Payment Services Act 2019 regulatory framework

The PS Act widens MAS’ regulatory scope to address new risks posed by existing payment services and to include new payment services.With a modular and risk-based regulatory approach, the PS Act is a flexible regulatory framework that reduces the impact of a failure of a payment service provider while promoting a progressive payments sector in Singapore.

A payment system may be designated if it is considered a SIPS or a SWIPS, or where it is otherwise in the public interest to do so: a) SIPS are systems where a disruption in the operations could trigger, cause or transmit further disruption to participants or cause systemic disruption to the financial system of Singapore;and b) SWIPS are systems where a disruption in the operations could affect public confidence in payment systems or the financial system of Singapore.

Although a disruption or failure in SWIPS may have system-wide implications and may affect many users, there is negligible risk of systemic impact to financial stability.The PS Act provides another basis for designation, which is to ensure better efficiency and competition in the financial system.

This framework therefore allows MAS to also designate a payment system if it is widely used in Singapore, or if its operations may have an impact on the operations of one or more other payment systems in Singapore, and the designation is necessary to ensure efficiency or competitiveness in any of the services provided by the operator of the payment system.

DPT services; and

g) money-changing service. To explain the scope of payment services regulated under the PS Act, Table 1 sets out a brief description of each regulated payment service. Table 1: Description of Regulated Payment Services

Payment Service

Description

Account issuance service

Issuing or providing services relating to the operation of a payment account in Singapore. Payment accounts include an e-wallet or a credit card.

Domestic money transfer service

Providing local money transfer services in Singapore.

Cross-border money transfer service

Providing inbound and/or outbound remittance services in Singapore.

Merchant acquisition service

Providing merchant acquisition services in Singapore. This is where the service provider contracts with a merchant to accept and process payment transactions, which results in a transfer of money to the merchant.

E-money issuance service

Issuing e-money in Singapore to allow a person to pay merchants or transfer e-money to another person.

DPT service

Buying or selling DPT, or providing a platform to allow persons to exchange DPT in Singapore.

Money-changing service

Buying or selling foreign currency notes in Singapore.

MAS published a consultation paper 1 to discuss the scope of e-money based payment services and DPT services under the PS Act.MAS will continue to participate in international work on the regulation of stablecoins, and monitor trends and developments in payment services, including stablecoins.

and c) Brokering of DPT transactions (without possession of money or DPTs by the DPT service provider) MAS has highlighted in the consultation paper on 6 June 2019 3 that DPT transactions are considered to carry higher inherent ML/TF risks due to the anonymity, speed and crossborder nature of the transactions.This is consistent with the position taken by the FATF 4, and in particular, the enhanced FATF Standards in June 2019 requiring jurisdictions to regulate 1

Consultation on the Payment Services Act 2019: Scope of E-money and Digital Payment Tokens Consultation on the Payment Services Act 2019: Proposed Amendments to the Act 3 Consultation Paper on the Proposed Payment Services Notices on Prevention of Money Laundering and Countering the Financing of Terrorism 4 The FATF sets the international standards for AML/CFT.

It promotes the global adoption of the FATF standards, and ensures member countries’ and the global network’s compliance with those standards through peer evaluations and follow-up assessments.2

what it has termed as virtual asset service providers for AML/CFT.As such, MAS will amend the PS Act to align Singapore’s regime with the enhanced FATF standards.In addition, MAS intends to expand the regulatory scope of cross-border money transfer service to capture entities that provide the service of brokering of cross-border money transfers between entities in two different jurisdictions, although money is not necessarily accepted or received in Singapore.

This is to address the ML/TF risks associated with such business models.

Descriptions of the three classes of licences are as follows: i.

