Response to public consultation on regulatory measures for DPT services (Part 2)

The paper highlighted MAS’ vision to develop an innovative and responsible digital asset ecosystem in Singapore, and strongly discourage cryptocurrency trading and speculation given the significant risks and consumer harms2.Since 2017, MAS has repeatedly warned the public that cryptocurrencies are not suitable for consumers and about the hazards of cryptocurrency speculation.These warnings were also made through joint advisories with the Singapore Police Force3.

However, despite these warnings and the high risks involved, cryptocurrencies continue to attract much speculative consumer interest, due in part to the alleged “success stories” of spectacular gains over a short period of time, celebrity endorsements encouraging consumers to participate in the market and playing on fears of missing out on good returns while trivialising the risks of cryptocurrency trading and other misleading claims4.

In this regard, MAS needed to put in place a comprehensive set of regulatory measures to reduce the risk of consumer harm.This includes imposing targeted measures on retail consumer access, enhanced business conduct requirements, risk management practices and measures to address technology and cyber risks.

MAS received many responses from a wide range of respondents, including industry associations, DPTSPs and other financial institutions (“FIs”), professional services firms as well as interested individuals.Arising from the feedback received during the consultation process and requests for further clarification received from respondents, MAS had followed up with further engagements and consultations with relevant stakeholders.

MAS would like to thank all respondents for their suggestions and contributions, which MAS had carefully considered and taken into account in MAS’ policy responses.

These include persons who are currently operating under the transitional exemption as they have been providing DPT services before the commencement of the Payment Services Act 2019 and have notified MAS pursuant to the Payment Services (Exemption for Specified Period) Regulations 2019.These entities are not licensed under the Payment Services Act 2019 but are allowed to continue to provide DPT services while their licence applications are being reviewed by MAS.

Don’t miss out on the next decade”, the UK Advertising Standards Authority found that it implied there would be a similar guaranteed increase in Bitcoin value over the next decade and did not make clear that past performance was not necessarily a guide for the future.

Globally, there is increasing consensus that robust regulatory standards and international regulatory cooperation is key to address issues of financial stability, investor protection and market integrity, while facilitating useful innovation.

A notable recent development would be IOSCO’s Final Report on Policy Recommendations for Crypto and Digital Asset Markets ("IOSCO Final Report”), which contain 18 policy recommendations designed to support greater consistency across regulatory frameworks to address market integrity and investor protection concerns arising from crypto-asset activities5.These international developments were also taken into account in MAS’ policy responses.1.4.

MAS has published the responses to the consultation feedback in parts.On 3 July 20236, MAS published Part 1 of the consultation response, which focused on the requirements for segregation and custody of customers’ assets [link], as well as draft legislative amendments to the Payment Services Regulations 2019 [link] to safeguard customer assets under a statutory trust.

This paper is Part 2 of the consultation response, covering business conduct and consumer access measures, as well as technology and cyber risk management requirements.MAS will issue Guidelines to set out our expectations for DPTSPs as a first step towards implementing the conduct and consumer access measures.MAS will also expand the scope of the Notice for Technology Risk Management (“Notice”) under the PS Act to implement the technology and cyber risk measures.1.5.

The list of respondents who submitted their feedback to the proposals under Questions 1-5, 11-14 and 17 of the consultation paper is set out in Annex A and their submissions are set out in Annex B.The annexes may be accessed at this link.MAS has carefully considered the feedback received including suggestions received through MAS’ further engagements with relevant stakeholders.These have been incorporated in the response where appropriate.

Comments that are of a wider interest, together with MAS’ responses, are set out below.

International Organization of Securities Commissions, November 2023. “Policy Recommendations for Crypto and Digital Asset Markets - Final Report”.

Regarding the definition of AI and II, respondents agreed that it would be useful to align these definitions with the Securities and Future Act 2001 (“SFA”) so that there would be a consistent understanding between the SFA and the PS Act.A few respondents further commented that as the policy intent is similar, the “opt-in” regime for AIs under the SFA should similarly apply to the consumer access measures for DPT services8.

Two respondents enquired on the treatment of DPTSP entities who did not qualify as AIs and were not IIs, and whether such DPTSP entities would be subject to consumer access measures if they were seeking services from another DPTSP.

Respondents thus sought clarification on whether a similar category of “Expert Investors” would be adopted in the context of DPT services, and whether the proposed consumer access measures would apply to these “Expert Investors”.

The majority of respondents (comprising mostly DPTSPs, related associations, advisory firms, and a few capital markets financial institutions) expressed the view that the consumer access measures should apply to retail customers in Singapore10.

