Guidelines on Licensing for Payment Service Providers PS-G01

Monetary Authority of Singapore PAYMENT SERVICES ACT 2019 (ACT 2 OF 2019) GUIDELINES ON LICENSING FOR PAYMENT SERVICE PROVIDERS

Guidelines on Licensing for Payment Service Providers 1 Guideline No: PS-G01 Issue Date: 18 December 2019 Last Revised Date: 8 October 2025 GUIDELINES ON LICENSING FOR PAYMENT SERVICE PROVIDERS TABLE OF CONTENTS

1. Purpose ……………………………………………………………….…...……………. 2
2. Licences under the Payment Services Act …………………….....………………. 2
3. Admission Criteria …………..………………………………………………………… 5
4. Licence Application Requirements …………….…………………….……………. 8
5. Ongoing Requirements for Licensees …………….…………………….………… 11 Appendices …………………………………………………………………………... 13 A1 - Governance and Ownership Requirements A2 - Minimum Compliance Arrangements A3 - Guidance on Licence Applications A4 - Fees A5 - Rules of Engagement for the Application Review Process A6 - External Auditor Independent Assessment

Guidelines on Licensing for Payment Service Providers 2 1 Purpose 1.1 The Guidelines on Licensing for Payment Service Providers (the “Guidelines”) are intended to provide guidance on the application procedures, licensing criteria and ongoing requirements for payment service providers under the Payment Services Act 2019 (the “PS Act”). 1.2 These Guidelines should be read in conjunction with the provisions of the PS Act, the Payment Services Regulations (the “PSR”) and other relevant legislation, notices, guidelines and FAQs issued by the Monetary Authority of Singapore (“MAS”). 1.3 MAS will update these Guidelines periodically to provide further guidance. 2 Licences under the PS Act 2.1 Pursuant to section 5 of the PS Act, any person that conducts payment services in Singapore as defined in the First Schedule of the PS Act is required to hold a licence unless that person is exempted. Section 13 of the PS Act sets out the applicable exemptions from holding a licence. Types of Payment Services 2.2 An applicant should consider which types of payment services apply to its business model. The seven payment services in the First Schedule of the PS Act are set out in Table 1 below with a brief description of each payment service. The applicant should also consider whether its proposed activities fall within any exclusions from the scope of payment services regulated under the PS Act, under Part 2 of the First Schedule. Refer to the Frequently Asked Questions on the Payment Services Act for more information or use the Licensing Self-Check Tool to check whether a licence is required and the eligibility to apply for a licence.

Guidelines on Licensing for Payment Service Providers 3 Table 1 - Payment Services under the PS Act Activity Type Brief Description Activity A Account issuance service The service of issuing a payment account or any service relating to any operation required for operating a payment account, such as an e-wallet (including certain multi-purpose stored value cards) or a non-bank issued credit card. Activity B Domestic money transfer service Providing local funds transfer service in Singapore. This includes payment gateway services and payment kiosk services. Activity C Cross-border money transfer service Providing inbound or outbound remittance service in Singapore, as well as facilitating remittance between entities in different countries even if monies are not accepted or received in Singapore Activity D Merchant acquisition service Providing merchant acquisition service in Singapore where the service provider processes payment transactions from the merchant and processes payment receipts on behalf of the merchant. Usually the service includes providing a point-of￾sale terminal or online payment gateway. Activity E E-money issuance service Issuing e-money to allow the user to pay merchants or transfer to another individual. Activity F Digital payment token service Buying or selling digital payment tokens (“DPTs”) (commonly known as cryptocurrencies), or providing a platform to allow persons to exchange DPTs. Transmitting or arranging for the transmission of DPTs, provision of custodian wallet services for DPTs, actively facilitating the buying or selling of DPTs without possession of monies or DPTs. Activity G Money-changing service Buying or selling foreign currency notes.

