conflict worries”.

of DPT services. MAS encourages industry participants’ continued efforts in strengthening business conduct practices and will also continue to engage with industry participants in this regard. 4.4 To establish baseline conduct norms for DPTSPs, MAS proposes to introduce business conduct standards for DPTSPs in key areas of concern, taking into consideration industry best practices and regulatory proposals introduced in other jurisdictions.

Segregation of Customers’ Assets and Risk Management Controls 4.5 MAS proposes that DPTSPs should ensure that customers’ assets are segregated from the DPTSPs’ own assets27, and held for the benefit of the customer28.The recent failure of several firms in the DPT industry underscores the importance of DPTSPs having effective and robust arrangements in place for the identification and segregation of customers’ assets.

In addition to minimising the risk of loss or misuse of customers’ assets during the ordinary course of business, these arrangements facilitate the return of customers’ assets in the event of the DPTSP’s insolvency.4.6 Globally, there has been some early discussions that in order to further protect customers’ assets, it could be useful to require DPTSPs to appoint an independent custodian to hold customers’ assets.

However, it was noted that this involves a broader scope of coverage as compared to similar requirements in the capital markets, where an independent custodian requirement is typically imposed on fund management companies, but not necessarily on other types of securities intermediaries, such as securities brokers.MAS also notes that activity on DPT custody will only be covered in Phase 2 of the PS Act amendment.

Nevertheless, MAS would like to seek views on whether having an independent custodian would be appropriate in the context of the DPT sector, and whether there are other more effective measures to address concerns over customers’ assets such as in the event of DPTSP’s insolvency.4.7 Customers should be properly informed of the arrangements and risks involved in having their assets held by DPTSPs.

To this end, MAS proposes that DPTSPs should provide written disclosures to customers, which may include: (a)

the terms and conditions, including the arrangements for receiving instructions from the customers and providing information to the customers, and applicable fees and costs;

Customers’ assets may include cash and DPTs belonging to customers. A customer’s assets may be commingled with the assets of other customers. 28

E.g., in a trust account or arrangement.

(b) that the customers’ assets are segregated from the DPTSP’s own assets, and held for the benefit of the customers;

(c) whether the customers’ assets will be commingled with the assets of other customers and, if so, the risks of such commingling; and

(d) the consequences for the customers’ assets if the DPTSP becomes insolvent, and the arrangements by the DPTSP to protect customers’ assets.

4.8 DPTSPs should also put in place a process to conduct, on a daily basis, timely reconciliation of all customers’ assets, which are held on behalf of the customers by DPTSPs.DPTSPs should also provide customers with a statement of account, comprising information on the customer’s assets and transactions, minimally on a monthly basis.Question 6.MAS seeks comments on the proposed segregation measures relating to customers’ assets.Question 7.

MAS seeks comments on whether DPTSPs should be required to appoint an independent custodian to hold customers’ assets.MAS also seeks comments on other control measures that would help to minimise the risk of loss or misuse of customers’ DPTs.Question 8.MAS seeks comments on whether the proposed disclosure and reconciliation measures are appropriate and adequate, and whether any other disclosures would be useful.4.

9 DPTs are typically held in wallets, which are applications or devices for storing the private keys that provide access to the DPTs.In some cases, DPTSPs hold the customers’ DPTs in custodial wallets 29 , where the DPTSPs control the private key and thus have exclusive control over the movement of customers’ DPTs.4.10 However, private keys may be compromised due to single points of failure, insider threats (e.g.

, employee fraud or misappropriation) or external theft, resulting in a permanent loss or inaccessibility of customers’ DPTs30.4.11 Management of private keys associated with custodial wallets is essential for the security of DPTs, which should be subject to strong controls.DPTSPs should apply the

Some DPTSPs may operate another custody model, where customers self-custody their DPTs in their own wallets and control the private keys. 30

International Organisation of Securities Commission, February 2020. “Final Report – Issues, Risks and Regulatory Considerations Relating to Crypto-Asset Trading Platforms”.

principles of “never alone” 31 , “segregation of duties” 32 , and “least privilege” 33 when establishing policies, procedures and controls to ensure the safety and control of customers’ DPTs. MAS is therefore seeking views on appropriate and effective measures to safeguard the private keys and storage of customers’ DPTs. Some of these control measures could include: (a)

instituting processes that restrict any one staff from being able to authorise and effect the movement, transfer or withdrawal of customers’ DPTs;

(b) controlling movement or transfer of DPTs between the DPTSP’s preapproved hot, warm and cold wallets;

(c) implementing operational controls to prevent the loss of cryptographic keys of DPTs that are held or managed by DPTSPs;

(d) storing a suitably high proportion of customers’ DPTs in cold wallets; and

(e) establishing a compensation process to handle any loss of such customers’ DPTs, arising from incidents that are attributable to the operations of the DPTSP.