In support of this position, a few respondents reasoned that retail customers outside Singapore (“foreign retail customers”) would be protected by regulatory requirements deemed relevant in their respective jurisdictions, and MAS should not need to impose such limitations on foreign retail customers in relation to their conduct of business with DPTSPs.

On the other hand, several respondents (mostly from capital markets financial institutions) took the view that the consumer access measures should 7

The finalised consumer access measures are elaborated in paragraphs 2.8 to 2.31 of this response paper.Under this regime, a person (whether an individual or otherwise) may only be treated as an AI for the purpose of certain provisions of the SFA and the Securities and Futures (Licensing and Conduct of Business) Regulations if that person had opted to be treated by the counterparty as an AI in accordance with the procedures set out in the relevant regulations.

apply to all retail customers, regardless of residence or jurisdiction of incorporation. They pointed out that this would be consistent with the SFA and the Financial Advisers Act 2001 (“FAA”) where no such distinction was made, in addition to the fact that there is significant potential harm and regulatory risk posed by the cross-border nature of DPT transactions.

MAS’ response 2.4.MAS will proceed with the consulted position to apply consumer access measures to retail customers, which will be scoped to customers who are not AIs or IIs11.The definitions of AI and II in the Guidelines will be aligned with that in the SFA.The Guidelines will also clarify that the consumer access measures would not apply to DPTSP entities that do not qualify as AI or II.2.5.

MAS agrees with the suggestion to adopt an “opt-in” regime for AIs, similar to the SFA, for the application of consumer access measures for DPT services.

This would better ensure that customers are fully aware and informed of their status as a retail customer or an AI, the regulatory measures accorded to that status, and would provide customers with flexibility to determine if the consumer access measures should apply to them after taking into account their circumstances and understanding of DPTs and DPT services.

In practice, this would mean that DPTSPs would treat all customers (other than IIs) as retail customers by default, and where a customer meets the criteria of an AI, the customer would have the choice of opting to be treated as an AI.Further details of MAS’ expectations will be provided in the Guidelines.

MAS has highlighted the extreme volatility and highly speculative nature of cryptocurrencies, and that they do not have any economic fundamentals.A classification of investors deemed to be an “Expert” in DPTs would not be in line with this view.In addition, “Expert Investors” would likely lack the financial wherewithal to withstand the large losses arising from speculative trading in cryptocurrencies12.2.7.

MAS noted the feedback to apply consumer access measures to all retail consumers, regardless of residency, as these measures aim to reduce consumer harm for retail consumers.Given the crossborder nature of DPT services and that currently there is no distinction between foreign-based and local-based retail customers under the SFA or the FAA, MAS agrees with the feedback to more prudently apply consumer access measures to all retail customers.This approach would reduce the

This is consistent with IOSCO Final Report, which recommends that regulators should require a crypto-asset service provider (“CASP”) to operate in a manner that is consistent with IOSCO’s standards regarding the interactions and dealings with retail clients.

risk of DPTSPs setting up in Singapore with the intent to primarily serve foreign retail customers who are not subject to MAS’ consumer access measures. DPTSPs regulated in Singapore should therefore apply the consumer access measures to all retail customers when offering DPT services.

Treatment of DPT Holdings for Determining AI Eligibility 2.8.Respondents were broadly supportive of allowing DPTs to be considered as part of an individual’s net personal assets when determining AI eligibility.However, there were mixed views on the valuation approach to be applied for DPTs.In the consultation paper, MAS had mooted the options of fully excluding the value of DPT holdings (i.e.

, applying a 100% haircut), and applying a cap of S$200,000 (based on 10% of the S$2 million AI net personal asset criteria) on the value of DPTs used in determining AI eligibility.Respondents broadly agreed with these approaches, but there was no consensus on the exact haircut or cap that should be applied.Respondents also suggested other options, including the use of the average DPT valuation over a certain period of time, and conducting more frequent revaluations.

For MAS-regulated stablecoins, respondents were broadly supportive of allowing them to be treated in the same manner as fiat (i.e., no haircuts or caps to be applied).

MAS’ response 2.9.MAS has considered the feedback and will allow DPTs to be taken into account in determining AI eligibility.However, given the volatility and lack of economic fundamentals underpinning DPT values, it is prudent to apply an appropriate haircut to their valuations.For a start, the haircut will be set at a minimum of 50%.