Guidelines on Licensing for Payment Service Providers 4 Types of Licences 2.3 There are three types of licences as set out in section 6 of the PS Act. The applicant should ensure that the licence it chooses accommodates its needs over a reasonable timeframe. An applicant should: (a) apply for a money-changing (“MC”) licence if it only intends to carry out money￾changing service; or, (b) in any other case, apply for: (i) a Standard Payment Institution (“SPI”) licence if it intends to conduct payment services below the specified thresholds1 ; or (ii) a Major Payment Institution (“MPI”) licence if it intends to conduct payment services without being subject to the specified thresholds. 2.3 Variation or change of licence – A licensee must apply for a variation or change of licence in Form 2 if it intends to (i) add or remove any payment service2 , or (ii) change its licence type. The licensee should ensure that it allocates sufficient time to prepare for any licence variation required as part of its future business needs. It should be able to comply with the requirements of any new payment service or the new licence type at the point of application. Approval must be obtained prior to commencing business of any new payment service or under the new licence type. In particular, an SPI that intends to become an MPI should initiate its licence variation process at a reasonable period of time prior to approaching the specified thresholds. An SPI should therefore monitor its transaction volumes and/or value of e-money issued or stored, and consider if changes such as new target clientele or new business initiatives could result in significant changes to the volume and/or value. It should also ensure that it is able to meet the MPI requirements at the point of application. 1 The thresholds are set out in section 6(5) of the Act and are, in summary: (a) S$3m monthly transactions for any activity type (b) S$6m monthly transactions for two or more activity types (c) S$5m of daily outstanding e-money 2 An MC licensee will need to apply to change its licence to an SPI or MPI licence to conduct any additional payment service.

Guidelines on Licensing for Payment Service Providers 5 3 Admission Criteria 3.1 An applicant must fulfil the criteria set out below and must demonstrate how it will be able to comply with its obligations under the PS Act as a licensee. 3.1.1 Governance and ownership requirements - The applicant must comply with the governance and ownership structure set out in Appendix 1 and must be registered with ACRA. 3.1.2 Fit and Proper - The applicant must satisfy MAS that its sole-proprietor, partners, or directors and CEO, shareholders and employees, as well as the applicant itself, are fit and proper, in accordance with the Guidelines on Fit and Proper Criteria [FSG-G01]. The onus is on the applicant to ensure that the relevant persons are fit and proper to the satisfaction of MAS, rather than for MAS to show otherwise. Other than honesty, integrity and reputation, competence and capability and financial soundness, MAS would also consider other factors such as whether there is any conflict of interest and time commitment the relevant persons have for the entity in Singapore. In particular, the entity and its related group should not have any adverse reputation, particularly with regard to financial crime. 3.1.3 Competency of Key Individuals - The applicant must ensure that its sole￾proprietor, partners, or executive directors and CEO have sufficient experience in operating a business in the payment services industry or related areas in the financial services industry, including having sufficient understanding of the regulatory framework for payment service providers in Singapore. Where the individual will be managing a sizeable team, the sole-proprietor, partners, or executive directors and CEO should also have the relevant experience, competencies, and influence, to allow them to exercise effective oversight and control over the business activities and staff. The applicant should also consider the educational qualifications and professional certification of its key individuals. 3.1.4 Permanent place of business or registered office - The applicant must have a permanent place of business or registered office in Singapore. It must be an office area where the applicant’s books and records can be securely held. The applicant must also appoint at least one person to be present to address any queries or complaints from customers. 3 3 As set out in MAS Notice PSN07, licensees must appoint at least one person to be present at its permanent place of business or registered office for a minimum of 10 days a month and a minimum of eight hours on each of those days during its normal business hours, unless: (a) it has notified all its customers in writing and in advance of any planned non-operating days that will prevent it from meeting the specified days and hours; or (b) there are circumstances beyond the control of the licensee that could not reasonably have been foreseen that prevent it from meeting the specified days and hours.