Question 9.MAS seeks comments on the proposed risk management controls for customers’ DPTs.MAS also seeks comments on any other measures to safeguard the private keys and storage of customers’ DPTs.4.12 MAS observes that DPTSPs may offer attractive yields for customers that hold DPTs with them.

These advertised yields are often much higher than that offered in the traditional financial system, even though the sources of underlying revenue streams may be unclear or unsustainable.In some cases, the yields arise from facilitating cryptocurrency staking or lending activities34.Staking also tends to be closely related to the unregulated and nascent

Certain system functions and procedures are of sensitive and critical nature, and are carried out by more than one person at the same time or performed by one person and checked by another. 32

Segregation of duties is to ensure that responsibilities and duties for IT functions, such as operating system function, system design and development, application maintenance programming, access control administration, data security, and backup are separated and performed by different groups of employees. 33

Access rights and system privileges are granted based on job responsibility and the necessity to have them to fulfil one's duties. No person by virtue of rank or position is given any intrinsic right to access confidential data, applications, system resources or facilities. Only personnel with proper authorisation are granted access to and use of information assets. 34

Such staking or lending activity may involve DPTSPs participating in unregulated DeFi protocols, such as automated market makers (AMMs) and liquidity pools, to attain greater yield.

Decentralised Finance (DeFi) space.Even though the market size of DeFi remains small, it can pose market, liquidity and cyber risks, potentially heightening consumer harm35.4.13 The collapse of a number of cryptocurrency trading platforms, where a few had conducted staking or lending activities, had led to significant consumer harm 36, 37.To reduce consumer harm, MAS has considered various options.

One option is to impose risk disclosure requirements on DPTSPs, so that retail customers are informed of these risks involved.Another option is to restrict DPTSPs from lending out retail customers’ DPTs, which is an approach also adopted by several jurisdictions.

While this latter option is stricter than the regulatory treatment of retail customers’ securities under the SFA38, MAS is of the view that the heightened risk of consumer harm in this unregulated space may necessitate stricter measures for retail customers.Furthermore, under the PS Act, the facilitation of DPT borrowing and lending is currently not regulated nor subject to any regulatory requirements.4.

14 To safeguard retail customers’ DPTs from the risks of unregulated borrowing and lending, MAS proposes that DPTSPs should not mortgage, charge, pledge or hypothecate the retail customer’s DPTs.For non-retail customers, DPT service providers should provide a clear risk disclosure document and obtain the customer’s explicit consent.Question 10.MAS seeks comments on the proposed restriction on DPTSPs not to lend out retail customers’ DPTs.

MAS also seeks comments on any other measures to protect customers’ DPTs from the risks of unregulated borrowing and lending by DPTSPs.

Identification and Mitigation of Conflicts of Interest 4.15 MAS notes that DPTSPs conduct multiple activities, including operating a trading platform (referred to in this consultation paper as a “DPT trading platform operator”), providing broker-dealer services and trading for their own or related accounts. Where DPTSPs engage in multiple business activities, this may give rise to conflicts of interest. Examples of conflicts of interest include: (a)

A DPTSP has a financial interest in DPTs which are listed on a trading platform that it operates 39 . While DPT trading platform operators should independently evaluate prospective DPTs for listing on their trading platform,

International Monetary Fund, April 2022. “Global Financial Stability Report”.

The Straits Times, 15 July 2022. “Crypto players may be too close for comfort”.

The Straits Times, 23 August 2022. “Torque creditors to get interim returns as liquidators end probe”.

As set out in Securities and Futures (Licensing and Conduct of Business) Regulations.