Subjecting DPTs to a minimum 50% haircut would provide a level of consistency across the industry in ensuring minimum standards and provide guidance to DPTSPs and other FIs which may not have developed their own models for assessing and valuing DPTs in this context.For avoidance of doubt, DPTSPs and FIs may apply a higher haircut or adopt their own valuation models which achieve the same or more prudent outcome.

MAS also deems it appropriate to apply an overall cap on the value of DPTs to be taken into account, to avoid an overreliance on the value of DPTs when considering an individual’s net worth, and mitigate the possible situation of customers vacillating between being AI-eligible and not, given the highly volatile nature of DPTs.Hence, MAS will set out in the Guidelines that the DPT holdings that can be taken into account in determining AI eligibility should be set at:

the DPT valuation after applying a haircut of 50%13, or

whichever is lower.

The above treatment of DPTs will not apply to MAS-regulated stablecoins when assessing a customer’s AI eligibility.

Risk Awareness Assessment 2.12.Respondents were broadly supportive of requiring DPTSPs to assess if a retail customer had sufficient knowledge of the risks of DPT services before providing any DPT service to that customer.

While several respondents favoured the development of a common assessment template or question bank by the industry to ensure consistent implementation across DPTSPs, other respondents commented that it was important for DPTSPs to have sufficient flexibility to calibrate their risk awareness assessment to be appropriate for the services offered by a particular DPTSP.

A few respondents commented that MAS should provide guidance or principles on the conduct of the risk awareness assessment, which could be adopted by DPTSPs.

), limitations of regulatory protection, and more broadly, risks associated with DPTs.

There were mixed views on whether a cooling-off period would be necessary between re-assessments.While some respondents

DPTSPs and FIs may choose to apply a higher haircut based on their internal models and risk appetite. The FAQs on the Definition of Accredited Investor and Opt-in Process can be accessed at this link.

were of the view that a cooling-off period would be prudent and part of the process of encouraging retail customers to review educational material, other respondents thought that it was unnecessary.

Clarification was also sought on how DPTSPs would be expected to apply the risk awareness assessment requirement to existing retail customers.

MAS’ response 2.16.MAS will proceed with the proposal to require DPTSPs to assess if a retail customer has sufficient knowledge of the risks of DPT services before providing DPT services to that customer15.As an overarching principle, MAS would require DPTSPs to put in place the appropriate internal policies and procedures to ensure a fair and robust assessment.

MAS noted the strong support from respondents and industry associations on their interests to develop a common industry template or question bank which DPTSPs may draw from when administering the risk awareness assessment.MAS encourages the industry to take on this initiative, as this would be very helpful in developing consistent standards and harmonise the approach for the industry and customers.

MAS acknowledges that there may be differences in the services provided by individual DPTSPs, and DPTSPs should apply their minds in development of the risk awareness assessment to ensure that the assessment administered is relevant for their customers.

DPTSPs should note that the Guidelines, in this respect, is non-exhaustive, and that DPTSPs should consider additional risks to be included in the assessment which would be relevant to their provision of DPT services, and to their customers.

In the same vein, DPTSPs should ensure that the risk awareness assessment is focused on the risks of DPT services, and is not designed in a manner that trivialises the risks involved and/or comes across as promoting specific products, services or tokens.2.18.

For retail customers who have been initially assessed to have insufficient knowledge of the risks, MAS will proceed with allowing DPTSPs to conduct re-assessment(s) and for the retail customer to re-take the risk awareness assessment.MAS expects DPTSPs to have appropriate policies and procedures to facilitate and encourage retail customers to build their understanding and knowledge

This is consistent with IOSCO Final Report, which recommends that regulators should require a CASP to implement adequate systems, policies and procedures, including for providing disclosures, in relation to onboarding new clients, and as part of its ongoing services to existing clients. This should include assessing the appropriateness and/or suitability of particular cryptoasset products and services offered to each retail client.

of the risks involved (e.g., through provision of reliable, clear and independent educational material that explain the nature of activities and the associated risks involved in those activities) prior to being re-assessed.DPTSPs should also ensure that subsequent assessments remain equally robust, for example, by having a sufficiently diverse question bank and system to generate different questions for subsequent assessments.

If these measures are implemented well, MAS is of the view there is no need to impose a cooling-off period between re-assessment(s).However, MAS will continue to monitor the implementation of the risk awareness assessment and review our measures, if needed.

Thus, while MAS will not impose a validity period on the risk awareness assessment or require DPTSPs to re-assess retail customers at regular intervals, DPTSPs should have in place internal processes to review and update the risk awareness assessment administered and assess if retail customers should be required to undertake an updated risk awareness assessment or part thereof.