Guidelines on Licensing for Payment Service Providers 6 3.1.5 Base Capital - An SPI or MPI licence applicant must satisfy MAS that it is familiar the base capital requirements as set out in the PSR4 and demonstrate clearly how it will meet the requirements on an ongoing basis, as summarized in Table 3 below. In view of this obligation, the applicant must ensure that it maintains sufficient capital buffer in excess of the base capital requirement, bearing in mind the scale and scope of its operations and the potential for profit and losses. As a general rule of thumb, the base capital of the entity should be able to cover at least 6 to 12 months of the applicant’s operating expenses. The applicant should also have an effective monitoring process in place to ensure that it is able to meet the base capital requirement at all times e.g. putting in place regular reporting or a specified capital buffer above the minimum requirement. Table 3 - Base Capital Requirement Type of Licence Base Capital Requirement SPI S$100,000 MPI S$250,000 3.1.6 Security - An MPI licence applicant must provide the required security, as summarised in Table 4 below, prior to commencing business, in the form of a cash deposit with MAS or a bank guarantee in the prescribed format. Table 4 - Security Requirement Category Security Requirement The average, over a calendar year, of the total value of all payment transactions in one month does not exceed S$6 million for any one payment service S$100,000 All other cases S$200,000 3.1.7 Compliance Arrangements - The applicant must have in place plans for effective compliance arrangements and ensure that it puts in adequate compliance resources that are commensurate with the nature, scale and complexity of its business. The minimum requirements in respect of compliance arrangements are set out in Appendix 2. Regardless of the setup of the compliance arrangements, the ultimate responsibility and accountability for ensuring compliance with applicable laws and regulations rests with the applicant’s sole-proprietor, partners, or directors and CEO. 4 Base capital means the sum of (i) the paid-up ordinary share capital and irredeemable and non- cumulative preference share capital and (ii) any unappropriated profit or loss, less any interim loss and dividend that has been declared.

Guidelines on Licensing for Payment Service Providers 7 3.1.8 Technology Risk Management - Where the applicant intends to provide online financial services, it must perform a penetration test of its proposed online financial services, remediate all high-risk findings identified, and conduct independent validation on the effectiveness of the remediation actions. This does not need to be completed prior to application but must be completed prior to the grant of licence. 3.1.9 Audit Arrangements - The applicant must have plans in place for adequate independent audit arrangements to regularly assess the adequacy and effectiveness of its procedures, controls, and its compliance with regulatory requirements. The audit arrangements should be commensurate with the scale, nature, and complexity of its operations. The audit may be conducted by an internal audit function within the applicant, an independent internal audit team from the head office of the applicant, or outsourced to a third-party service provider. 3.1.10 Annual Audit Requirements - The applicant must have in place plans to meet the annual audit requirements as set out in section 37 of the PS Act. The auditor must be appointed at the applicant’s own expense to carry out an audit of its accounts and transactions, and compliance with the relevant regulations and requirements. 3.1.11 Letter of Responsibility and/or Letter of Undertaking - Where appropriate, MAS may require applicants to procure a Letter of Responsibility and/or Letter of Undertaking from the applicant’s majority shareholders, parent company and/or related company The template will be provided by MAS if the application is approved. Other Factors - MAS may also take into consideration factors such as: 3.1.12 track record and financial condition of the applicant, its holding company or related corporations, where applicable; 3.1.13 operational readiness of the applicant, including ability to comply with regulatory requirements; 3.1.14 whether the applicant has demonstrated adequate awareness of the key risks associated with its business activities and has sufficiently identified, assessed and mitigated the associated risks accordingly; 3.1.15 whether the applicant, its holding company or related corporations are subject to proper supervision by a competent regulatory authority; 3.1.16 commitment of the applicant’s holding company to operations in Singapore; and 3.1.17 whether the public interest will be served by granting a licence.