Money-changing licence Licensees can provide only money-changing services. The regulation is quite narrow in scope as these services are often provided by small businesses such as sole proprietors offering over-the-counter services with limited risks.

ii. SPI licence Licensees may provide any combination of the seven regulated payment services, if they process payment transactions or hold e-money float below specified thresholds. SPIs are subject to lighter regulations to encourage innovation and enterprise in smaller businesses.

iii. MPI licence MPIs may provide payments services above the specified thresholds. As the scale of their operations would pose more risk, they are subject to more comprehensive and robust regulation.

References to legislation Overview of the PS Act

3.1 Requirements for licence applicants 3.1.1

Registered business

Every applicant, other than an applicant for a money-changing licence, must be a company incorporated in Singapore or a corporation formed or incorporated outside Singapore.

3.1.2 Operations in Singapore

An applicant must have a permanent place of business or registered office in Singapore. An applicant should note that licensees will be required to ensure that customers can seek redress and MAS can access the licensee's books at the permanent place of business or registered office in Singapore.

3.1.3 Executive directors

The PS Act requires that any applicant applying for a SPI licence or MPI licence must have at least one executive director who is a Singapore citizen or PR. Alternatively, an applicant may have an executive director who is an employment pass holder if the applicant has at all times, at least one director who is a Singapore citizen or PR.

3.2 Right sizing permissible activities

3.2.1 Prohibition of credit and deposit facilities

Two sets of measures are in place to differentiate payment services licensees from deposittaking institutions such as banks. First, the PS Act prohibits all licensees from carrying on a business of granting any credit facility to any individual in Singapore, and all regulated entities that provide e-money issuance services from lending any customer money or using any

customer money or interest earned on any customer money, to finance their business activities, wholly or to any material extent.MAS has right-sized regulations under the PS Act to the key risks that payment services pose.If licensees want to engage in banking or other regulated activities such as consumer lending, licensees should apply for the relevant licence.

Second, all regulated entities providing account issuance services are prohibited from offering cash withdrawals in Singapore dollars from payment accounts storing e-money that are held by Singapore residents.The PS Act aims to promote greater adoption of electronic payments rather than the use of cash, and preserves the privilege of FTA partners, whose banks can offer cash withdrawal services.

3.2.2 Stock Cap and Flow Cap for MPIs

A stock cap and flow cap on personal payment accounts issued by MPIs have been imposed to protect customers by limiting a customer’s potential loss from the customer’s account.These caps also ensure continued stability of the financial system by reducing the risk of significant outflows from banks deposits to e-money, which can undermine the stability of banks.

Personal payment accounts issued by a MPI are subject to a load capacity of $5,000 and an annual transaction flow cap of $30,000.

3.2.3 Prohibition against solicitation

To ensure that payment services offered to the public in Singapore are properly regulated under the PS Act and that accurate information about such payment services is provided, the PS Act prohibits any person from soliciting for the provision of payment services, unless that person is a licensee, an exempt payment service provider (such as a bank) or a person exempted from licensing.

In addition, the PS Act also prohibits any person in Singapore (including licensees or exempt payment service providers) from soliciting for the provision of payment services on behalf of persons overseas that are not licensees or exempt payment service providers.Third parties may solicit for the provision of payment services by licensees, exempt payment services providers, and persons exempt from licensing.

However, licensees and exempt payment service providers are required to ensure that third parties make certain disclosures in every offer, invitation or advertisement the third parties make on their behalf under PSN08.Regulated entities are not allowed to solicit for payment services to be provided by related companies overseas, such as the regulated entity’s head office, where the related companies overseas are not licensees or exempt payment service providers.

3.3.1 Money-changing licensee

Money-changing licensees are not required to meet minimum financial requirements such as minimum paid up capital, in recognition of the nature and scale of money-changing businesses which are typically over-the-counter services operated by small businesses including sole proprietors.

3.3.2 SPIs

SPIs are restricted to accepting, processing or executing payment transactions where the total value is $3 million or less in a month for one payment service, and $6 million or less in a month for any two or more payment services.They are also restricted to holding an average daily e-money float of $5 million or less.