For example, to address future developments and risks, DPTSPs may consider structuring the risk awareness assessment in a modular manner, and require existing retail customers to be subsequently assessed on new modules instead of being re-assessed entirely.2.20.

In response to the request for clarification on the treatment of existing retail customers, MAS will clarify in the Guidelines that DPTSPs will be expected to conduct the risk awareness assessment for all retail customers prior to providing any DPT service after the Guidelines becomes effective.

Restrictions on Offering of Incentives 2.21.MAS sought comments on the proposal to restrict DPTSPs from offering incentives to retail customers, or any person (e.g., an existing customer or a celebrity16) to refer a DPT service to retail customers.Some respondents agreed with the restriction, as incentives such as free DPTs upon signup may unduly impair the judgment of retail customers to participate in DPT services.

However, the majority of respondents (comprising mostly DPTSPs and related associations) disagreed with the restriction.Some respondents were of the view that other consumer access measures, such as risk awareness assessments, would be adequate to mitigate consumer harm, while other respondents pointed out that the offering of incentives is not restricted in the capital markets space, where there

Under PS-G02 Guidelines on Provision of Digital Payment Token Services to the Public, DPTSPs should not engage third parties, such as social media influencers or third-party websites, to promote their DPT services to the general public in Singapore. This includes joint promotional campaigns to solicit new customers. The PS-G02 Guidelines may be accessed at this link.

is existing guidance in place17.In this regard, a few respondents suggested for MAS to adopt similar guidance for DPTSPs, for instance by permitting incentives up to certain prescribed limits.

A few respondents were of the view that the use of incentives embedded into educational initiatives, for instance through “learn and earn programmes”, would help to promote a better understanding of the risks relating to DPTs among retail customers.Several respondents cautioned that restricting DPTSPs from offering incentives could lead to retail customers turning to unregulated platforms.

MAS’ response 2.23.MAS has carefully considered the consultation feedback.MAS notes that any gift or incentive may unduly influence the decision of retail customers to trade in DPTs without fully considering the risks involved.MAS has also observed that the risks and volatility in DPT markets, as compared to capital market products, necessitates a stricter approach to mitigate the consumer harm.

This is in line with global regulatory developments, where a number of global regulators noted similar concerns and considerations, and have put in place similar restrictions on incentives.

This restriction will broadly apply to sign-up incentives, referral incentives and trading incentives that have an intent to entice consumers to trade in DPTs.MAS clarifies that the same restriction will apply to activities such as “learn and earn” programmes.This is because the “earn” component tends to be overemphasised or have undue focus, with the aim to entice retail customers to participate in DPT trading (e.g., through free DPT credits).

DPTSPs should therefore not offer such programmes in the spirit of this incentive restriction.

MAS consistently warns consumers about the risks of participating in DPT trading and the risks of dealing with unregulated entities19, including those that may operate in other jurisdictions which brings additional legal and jurisdictional risks.

FSG-G02 Standards for Marketing and Distribution Activities. PS-G02 Guidelines on Provision of Digital Payment Token Services to the Public.

Restrictions on Debt-Financed and Leveraged DPT Transactions 2.26.MAS proposed that DPTSPs should not: (i) provide to a retail customer any credit facility (whether in the form of fiat currencies or DPTs) to facilitate retail customers’ purchase or continued holdings of DPTs;(ii) enter into any leveraged DPT transaction20 with a retail customer or facilitate a retail customer’s entry into any leveraged DPT transaction with any other person;

or (iii) accept any payments21 made by the retail customer using a credit card or charge card, in connection with the provision of any DPT service.

Respondents that did not support the proposals suggested that the risks of debt-financing and leveraged DPT transactions can be addressed by risk disclosures, or by setting limits on the amount of leverage that retail customers may undertake.

A few respondents commented that preventing debt-financing or leveraged DPT transactions would be detrimental as retail customers would be unable to hedge their positions or that the restrictions would drive retail customers to unregulated offshore entities.

Requests for clarification were received on the scope of these restrictions, specifically, whether they would apply to DPT futures, options or other derivatives, and how the restrictions would interact with section 20 of the PS Act 22.2.28.On proposal (iii), the majority of respondents were unsupportive of MAS’ proposal to restrict DPTSPs from accepting credit card or charge card payments from retail customers.