Guidelines on Licensing for Payment Service Providers 8 3.1 MAS considers each application on its own merits and may take into account other factors on a case-by-case basis. The criteria and considerations listed above are not meant to be exhaustive; MAS may impose additional conditions or requirements to address the unique risks posed by applicants. 3.2 The applicant should submit an application in Form 1. All applicants and licensees are required to pay the relevant fees set out in the Schedule to the PSR. Please refer to Appendix 4 for more information on fees. Applicants should also refer to Appendix 5 for more information on the rules of engagement for the application review process. 4 Licence Application Requirements 4.1 Applicants who have assessed that they are able to meet the admission criteria should refer to Appendix 3 for guidance on information required as part of the licence application. Legal Opinion 4.1.1 Legal Opinion Requirement for New Applications – All new applicants applying for an SPI or MPI licence will need to submit a legal opinion together with their applications. The legal opinion should be issued by a law firm that has experience advising on the PS Act in Singapore. The legal opinion should include a clear and concise summary of the applicant’s business model and an assessment of whether the applicant’s proposed service(s) and/or product(s) are regulated payment services under the PS Act. 4.1.2 Legal Opinion Requirement for Variation Applications – Existing licensees applying to vary their licence to add a DPT service will need to submit a legal opinion together with their variation applications. The legal opinion should be issued by a law firm that has experience advising on the PS Act in Singapore. The legal opinion should include a clear and concise summary of the applicant’s business model and an assessment of whether the applicant’s proposed service(s) and/or product(s) are regulated payment services under the PS Act. 4.1.3 Other than the applications covered in 4.1.1 and 4.1.2, MAS may also require any other applicant to provide a legal opinion if warranted (e.g. complex business model). 4.1.4 In all cases, MAS reserves the right to request for a second legal opinion if the initial legal opinion is unclear. External Auditor’s Independent Assessment for New Licence Applications 4.1.5 New applicants intending to provide DPT services (except for notified entities that have notified MAS pursuant to the Payment Services (Amendment) Act 2021 (Saving and Transitional Provisions) Regulations 2024), must appoint a

Guidelines on Licensing for Payment Service Providers 9 qualified independent External Auditor to perform an independent assessment of its policies, procedures and controls in the areas of anti-money laundering/countering the financing of terrorism (“AML/CFT”) and Consumer Protection. Please refer to Appendix 6 for further details on the assessment scope and External Auditor criteria. 4.1.6 The External Auditor’s independent assessment report (“report”) must be submitted together with the applicant’s licence application (Form 1). The submitted report must have been issued and signed off by the External Auditor(s) within the last 3 months from the date of application submission. 4.1.7 The applicant should have relevant information ready prior to engaging the External Auditor, including but not limited to its business plan5 , policies and procedures on AML/CFT as well as Consumer Protection. For purposes of conducting this independent assessment, the policy and procedures, and other documents to be reviewed by the External Auditor must be the same version submitted by the applicant under Section 8 of Form 1. 4.1.8 The onus is on the applicant to ensure that it appoints an appropriate and suitably qualified External Auditor to conduct the independent assessment. The applicant may engage more than one External Auditor to perform the independent assessment of each area as appropriate, depending on the External Auditor’s expertise, experience, and track records in the field.6 The Institute of Singapore Chartered Accountants has collated a list of External Auditors that are open to conduct such independent assessments. Please note that MAS does not endorse any of these External Auditors on the list and it is not mandatory to select from the list. The applicant is ultimately responsible for assessing and appointing an External Auditor that meets the criteria and has relevant experience and expertise to perform the independent assessment. 4.1.9 The Authority reserves the right to require the applicant to appoint another External Auditor to re-perform the independent assessment if there are concerns on the quality and/or comprehensiveness of the External Auditors’ independent assessment. 4.1.10 MAS would engage the applicant directly to discuss the observations. In assessing the licence application, MAS would take into consideration the observations and other factors, including those highlighted in Section 3.2 above, as well as management’s attitude towards the observations. The observations from the report are not meant to be viewed in isolation and the number of findings may not be directly linked to MAS’ assessment of the control framework. MAS may also contact the External Auditor(s) directly for any 5 This includes details on its business model, each of the service(s) and product(s) it intends to offer (mapped to the respective regulated payment services under the PS Act), asset/fund flows and parties involved for each service/product etc. Please refer to Appendix 3 for further guidance on information required in the business plans. 6 For example, the Applicant could appoint one External Auditor to perform an assessment of the area of Consumer Protection and another for the assessment of AML/CFT.