Financial Times, 29 January 2022. “Coinbase’s bets on token issuers fuel fears over crypto industry disclosure”.

they, or their related entities, may also invest in new token projects that could then be listed on the trading platform; (b)

A DPTSP transacts as principal on a trading platform it operates. While DPTSPs that handle and execute customer orders should do so in the customers’ best interests, they could be incentivised to exploit the information relating to customer orders to make a trading profit for themselves (commonly known as “front-running”); and

(c) A DPTSP conducts market making activities for DPTs listed on its trading platform. While DPT trading platform operators should ensure that trading on their DPT trading platform is fair, orderly and transparent, they could be incentivised to trade anonymously on their DPT trading platform against customers and give an artificial impression of market liquidity, while not being subject to any independent oversight of such trading activities on their own trading platform.

4.16 Failure to have appropriate controls in place to address conflicts of interest raises concerns that DPTSPs may not always be acting in the best interests of the customer. Customers are at risk of being treated unfairly. Hence, MAS proposes that DPTSPs should: (a)

establish and implement effective policies and procedures to identify and address conflicts of interests; and

(b) disclose to their customers the general nature and sources of conflicts of interest and the steps taken to mitigate them.

4.17 To mitigate conflicts of interest, DPTSPs could adopt appropriate measures such as segregation of duties, independent reporting lines and information barriers.Disclosures provided by DPTSPs to their customers should also be sufficiently clear and precise to enable each customer to make an informed decision about the DPT service in the context of which the conflict of interest arises.4.

18 MAS also proposes that DPTSPs should disclose the manner in which they handle and execute customer orders (e.g., whether they trade as counterparty against the customer or facilitate trade matching between customers), and the capacity in which they are doing so (e.g., as agent or principal).This is often opaque or unclear, which hinders the customers’ ability to assess whether the DPTSPs are acting in the customers’ interests.4.

19 To address common conflicts of interests that have been observed in the DPT industry, MAS also proposes the following specific measures: Monetary Authority of Singapore

(a) DPTSPs that execute orders to purchase and sell DPTs on behalf of their customers should not misuse any information relating to customers’ orders, and should prevent the misuse of such information by employees;

(b) DPT trading platform operators should not – (i)

buy or sell DPTs for their own account; and

(ii) permit their related corporations to buy or sell DPTs for their own account on the DPT trading platform.

Question 11. MAS seeks comments on the proposed measures to identify and mitigate conflicts of interests. MAS also seeks comments on any other measures to identify and mitigate conflicts of interest.

Disclosure of DPT Listing and Governance Policies 4.20 DPT trading platform operators typically list a wide range of DPTs for trading.MAS has observed that it is not uncommon for newly listed DPTs to collapse in price soon after they are listed, or are thinly traded and hence highly susceptible to manipulation.4.

21 A number of DPT trading platform operators have made efforts to disclose some information on their digital asset evaluation frameworks, which may include assessing the legal, security and compliance aspects of prospective DPTs.However, most do not provide adequate information on their token listing and governance procedures.Customers continue to have very limited information of the relevant processes that DPT trading platform operators may undertake.

This raises concerns on whether DPT trading platform operators have put in place adequate policies and procedures to evaluate prospective tokens prior to their listing and conduct periodic reviews on listed tokens.

As DPT trading platform operators are ultimately accountable and responsible for the DPTs which are available for trading on their trading platforms, clarity and transparency on the DPT evaluation framework would provide consumers with the relevant information to make more informed decisions.4.

22 Given the lack of economic fundamentals underpinning prices of DPTs, a disclosurebased approach towards DPT listing and governance policies would be a good starting point for DPTSPs to share their policies and procedures in relation to listing and reviewing a DPT.4.23 MAS proposes that DPT trading platform operators should disclose their DPT listing and governance policies that address the following matters:

(a) the criteria, due diligence, processes and fees applied in making a DPT available for trading on the DPT trading platform;

(b) the conditions under which DPTs may remain available for trading, be suspended or removed from trading;

(c) the processes by which DPTs are removed from trading, and the rights available to customers;

(d) the requirements to address unfair or disorderly trading practices of DPTs on the DPT trading platform; and

(e) the settlement procedures of DPT transactions.

4.24 The disclosures should be sufficiently clear to allow customers to make informed decisions about the DPT services offered.In particular, DPT trading platform operators should disclose their policies and procedures and their decision-making process for selecting and listing of DPTs, and how they have applied their evaluation criteria (e.g.