A few respondents commented that the restriction was unnecessary because credit card usage was largely seen as a convenient means of payment, and that the risks of credit card financing were mitigated by existing requirements placed on credit card issuance and credit card limits.A few respondents suggested for MAS to consider introducing caps on the value of DPT transactions for which credit card payments would be allowed.

A few respondents also highlighted that DPTSPs would incur operational costs to differentiate payments made via credit cards or charge cards, as opposed to other payment cards.

A “leveraged DPT transaction” means a transaction to purchase or sell DPTs, where one counterparty provides to the other counterparty money, DPTs, property, or other collateral which represents only a part of the value of the transaction.

MAS’ response 2.29.MAS will proceed with the proposal to restrict DPTSPs from: (i) providing to a retail customer any credit facility to facilitate retail customers’ purchase or continued holdings of DPTs;and (ii) entering into any leveraged DPT transaction with a retail customer or facilitate a retail customer’s entry into any leveraged DPT transaction with any other person.

Such transactions would include margin trading, DPT futures, options and other derivative transactions.These restrictions would apply to new transactions when the Guidelines become effective.

For avoidance of doubt, the prohibition on carrying on a business of granting any credit facility to any individual in Singapore continues to apply to licensed DPTSPs.The restrictions in paragraph 2.29 will apply alongside section 20(1) of the PS Act, i.e., the DPTSP would also be restricted from providing credit facilities and entering into or facilitating leveraged DPT transactions in relation to all retail customers, which includes individuals and non-individuals (e.g.

, corporate entities).

While MAS recognises that credit card payments are seen as a convenient means of payment, MAS is of the view that credit card and charge card usage would allow retail customers easy access to debt financing, running counter to MAS’ policy intent to restrict purchases of cryptocurrencies on credit.

The concession for foreign-issued credit cards recognises that there are limited payment alternatives available for a foreign retail customer as compared to a retail customer in Singapore, who is able to make use of other payment modes.

Several respondents also highlighted that DPTSPs should adopt good risk management practices, including relevant best practices stipulated under MAS’ Risk Management Practices for Internal Controls23.3.2.MAS had noted in the consultation paper that the vertical integration of DPT activities within a single entity may give rise to COI.

We have observed that DPTSPs often perform multiple roles while operating a trading platform, such as: (i) matching orders from multiple market participants (similar to a market operator);(ii) routing customers’ orders to liquidity providers and trading venues (similar to a broker);and/or (iii) transacting on its own account as the counterparty to the customer (similar to dealing as principal or conducting proprietary trading), all within one legal and operating entity.3.3.

In this regard, many respondents agreed that further mitigating measures are needed to address COI arising from vertical integration of certain types of DPT activities within a single entity or a group of related entities.These measures include segregated trading desks, Chinese walls and separate reporting lines, monitoring and surveillance requirements, and functional or legal segregation of certain DPTSP functions.3.4.

Several respondents agreed with the consulted position to restrict a DPTSP or its related corporations from buying or selling DPTs for their own account on the DPT trading platform.They noted that recent events in the cryptocurrency space may necessitate such a restriction, and that the proposed restriction would be in line with rules under the SFA.

However, many respondents (comprising mostly DPTSPs and related associations) also expressed concerns over this proposal, as such a restriction could reduce liquidity, impede price discovery and timely settlement on the trading platform, the effects of which would be exacerbated if the restriction is extended to related entities.

While these respondents broadly agreed that principal trading for revenue generation should be restricted, they suggested that a DPTSP or its related corporations should be allowed to do so for purposes of liquidity provision and risk management, if they put in place controls (e.g.

Guidelines on Risk Management Practices – Internal Controls (link here).

effective Chinese walls) and customer disclosures.A few respondents also suggested an exemption to allow matched principal trading, where trades are executed on a riskless basis.3.5.

A number of respondents also suggested that if a DPTSP lists its own token or its related entities’ token(s) (“related token”) on its trading platform, the DPTSP should be subject to certain mitigating measures, including enhanced disclosures or an outright restriction on offering trading of related tokens.Two respondents sought clarification on whether a DPTSP would be restricted from having a financial interest in reserve-backed stablecoins listed on its platform.3.6.

To further mitigate the risk of misuse of information relating to customers’ orders, several respondents suggested for DPTSPs to put in place a system of reporting current best bid and offer prices (“CBBO”) across major DPT trading platforms, and for customer orders to be executed at prices no worse than the CBBO.

As regards mitigating COI arising from employees misusing information relating to customers’ orders, a number of respondents also suggested that DPTSPs should put in place policies such as personal account dealings, and trading blackout periods for employees with access to non-public information that may be materially price sensitive.