The minimum initial and ongoing financial requirements for SPIs is a base capital of not less than $100,000 (where the SPI is incorporated in Singapore), or net head office funds of not less than $100,000 (where the SPI is a foreign company).

3.3.3 MPIs

There are no restrictions in payment transaction flows or thresholds for MPIs.The minimum initial and ongoing financial requirements for MPIs is the base capital of not less than $250,000 (where the MPI is incorporated in Singapore), or net head office funds of not less than $250,000 (where the MPI is a foreign company).MPIs are also required to maintain a security deposit as a small buffer for the protection of customer money.

MPIs who accept, process or execute payment transactions where the total value is $6 million or less in a month in respect of each payment service are required to place a security deposit of $100,000.Licensees that conduct higher volume transactions (above $6 million) in respect of any payment service are required to place a security deposit of $200,000.

Some key requirements in PSN07 include: 3.4.1

Issuance of receipt

MAS requires licensees providing domestic money transfer services, cross-border money transfer services, e-money issuance services, DPT services, or money-changing services, to issue a receipt for every transaction with a customer that is an individual or sole-proprietor, or when the customer requests a receipt.

The receipt may be issued in paper or electronic form, and may be issued as a single receipt for each transaction accepted, processed or executed, or a consolidated receipt for all transactions accepted, processed or executed over a period of not more than 90 days.

MAS requires that every licensee must have at least one person present at the permanent place of business or registered office for at least 10 days a month, and for at least eight hours for each of those days. This is to ensure that the public has ample opportunity to reach the licensee. Any notification of changes to its normal business days and hours should be publicised to all its customers and potential customers.

5 MAS has published a series of MoneySense articles for consumers

1.

Risk of Cryptocurrencies, Initial Coin Offerings and Other Digital Tokens : https://www.moneysense.gov.sg/articles/2018/10/risks-of-cryptocurrencies-initial-coin-offerings-and-otherdigital-tokens Understanding E-wallets: https://www.moneysense.gov.sg/articles/2018/10/understanding-stored-value-facilities Understanding Money Transfers : https://www.moneysense.gov.sg/articles/2018/10/understanding-remittance Understanding Money-changing : https://www.moneysense.gov.

sg/articles/2018/10/understanding-money-changing

MPIs are required to safeguard customer money received in respect of certain payment services.As a MPI may safeguard customer money in a currency different from that received from its customer, it is necessary that MPIs use a standardised exchange rate to compute the amount of money to be safeguarded.Hence, MAS requires a MPI to adopt exchange rates published by its safeguarding institution to safeguard customer money.

A MPI which provides domestic money transfer services, cross-border money transfer services or merchant acquisition services must apply the exchange rate it offers to its customer for that service, where it is applicable.The display of exchange rate requirements will only apply when the regulated entity offers an exchange rate at the point of transaction.

Where a currency conversion is performed and the regulated entity that provides an applicable payment service6 does not offer an exchange rate at the point of transaction, and instead the exchange rate is determined by a third party, the regulated entity will be required to disclose in writing to the customer that the exchange rate is not available at the point of transaction and will be determined by a third party at a later date.

Where a DPT service provider does not offer an exchange rate, the DPT service provider must disclose in writing to the customer that the exchange rate will be determined by a third party.

References to legislation Licensing Requirements for Payment Service Providers

Applicable payment service here refers to a domestic money transfer service, cross-border money transfer service or e-money issuance service.

 PSN08 Notice on Disclosures and Communications

3.4 Business Conduct Requirements  PSN07 Notice on Conduct

At this point, there is no significant change in requirements in the regulations under the PS Act that are imposed on operators, settlement institutions and participants of such payment systems.

b) Apart from MEPS+, payment systems that may pose system-wide impact during a disruption, such as FAST, Singapore Dollar Cheque Clearing System, US Dollar Cheque Clearing System, Inter-bank GIRO System and NETS Electronic Fund Transfers at Point of Sale are also designated as SWIPS to avoid potential loss of public confidence in payment systems or the financial system of Singapore.