, track record, market capitalisation, liquidity, volatility, technical security) before making a DPT available for trading on the DPT trading platform.4.25 Besides the above disclosures, MAS welcomes other suggestions to enhance market discipline on DPT trading platform operators in relation to DPTs traded on their trading platform.

However, MAS notes that, even with these proposed disclosures in place, the information disclosed by DPT trading platform operators will not be comparable to the product information required to be disclosed for securities that considers economic fundamentals.Hence, customers of DPT trading platform operators should still be aware that DPTs have high inherent risks which these proposed disclosures cannot mitigate.Question 12.

MAS seeks comments on the proposal for DPT trading platform operators to publish its policies and procedures on the process for selecting, listing, and reviewing DPTs, as well as the relevant governance policies.MAS also seeks comments on any other measures or disclosures to enhance market discipline on DPT trading platform operators, with regard to DPTs traded on their trading platforms.

Complaints Handling 4.26 Customer complaints are important indicators of the problems that customers face with their service providers. The monitoring of complaints allows the service provider to take timely remedial measures to address those problems. The handling of customer complaints

in an independent, prompt, and effective manner provides assurance to customers that their concerns are dealt with in a fair and timely manner. 4.27 MAS therefore proposes that DPTSPs have in place adequate policies and procedures to handle customer complaints. Examples of such policies and procedures could include40: (a)

appointing a member of senior management, or committee of members, who are not directly involved in the provision of DPT services to oversee complaints handling;

(b) establishing a complaints handling unit that is not directly involved in the provision of DPT services;

(c) establishing a process for handling and resolving complaints in a fair and timely manner which includes: (i)

providing for the assessment of merits of each complaint, the criteria for determining whether to refer a complaint to senior management, and a reasonable timeframe for handling and resolving complaints;

(ii) providing customers with written reasons for rejection of their complaints;

(iii) ensuring that information on its complaints handling process is publicly available; and

(iv) establishing a system to record, track and manage complaints.

4.28 If a customer is not satisfied with the DPTSP’s handling and resolution of the complaint, the customer may wish to seek recourse through legal proceedings.Dispute resolution processes are typically stipulated by the DPTSPs in their terms of agreement.In this regard, DPTSPs should not hinder or prevent retail customers from bringing disputes before the courts of Singapore, such as by requiring arbitration in its terms and conditions.Question 13.

MAS seeks comments on the proposed complaints handling policies and procedures.MAS also seeks comments on any other measures or disclosures to ensure that customer complaints are dealt with in a fair and timely manner.

These proposals are similar to those required for financial advisers under the Financial Advisers (Complaints Handling and Resolution) Regulations 2021.

Managing Technology and Cyber Risks

5.1 DPTSPs operate in a complex IT environment, and its ability to execute DPT services for their customers is dependent on the underlying distributed ledger technology and other service providers in the network.Cyber attacks and system outages at DPTSPs can disrupt their operations and services, resulting in trading halts on the DPT trading platforms and significant financial losses to their customers.5.

2 Currently, DPTSPs are required to comply with cyber hygiene requirements as delineated in the MAS Notice on Cyber Hygiene.

Specifically, DPTSPs are required to secure administrative accounts against any unauthorised access or use, establish security standards, implement security patches timely, put in place network perimeter defence and malware protection, as well as implement multi-factor authentication for administrative accounts of critical systems and all system accounts used to access customer information through the internet.5.

3 DPTSPs are also subject to the MAS Technology Risk Management Guidelines, which requires financial institutions to establish sound and robust technology risk governance, and maintain cyber resilience.This includes the implementation of secure coding, robust cryptographic key management, and controls to ensure the availability and security of IT systems.5.

4 MAS has observed a number of incidents globally where DPTSPs’ systems were disrupted, particularly during periods of market volatility.These disruptions have impacted their customers’ access to their DPTs and use of DPT services.5.

5 To improve IT resilience, as well as maintain trust and confidence in DPT services, DPTSPs should maintain high system availability and recoverability to ensure DPT systems supporting critical operations and services are not disrupted for a prolonged period that could severely affect the DPTSPs’ operations and delivery of services to their customers.DPTSPs should also ensure the protection of customer information and timely reporting of incidents.5.