MAS’ response 3.7.MAS will proceed with the proposal for DPTSPs to establish and implement effective policies and procedures to identify and address COI, and disclose to customers the nature of activities and sources of COI, and the relevant measures and controls that the DPTSPs have put in place to mitigate the COI.3.8.

MAS has significant concerns over the potential consumer harm that arises from certain combinations of DPT activities conducted within the same DPTSP entity and its related entities.Depending on the combination of DPT activities, DPTSPs should put in place specific mitigating measures, as described in paragraphs 3.9 – 3.12, that can address and minimise consumer harm.

These mitigating measures are also broadly in line with (1) global regulatory developments, (2) policy recommendations in IOSCO’s Final Report to address COI for trading of DPTs24;and (3) existing requirements in the capital markets.

This is consistent with IOSCO Final Report, which recommends that a regulator should consider whether certain conflicts are sufficiently acute that they cannot be effectively mitigated, including through effective systems and controls, disclosure, or prohibited actions, and may require more robust measures such as legal segregation of functions and activities, as well as separate registration and regulation of certain activities and functions to address this recommendation.

related entities also transacts on its own account25 on that market.This is because the DPTSP has significant opportunity and incentive to misuse information related to customers’ orders placed on its market.Hence, a DPTSP and its related entities should not trade on markets that they operate, unless for the purposes of matched principal trading26.3.10.

Where a DPTSP conducts the following combinations of DPT activities within the same entity, the DPTSP should put in place the following measures: i.

Operating a market and acting as a broker: Where a DPTSP operates a market and also acts as a broker, it should set up separate legal entities with separate management teams such that the two functions are independent of one another, and provide clear client disclosures27.This is because the DPTSP may not independently perform its obligations as a broker to the client to source the best terms (e.g.

, prices) across markets and platforms for its customers, as the DPTSP itself is also operating a market.

ii.Acting as a broker and transacting on own account: Where a DPTSP acts as a broker and also transacts on its own account, it should put in place proper functional segregation (e.g., separate reporting lines) and effective Chinese walls.This is because the DPTSP is susceptible to unfair trading practices, such as front running of customer orders.

The DPTSP should also provide clear client disclosures so that the customer is aware of the capacity and manner in which the DPTSP is executing the customer order27.

However, MAS has also observed instances where a DPTSP may have developed a business proposition around tokens that itself or its related entity has issued, and has continued to offer these tokens for trading on its platform.

While there are ongoing regulatory developments and discussions on how to address this form of COI, MAS recognises that an outright prohibition at this time could be of significant impact to such DPTSPs, and further assessment of this issue would be required.We will continue to monitor global regulatory developments in this regard, and will continue to engage closely with the industry.

Where the DPTSP is the counterparty to the customer, similar to dealing as principal or conducting proprietary trading.In such transactions, the DPTSP is never exposed to market risk throughout the transaction.

and (iii) proprietary holdings of any tokens at the point of token listing.DPTSPs may also consider further disclosures, such as the quantum or size of such proprietary holdings and provide suitable frequency of periodic updates of these holdings following token listing, which may be useful information for customers.MAS expects these disclosures to be made in relation to the listing and trading of all DPTs.3.13.

In addition, MAS expects DPTSPs to assess the effectiveness of the mitigating measures to address any potential COI on a regular basis, and take a prudent approach should the measures be assessed to be inadequate to effectively address COI.Examples of effective mitigating measures include segregating the functions or activities into separate legal entities with independent management oversight, or to discontinue the activity/activities completely.3.14.

As part of the regular review process, DPTSPs should also conduct close monitoring of their employees’ trading activities, and their access to material non-public information to safeguard clients’ interests.MAS will provide more details in this regard in the response to the "Consultation Paper on Proposed Measures on Market Integrity in DPT Services”30.

Disclosure of DPT Listing and Governance Policies 3.15.Most respondents agreed with the proposal for DPT trading platform operators to publish policies and procedures related to selecting, listing and reviewing DPTs offered on their platform.This will provide customers with clear and relevant information on the DPTSPs’ policies and procedures used to evaluate prospective tokens prior to their listing and thereafter, conduct periodic reviews on listed tokens.