References to legislation Requirements for DPS Entities

Activity

ML/TF Risks

User Protection

Interoperability

Technology and Cyber Security Risks

Account issuance AML/CFT service requirements for specific providers

Protection of Access to funds

Access Regime, Common Platform, Common standards

Technology Management Guidelines

Domestic money AML/CFT transfer service requirements for specific providers

Safeguarding of Funds in Transit

Cross-border AML/CFT money transfer requirements service for specific providers

Safeguarding of Funds in Transit

Cyber Hygiene requirements

Merchant acquisition service

Safeguarding of Funds in Transit

Access Regime, Common Platform, Common standards

E-money issuance service

Safeguarding of Float

DPT service

AML/CFT requirements for all providers

Money-changing service

AML/CFT requirements for all providers

PSN02 will apply to licensees which carry on a business of providing DPT services.However, a licensee does not

need to comply with MAS’ AML/CFT requirements if it only provides payment services that meet the low risk criteria for ML/TF.The MAS-defined low-risk criteria are set out in paragraph 3.2 of the PSN01.7 The key AML/CFT requirements for all licensees include (but are not limited to) the following: a) Taking appropriate steps to identify, assess and understand the licensee’s ML/TF risks;

b) Developing and implementing policies, procedures and controls – including those in relation to the conduct of CDD, transaction monitoring, screening, suspicious transaction reporting and record keeping, in accordance with PSN01 and/or PSN02 – to enable the licensee to effectively manage and mitigate their ML/TF risks;c) Monitoring the implementation of those policies, procedures and controls, and enhancing them as necessary;

and d) Performing enhanced measures where there is higher ML/TF risks to effectively manage and mitigate those higher risks.Licensees should refer to PSN01 and/or PSN02, and the accompanying Guidelines to the respective notices, for the full set of AML/CFT requirements and MAS’ supervisory expectations that will be applicable to their businesses.From time to time, MAS may also provide additional AML/CFT guidance which licensees should also consider.

SPIs are smaller payment firms that process a lower volume of payment transactions or hold less e-money float as compared to MPIs.

Money Laundering and Countering the Financing of Terrorism that was issued on 6 June 2019 and MAS’ Response to the Feedback Received on the Consultation Paper, for full details on the criteria for MAS-defined low risk activities and AML/CFT requirements for payment service providers.

Safeguarding of funds in transit and e-money float

MPIs and exempt payment service providers are required to safeguard customer money from their insolvency in respect of domestic money transfer service, cross-border money transfer service, merchant acquisition service and e-money issuance service (for specified e-money8).These entities are required to safeguard customer money for these services using any of the following means: a) an undertaking from a bank in Singapore, a merchant bank or a finance company;

b) a guarantee from a bank in Singapore, a merchant bank, a finance company, or a financial guarantee insurer;c) a deposit in a trust account held with a bank, merchant bank or finance company;or d) safeguarding in such other manner as may be prescribed by MAS.MPIs do not need to comply with safeguarding requirements for customer money received for DPT services and money-changing services.

MPIs also do not need to safeguard customer money owing to foreign merchants if they comply with disclosure requirements specified in the relevant regulations.SPIs are not required to comply with safeguarding requirements but must disclose certain information to their customers so that customers can make informed decisions on which payment service provider best suits their needs.ii.

Guidelines on e-payments user protection

MAS has developed a set of E-Payments User Protection Guidelines that set out the best practice standards for FIs that issue protected accounts9.For example, responsible FIs such as banks, MPIs, finance companies and non-bank credit card issuers, are expected to provide timely transaction notifications to users, as well as investigate, assess and provide compensation for, where applicable, claims of unauthorised transactions in a timely manner.

Where an account holder of a protected account suffers a loss from an unauthorised transaction resulting from any action or omission by the responsible FI, the responsible FI is expected to bear the entire loss.