Guidelines on Licensing for Payment Service Providers 10 clarifications. The External Auditor(s) are not required to engage the applicant on the remediation of the report findings. 4.1.11 When performing the independent assessment, the External Auditor must maintain independence from the applicant, and does not subject itself to any conflicts of interest situations. 4.1.12 Each External Auditor engaged by the applicant for the purpose of conducting the independent assessment is required to furnish information on its contact details, track record and relevant experience via an online form in the FormSG portal (here). The External Auditor(s) is(are) also required to attach and submit a Declaration7 (External Auditor's Declaration – Independent External Auditor Assessment) in the same FormSG online form. 4.1.13 The Authority may request the External Auditor(s) to submit minutes of meetings and/or supporting documents of its assessment as part of the Authority’s review of the applicant’s licence application. 4.1.14 If the applicant intending to provide DPT service is granted an in-principle approval (“IPA”), it would be required to appoint a qualified independent External Auditor to perform an independent assessment of its policies, procedures and controls in the areas of Technology and Cybersecurity risks8 . External Auditor Independent Assessment for Licence Variation Applications (DPT) 4.1.15 The requirements as described in the section above also applies to a PS Act licensee intending to vary its licence to add DPT services. Please submit the report via the Variation or Change of a Payment Service Provider Licence (Form 2). External Audit Attestation for Entities that have Notified MAS Pursuant to the Payment Services (Amendment) Act 2021 (Saving and Transitional Provisions) Regulations 2024 (“Transitional Regulations 2024”) 4.1.16 All entities that have notified MAS pursuant to the Transitional Regulations 2024 are required to submit an attestation signed off by an external auditor on the applicant’s business activities and compliance with AML/CFT and user protection requirements before 4 January 2025. The specimen attestation form can be found here. Such notified entities are not required to submit the External Auditor’s independent assessment report covered in 4.1.6. 7 Refer to Appendix 6 for further information required for the External Auditor’s declaration. 8 This requirement would be incorporated as an IPA condition. Please refer to Appendix 6 for the scope of assessment on Technology and Cybersecurity risks.

Guidelines on Licensing for Payment Service Providers 11 5 Ongoing Requirements for Licensees 5.1 A licensee is required to comply, on an ongoing basis, with all applicable requirements set out under the PS Act, as well as other relevant legislation. Licensees are expected to put in place processes, systems, policies and procedures to ensure that they fulfil all ongoing obligations, including applications and notifications to MAS where necessary. Some of these requirements are summarised below. Please note the list is non-exhaustive and licensees should keep up-to-date with regulatory developments and may refer to MAS website for the latest requirements. 5.2 Anti-Money Laundering and Countering the Financing of Terrorism (“AML/CFT”) Requirements - A licensee must comply with the AML/CFT requirements as set out in the Financial Services and Markets Regulations (including regulations for targeted financial sanctions), Terrorism (Suppression of Financing) Act 2002, Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992, Notices on Prevention of Money Laundering and Countering the Financing of Terrorism [PSN01 and/or PSN02] and Notice on Reporting of Suspicious Activities & Incidents of Fraud [PSN03]. A licensee should also refer to the Guidelines to Notices PSN01 and/or PSN02 for guidance on the AML/CFT requirements. 5.3 Periodic Returns - A licensee must submit periodic regulatory returns in relation to its payment service activities, in accordance with the PSR. The requirements are set out in the Notice on Submission of Regulatory Returns [PSN04]. 5.4 Cyber Hygiene - A licensee must comply with the cyber hygiene requirements as set out in the Notice on Cyber Hygiene [FSM-N14] and put in place appropriate safeguards to protectcustomer information. 5.5 Technology Risk Management - Licensees providing DPT services must comply with the Notice on Technology Risk Management [FSM-N13], with effect from 6 November 2024. All other licensees should also refer to the Guidelines on Risk Management Practices – Technology Risk for guidance on technology risk management requirements. 5.6 Business Conduct - A licensee must comply with business conduct requirements in the PS Act, the PSR and the Notice on Conduct [PSN07]. These obligations include safeguarding of customers’ monies, record of transactions, issuance of receipts, adhering to the prescribed time period for transmission of money, display of exchange rate and fees, and notification of normal business hours. Licensees must also ensure that they comply with all prohibitions and restrictions, including personal payment account stock and flow restrictions, as well as prohibited business activities. 5.7 Disclosures and Communications - A licensee must make accurate representation on the scope of its licence and provide the disclosures set out in the Notice on Disclosures and Communications [PSN08] where applicable to its business. A licensee should also ensure that customers receive timely updates regarding any material changes to the disclosures.