These policies and procedures should address the following matters: i.

the criteria, due diligence, processes and fees applied in making a DPT available for trading on the DPT trading platform;

This is consistent with IOSCO Final Report, which recommends that regulators should require a CASP to manage and mitigate conflicts of interest surrounding the issuance, trading and listing of crypto-assets.This should include appropriate disclosure requirements and may necessitate a prohibition on a CASP listing and/or facilitating trading in, its own proprietary cryptoassets, or any crypto-assets in which the CASP, or an affiliated entity, may have a material interest.

ii. the conditions under which DPTs may remain available for trading, be suspended or removed from trading;

iii. the processes by which DPTs are removed from trading, and the rights available to customers;

iv. how risks of unfair or disorderly trading of DPTs are addressed on the DPT trading platform; and

the settlement procedures of DPT transactions.

Several respondents pointed out that listing policies and procedures may contain proprietary information, and suggested instead for disclosures to only be made to MAS, and not publicly disclosed.One respondent suggested for MAS to whitelist DPTs for purposes of bilateral trading, which would provide for more uniform regulatory outcomes.Another respondent suggested for industry bodies to formulate an industry-wide harmonised “listing framework” that can be adopted by DPTSPs.3.

One respondent sought clarification whether DPTSPs could rely on third-party arrangements to conduct due diligence on prospective tokens.

One respondent was of the view that disclosures should focus on the listing policy and procedures, rather than evaluation outcomes of specific tokens which may be misconstrued as investment advice.

MAS’ response 3.19. MAS will proceed with the proposal for DPTSPs to publicly disclose their listing and governance policies for tokens listed and offered on their markets and trading platforms. All DPTSPs should Response to Feedback Received on Proposed Regulatory Measures for Digital Payment Token Services (Part 2)

assess whether they have provided sufficient and understandable information to allow customers to make informed decisions about how they have applied their evaluation criteria before making a DPT available for trading on their DPT trading platform.MAS expects senior managers to have responsibility, control and oversight over the DPTSP’s listing and governance policies, including being responsible for listing, suspension and de-listing decisions.3.20.

MAS has consistently noted the lack of economic fundamentals in relation to the prices of DPTs, and the rapidly evolving DPT trading and regulatory landscape.We also note several respondents’ feedback that details of the listing policies and procedures could be regarded as proprietary and commercially sensitive.Against this background, MAS does not view it as appropriate for MAS to prescribe a set of common listing evaluation criteria or to whitelist DPTs for trading.

It is the DPTSPs that are ultimately accountable and responsible for the DPTs made available for trading on their trading platforms, including the use of any third-party outsourcing arrangements, the proper and adequate disclosure of their listing and governance policies, and for customers to be aware that they need to be able to understand and assess the information, as well as the clear risks presented, if they intend to trade in DPTs.3.21.

MAS notes the consultation feedback that COI may arise where DPTSPs receive incentives for listing certain DPTs.As noted in paragraphs 3.7 and 3.13, DPTSPs should consider appropriate measures (e.g., clear customer disclosures, segregation of functions) to address COI, including any which may arise from commercial decisions that may impede the effectiveness and independence of its DPT listing and governance policies and procedures.3.22.

On the format of disclosures, these should be made to all customers in a clear, legible and concise manner.DPTSPs should not disclose the policies and procedures in a way that trivialises the risks of DPT trading.As the disclosures should be specific to the DPT listing and governance policies of the DPTSP, there will not be a prescribed template or form.

Complaints Handling and Dispute Resolution 3.23. Respondents were generally supportive of the proposal for DPTSPs to put in place adequate policies and procedures to handle customer complaints, which will provide assurances to customers that their concerns are dealt with in a fair and timely manner. These policies and procedures include: i.

appointing a member of senior management, or committee of members, who are not directly involved in the provision of DPT services to oversee complaints handling;

ii. establishing a complaints handling unit that is not directly involved in the provision of DPT services; and

iii. establishing a process for handling and resolving complaints in a fair and timely manner.

Another respondent suggested that DPTSPs should be required to submit complaints data to MAS to enhance accountability.

A few respondents however suggested that DPTSPs should have the flexibility to agree on a suitable dispute resolution mechanism with their retail customers, given the cross-border nature of DPT transactions.

A few respondents suggested that DPTSPs be required to subscribe to FIDReC, which is in line with existing requirements related to dealings with traditional FIs and investment products.

MAS’ response 3.27.MAS will proceed with the proposal for DPTSPs to put in place complaints handling policies and procedures31.This will be broadly aligned with the scope and rules set out under the Financial Advisers (Complaints Handling and Resolution) Regulations 2021.Such policies and procedures should apply minimally to DPTSPs’ dealings with their retail customers, and to all complaints relating to DPTSPs’ provision of DPT services.