On the other hand, where an account holder of a protected account suffers a loss from an unauthorised transaction resulting from any action or omission of an independent third party, the account holder is not liable for any loss where the transaction amount does not exceed $1,000.For transactions exceeding $1,000, the responsible FI should investigate further and may offer to reduce the account holder’s liability on a case-by-case basis.

“Specified e-money” is a defined term in the PS Act; please refer to the PS Act “Protected account” is a defined term in the E-Payments User Protection Guidelines; please refer to the E-Payments User Protection Guidelines 9

For example, PayNow allows realtime payments between participants via their respective payment applications, including by internet banking and mobile banking channels 10.The development of a standardised and unified SGQR code combines the payload details of different electronic payment schemes that a merchant or business accepts, making QR payments simple for both consumers and businesses.

b) A MPI must participate in a specified common platform or enter into an equivalent arrangement to achieve interoperability of payment accounts issued by that MPI and other payment service providers.c) A MPI must adopt a common standard to make widely-used payment acceptance methods interoperable.MAS will continue to engage payment players to improve interoperability before using the interoperability powers under the PS Act.

At the time of publication of this paper, the PayNow participants comprise nine banks.

technology could also expose the firms to cybersecurity risks such as data breaches, fraud and operational disruption. To strengthen cyber resilience, MAS has established requirements and guidelines to help FIs manage cyber risks. The PS Act gives MAS powers to monitor and impose these requirements on payment service providers.

Cyber Hygiene Notice All operators of DPS and licensees must implement the cyber hygiene requirements in PSN06 by 6 August 2020.The requirements are basic cyber security measures to establish baseline defences and controls against cyber threats.iii.

Guidelines on Technology Risk Management MAS Guidelines on Technology Risk Management set out IT risk management principles and best practices to guide FIs in establishing a robust technology risk management framework, strengthening cyber security controls, enhancing system resiliency, and implementing strong authentication measures to protect customer data, transactions and systems.The guidelines apply to operators and settlement institutions of DPS, as well as licensees.

References to legislation Mitigating Key Risks in Payment Services

5.1 Overview of Key Measures  Payment Services Act 2019

5.

ent Services (Exemption for Specified Period) Regulations 2019  PSN02 Notice on Prevention of Money Laundering and Countering the Financing of Terrorism - Holders of Payment Service Licence (Digital Payment Token Service)  Guidelines to Notice PSN02 on Prevention of Money Laundering and Countering the Financing of Terrorism – Digital Payment Token Service

 MAS Technology Risk Management Guidelines

Additionally, domestic money transfer service providers that only facilitate the domestic leg of cross-border money transfers on behalf of a customer of a) a licensed cross-border money transfer service provider;b) a person who is exempted from holding a licence to perform cross-border money transfer service under regulation 28(1);or c) an exempt payment service provider, do not need to hold a licence to provide cross-border money transfer services.

Disclaimer: This paper provides guidance on the licensing and regulation of payment service providers, the oversight of payment systems, and connected matters.The paper does not constitute legal advice.In particular, the “References to legislation” in this paper are not exhaustive.

MAS expects industry participants to retain their independent legal counsel to advise them on how their business operations should be conducted in order to satisfy legal and regulatory requirements, and to advise them on all applicable laws, rules and regulations of Singapore.

Anti-Money Laundering and Counter-Financing of Terrorism

Money-Changing and Remittance Businesses Act

(New) MAS Electronic Payment and Book Entry System

Money-Laundering and Terrorism-Financing

Systematically Important Payment System

APPENDIX B Regulations, Notices and Guidelines

The following regulations, notices and amendments to guidelines came into force on 28 January 2020, with the exception of, PSN06 (which will come into force on 6 August 2020) and further amendments to E-Payments User Protection Guidelines (which will come into force on 5 September 2020).