6 Hence, MAS is proposing to mandate the requirements in the Notice of Technology Risk Management that are currently applicable to other types of financial institutions, such as banks, to DPTSPs.5.7

The Notice requires DPTSPs to: (a)

put in place a framework and process to identify critical systems;

(b) ensure that the maximum unscheduled downtime for each critical systems does not exceed a total of 4 hours within any period of 12 months;

(c) establish a recovery time objective of not more than 4 hours for each critical system;

(d) notify MAS as soon as possible, but not later than 1 hour, upon the discovery of a system malfunction or IT security incident, which has a severe and widespread impact on the bank’s operations or materially impacts the bank’s service to its customers, and submit a root cause and impact analysis report to MAS within 14 days; and

(e) implement IT controls to protect customer information from unauthorised access or disclosure.

Question 14. MAS seeks comments on the proposed requirements for DPTSPs to establish a high level of availability and recoverability of critical IT systems that they use to support their business and services. MAS also seeks comments on the proposed incident reporting and customer information protection requirements.

Market Integrity

6.1 While DPTs are represented on a blockchain, most DPT transactions are in fact conducted through providers that facilitate trade matching (also known as “centralised exchanges” or CEX), without being recorded on the blockchain (off-chain transactions).

Customers who transact DPTs through centralised exchanges expect DPT quotations displayed by the DPT trading platforms to reliably represent the prevailing market supply and demand, their orders to be matched on an equitable basis, and their counterparties not to have an unfair advantage.6.2 However, DPT markets have been susceptible to unfair trading practices of market manipulation, misleading conduct and insider trading by nefarious actors.

Such unfair trading practices distort the price discovery process and undermine customers’ trust and confidence in the functioning and integrity of DPT markets.Examples of unfair trading practices include:

(a) wash trading, which is the buying and selling of DPTs with no change in beneficial ownership, to create a false or misleading appearance of active trading. This may be carried out through the creation of “ghost accounts” or other deceptive means, which seek to inflate trading volumes to give the appearance of rising popularity41;

(b) pump-and-dump, which is to induce an increase in the price of a DPT (“pump”) through the dissemination of false or misleading information, such as deceitful marketing and promotional ploys, before selling off their own holdings of the DPT (“dump”), ahead of other participants who would have been misled into buying the DPT;

(c) cornering, which is to use a dominant controlling position in a DPT to influence the price of the DPT and profit from that activity;

(d) trade spoofing, which is to place orders with the intention of cancelling them prior to being fulfilled, often by deploying trading bots and algorithms, to push the market price in a particular direction. These orders give the market a false sense of supply or demand; and

Forbes, 26 August 2022, “More than half of all bitcoin trades are fake”.

(e) insider trading, which refers to the buying or selling DPTs while possessing material non-public information, such as an upcoming announcement of a listing decision42.

6.3 MAS recognises that there are limitations to addressing market integrity risks arising from cross-border transactions.This is because many DPTs are available and traded globally across any number of trading platforms.Given the cross-border nature of DPT markets, a global consensus, be it through regulatory standards or possibly industry codes of conduct 43, would be needed to address market integrity concerns in an effective and coordinated way.6.

4 MAS is actively involved in work undertaken by international standard setting bodies, such as the International Organisation of Securities Commissions (IOSCO), to address market integrity risks, and will continue to actively support these international regulatory efforts.MAS will also continue to study various considerations and appropriate measures to detect and deter unfair trading practices.

If and when MAS proposes these measures, MAS will seek views from stakeholders, including industry participants.6.5 MAS encourages DPT trading platform operators to put in place good industry practices to detect and deter unfair trading practices in DPT markets.Examples of good industry practices include: putting in place effective systems, procedures and arrangements to promote fair, orderly, and transparent trading of DPTs traded on their trading platform.

As a baseline, DPT trading platform operators could set out, disclose, and enforce rules governing the trading activities that take place on their DPT trading platforms.MAS notes that these practices are similar to regulatory proposals put forward in other jurisdictions such as in Hong Kong and EU;and monitoring trading activities that take place on their DPT trading platforms, such as employing real-time surveillance systems.

MAS is cognizant that the commercial availability of technological solutions for real-time DPT surveillance may presently be limited.In this regard, DPT trading platform operators could conduct market surveillance in a manner that is commensurate with the nature, scale and complexity of their businesses.