MAS will not, at this point in time, require DPTSPs to submit regular returns on complaints data to MAS, but DPTSPs are expected to properly monitor and track complaints and complaints trends, such that customer complaints are handled and resolved in a fair and timely manner, and to be able to provide such information to MAS when requested.To minimise conflicts of interest, the unit in charge of handling customer complaints should not be directly

This is consistent with IOSCO Final Report, which recommends that regulators should require CASPs to have an efficient and effective mechanism to address client complaints.

involved in the provision of DPT services.This unit could sit with the compliance function, which should be independent of its business-facing functions.

This is because retail customers would be disadvantaged if the recourse process is difficult to access or becomes protracted in a disproportionate way.MAS notes that DPTSPs may voluntarily engage the services of FIDReC as an alternative dispute resolution channel on an ad-hoc basis for an agreed case fee.

While MAS does not require DPTSPs to subscribe to FIDReC’s services, MAS is supportive of industry associations coming together to discuss possible membership arrangements with FIDReC.

Some respondents opined that the recovery time objective (“RTO”) for critical systems should be assessed by the nature of the business conducted by the DPTSPs and subjected to the service commitment made by the DPTSPs to its customers.

Additionally, some respondents wished to clarify if an event affecting the blockchain underlying a DPT that in turn affected the DPTSP’s service would be considered as unscheduled downtime.

These respondents highlighted that each FI would require time to investigate and confirm that an IT incident has occurred.Separately, one respondent suggested to streamline data breach reporting with Personal Data Protection Commission (“PDPC”) under Personal Data Protection Act (“PDPA”).

MAS’ response 4.4.MAS will mandate the requirements in the Notice, i.e., MAS Notice PSN0532, to DPTSPs.MAS agrees that DPTSPs should perform a risk assessment and determine the system recovery and business resumption priorities.

However, in the context of “critical systems” as defined in the Notice, DPTSPs are required to implement an effective and swift recovery strategy for systems where a system failure will lead to a severe and widespread impact on its operations or materially impact the DPTSP’s customers.It is important that the critical systems can be quickly recovered so as to

MAS Notice PSN05, issued under the PS Act, sets out requirements for a high level of reliability, availability and recoverability of critical IT systems and for such entities to implement IT controls to protect customer information from unauthorised access or disclosure (link here).

minimise adverse impact on the DPTSP’s operations and reputation, or in maintaining customer confidence.

A “critical system” means a system, the failure of which will cause significant disruption to the operations of the FI or materially impact the FI's service to its customers.This includes systems which process transactions that are time critical, or provide essential services to customers.

If a system supports the DPTSP’s essential functions and in the event of failure does not cause significant disruption to the DPTSP’s operations or materially impact the DPTSP’s customers, the DPTSP should assess whether the system should be identified as a “critical system”.

ii. As each DPTSP is in a better position to understand the importance of their systems to their business, it is essential that the DPTSP establishes a proper framework and process to assess and identify the type of threshold of such “severe and widespread impact”.

iii. The 4 hours RTO will not apply to the underlying public blockchain of DPTs.

MAS should be notified at all times of any system malfunction or IT security incident, as defined in the Notice, when the event has a severe and widespread impact on the DPTSP’s operations, or materially impacts the DPTSP’s service to its customers, even if it has occurred during non-business hours.DPTSPs should notify MAS of IT incidents according to the Notice’s requirement, and also notify PDPC of any data breaches as required under PDPA.

, up to 15 months) to facilitate a smoother transition, given the wide range of proposed measures.Several respondents also suggested for a phased approach towards implementation.Depending on the complexity of implementation, the proposals that are likely to involve major technological and operational changes or require buy-in from multiple stakeholders (e.g., development of a common risk assessment template) may necessitate a longer transition period.

MAS’ response 5.3.MAS notes the consultation feedback.To implement asset segregation and custody measures, MAS had published the consultation response and the proposed amendments to the subsidiary legislation in July 2023.The final subsidiary legislation will be published in due course, and there will be a 6-month transition period for implementation.5.4.

Additional implementation details for the measures covered in this response paper will initially be provided in the form of Guidelines to be published in mid-2024 with a 9-month transition period for implementation.This will provide for timely implementation in a manner that is aligned with the pace of global regulatory developments.MAS will also mandate the requirements in the Notice, i.e.

, MAS Notice PSN05, to DPTSPs in early 2024 with a 9-month transition period for implementation.MAS encourages the industry to start early preparations to implement these measures and will continue to engage industry on the implementation progress.