Regulation Payment Services Regulations 2019

Regulations issued under the PS Act that apply to entities regulated under the PS Act.

Regulation Payment Services (Composition of Offences) Regulations 2019

Regulations issued under the PS Act that set out the offences which are compoundable under the PS Act.

Regulation Payment Services (Exemption for Specified Period) Regulations 2019

Regulations issued under the PS Act that set out exemptions that are applicable during certain specified periods.

Regulation Payment Services (Saving and Transitional Provisions) Regulations 2019

Regulations issued under the PS Act that provide for saving and transitional arrangements for entities regulated under the PS Act.

Regulation Payment Services (Singapore Dollar Regulations issued under the PS Act Cheque Clearing System and Interthat set out requirements in respect Bank GIRO System) Regulations 2019 of the Singapore Dollar Cheque Clearing System and Inter-bank GIRO System. Notice

PSN01 Notice on Prevention of Money Laundering and Countering the Financing of Terrorism - Holders

AML/CFT requirements for payment service providers (other than a DPT service provider)

of Payment Services Licence (Specified Payment Services) Notice

PSN01A Notice on Prevention of Money Laundering and Countering the Financing of Terrorism - Persons Providing Account Issuance Services Who Are Exempted Under the Payment Services (Exemption for Specified Period) Regulations 2019

AML/CFT requirements to facilitate the transition of stored value facility holders previously regulated under the PS(O)A

PSN02 Notice on Prevention of Money Laundering and Countering the Financing of Terrorism - Holders of Payment Service Licence (Digital Payment Token Service)

AML/CFT requirements for DPT service providers

PSN03 Notice on Reporting of Suspicious Activities and Incidents of fraud

PS Notice issued under the PS Act on regulated entities’ obligation to report suspicious activities and incidents of fraud.

PSN04 Notice on Submission of Regulatory Returns

PS Notice issued under the PS Act on regulated entities’ obligations to submit regulatory returns.

PSN04A Notice on Submission of Statement of Transactions and Profit/Loss

PS Notice issued under the PS Act on regulated entities’ obligations to submit statements of transactions and profit or loss.

PSN05 Notice on Technology Risk Management

PS Notice issued under the PS Act that set out requirements on technology risk management.

PS Notice issued under the PS Act that set out cyber hygiene requirements.

PS Notice issued under the PS Act that set out requirements on the

conduct of business by entities regulated under the PS Act. Notice

PSN08 Notice on Disclosures and Communications

PS Notice issued under the PS Act that set out disclosures and communications that entities regulated under the PS Act are required to provide and comply with.

PSN09 Notice on Specified Matters and Forms

PS Notice issued under the PS Act that set out administrative matters and forms.

PSN10 Notice on Prevention of Money Laundering and Countering the Financing of Terrorism – Exempt Payment Service Providers

PS Notice to exempt payment service providers on the application of AML/CFT requirements to the provision of payment services for specified products

Guidelines E-payments User Protection Guidelines at commencement

Covers application of the guidelines, liabilities and specific duties of various stakeholders in relation to unauthorised or erroneous transactions.

Guidelines Further amendments to E-Payments User Protection Guidelines

Amended guidelines to include all MPIs and exempt payment service providers that issue payment accounts containing specified emoney.

Guidelines Guidelines to Notice PSN01 on Prevention of Money Laundering and Countering the Financing of Terrorism - Specified Payment Services

Guidance to payment service providers (other than DPT service providers) on the AML/CFT requirements in PSN01

Guidelines Guidelines to Notice PSN02 on Prevention of Money Laundering and Countering the Financing of

Guidance to DPT service providers on the AML/CFT requirements in PSN02

Terrorism - Digital Payment Token Service Guidelines MAS Technology Risk Management Guidelines

Risk management principles and best practice standards to guide FIs in managing technology risk.

Sets out the fit and proper criteria applicable to all licensees.

Guidelines on Fit and Proper Criteria [FSG-G01]