Félez-Viñas, Ester and Johnson, Luke and Putnins, Talis J., 8 August 2022, “Insider Trading in Cryptocurrency Markets”. 43

For example, market participants cooperated to launch the FX Global Code, which is developed to provide a common set of guidelines to promote the integrity and effective functioning of the wholesale foreign exchange market.

Question 15. MAS seeks comments on effective systems, procedures and arrangements that DPT trading platform operators should implement, in order to promote fair, orderly, transparent trading of DPTs offered for sale on their trading platform. Question 16. MAS seeks comments on effective measures, including the implementation of market surveillance mechanisms, to detect and deter unfair trading practices.

Implementation Options

7.1 To implement these proposals, MAS intends to issue Guidelines, taking into account responses to this consultation paper, to set out our expectations for DPTSPs as a first step to implementing the proposals.Thereafter, details on the regulatory requirements and subsidiary legislation will be separately published for consultation in due course.7.

2 Given the importance of addressing the risks of consumer harm in a timely manner, MAS is considering to provide a transition period of 6-9 months for DPTSPs to meet the Guidelines.MAS will take into account and consider the extent of the finalised guidelines before deciding on the length of the transition period, and closely engage with DPTSPs to ensure that the measures will be able to be implemented in a timely and practicable manner.7.

3 The transition period is envisaged to start from the time of publication of the finalised guidelines, or other suitable junctures, in consultation with stakeholders.Question 17.MAS seeks comments on the proposed transition period of 6-9 months.MAS also seeks other comments to facilitate the transition towards the implementation of the regulatory measures.

Annex A KEY RISKS HIGHLIGHTED BY MONEYSENSE (a)

(b) “Risks of cryptocurrencies, initial coin offerings and other digital tokens”, 29 October 2018. (i)

Foreign and online operators. It is difficult to trace and verify the authenticity of these operators.

(ii) Sellers without a proven track record. It could be hard to establish the credibility of digital token sellers, and the failure rate tends to be high.

(iii) Insufficient secondary market liquidity. Even if the digital tokens can be traded in a secondary market, consumers may be stuck with them if there are not enough active buyers and sellers, or if the bid-ask spreads are too wide.

(iv) It is possible to lose every cent. The traded price can fluctuate greatly in a short time and can become zero overnight.

(v) Investments promising high returns. Investments with higher promised returns could potentially be fraudulent. Schemes that offer high referral commissions would increase operating costs, which could lower the chances of achieving the promised returns.

(vi) Money-laundering and terrorist financing. Investors are likely to be adversely affected if authorities investigate any alleged illicit activities related to the token issuers, its business activities or the trading of the token.

(vii) Risk of losing private key. If you lose your private key, you lose access to your digital tokens. If someone hacks into your digital wallet or otherwise knows of your private key, that person gains access to your digital tokens.

“The risks you are exposed to when trading in cryptocurrencies and their derivatives”, 9 November 2021. (i)

MAS’ regulations on crypto derivatives only apply to those listed on Approved Exchanges. If you trade in crypto derivatives that are not listed on Approved Exchanges, the money you deposited for trading in these derivatives is not protected by MAS’ regulations.

(c) “Decentralised Finance (DeFi): What you need to know”, 19 October 2022. (i)

Speculative nature of digital tokens. Cryptocurrencies are closely interlinked with DeFi. Their prices are known to fluctuate wildly, potentially even crashing to zero, no matter how reputable they may be.

(ii) Unsustainable yield. Investors should be sceptical of claims of consistently high investment returns with little or no risk.

(iii) Hacking. The open-sourced and decentralised nature of DeFi projects make them more vulnerable to malicious attacks and the level of security varies considerably across protocols.

(iv) Information asymmetry. DeFi projects are unregulated and are not subject to disclosure requirements unlike traditional financial investment products. Thus, the average investor may have limited access to sufficient information to fully assess the investment risks and suitability.

(v) Fraud. There may be outright fraud, such as rug pulls or pump-and-dump schemes.

(vi) Lack of a central party to hold accountable. With no intermediary or central party in charge, you will have nowhere to turn to or no one to hold accountable should things go awry.

Annex B LIST OF QUESTIONS Question 1.

Question 2.

Question 3.

Question 4.

Question 5.

Question 6.

Question 7.

Question 8.

Question 9.

Question 10.

Question 11.

Question 12.

Question 13.

Question 14.

Question 15.

Question 16.

Question 17.