Guidelines on Licensing for Payment Service Providers 12 5.8 Annual Audit Requirements - A licensee must, on an annual basis, appoint an auditor to carry out an audit of its accounts and transactions, and compliance with regulations and requirements. The licensee must ensure that the auditor submits a report to MAS in Form 4. 5.9 Licensees should also understand and apply the relevant MAS Guidelines and Circulars such as the Guidelines on Technology Risk Management, E-payments User Protection Guidelines, Guidelines on Shared Responsibility Framework, and Circular on Anti-scam Measures by Major Payment Institutions, where applicable, and keep abreast of regulatory changes.

Guidelines on Licensing for Payment Service Providers 13 A1 Governance and Ownership Requirements Appendix 1 Table A1-1 - Governance/Ownership Requirements for Money-Changing Licence Entity Type Governance/Ownership Requirements Sole-proprietor • The applicant must be a Singapore citizen. • The applicant must have a minimum of 1 year's relevant working or business experience on a full-time basis. Partnership or Limited Liability Partnership (LLP) • The majority of its partners should be Singapore citizens. If there are only two partners, only one needs to be a Singapore citizen. • Each partner must have a minimum of 1 year's relevant working or business experience on a full-time basis. Singapore-owned Company • More than 50% of the equity shareholdings should be beneficially owned and effectively controlled by Singapore citizens. • A majority of the board of directors of the company should be Singapore citizens. If there are only two directors, only one of the directors needs to be a Singapore citizen. • Each executive director must have a minimum of 1 year's relevant working or business experience on a full-time basis. Singapore incorporated wholly-owned subsidiary of a foreign bank, or a foreign company primarily engaged in money￾changing • The parent company must: o Be of significant size. In case of a foreign bank, it needs to rank among the top banks in the country where it is incorporated. o Possess a good track record and reputation. o Be adequately regulated and supervised by its home supervisory authority for AML/CFT.

Guidelines on Licensing for Payment Service Providers 14 Table A1-2 - Director Requirements for Standard or Major Payment Institution Licence Entity Type Director Requirements Singapore￾incorporated company • At least one Executive Director 9 of the applicant is a Singapore citizen or permanent resident; or, • At least one Executive Director of the applicant is a Singapore Employment Pass holder and at least one other director of the applicant is a Singapore citizen or permanent resident. Singapore branch of a foreign corporation 9 As set out in section 2 of the PS Act, executive directors should be involved in the day-to-day running of and making of executive decisions on behalf of the business or operations of the applicant. They are expected to be resident in Singapore to oversee the activities of the licensee. Nominee directors such as investors, legal advisers or corporate secretaries are not Executive Directors. Non-Executive Directors provide oversight as members on the Board of Directors, but are not involved in the day-to-day business or operations of the licensee. The job titles and designations of directors should reflect the substance of the role and responsibilities of the individual.

Guidelines on Licensing for Payment Service Providers 15 A2 Minimum Compliance Arrangements Appendix 2 The applicant should ensure that it has effective compliance arrangements and adequate compliance resources, commensurate with the scale, nature and complexity of its operations. This may take the form of: • An independent compliance function - The applicant should put in place an independent compliance function in Singapore with staff who are suitably qualified in the areas relevant to its business activities.Compliance staff may perform other non-conflicting and complementary roles suchas that of an in-house legal counsel. • Compliance support from holding company or overseas related entity - The applicant may obtain compliance support from an independent and dedicated compliance team at its holding company, or at an overseas related entity, provided that it is able to demonstrate that there is adequate oversight by the applicant’s compliance officer, sole-proprietor, partners, or directors and CEO and other senior management. Notwithstanding this, MAS expects entities conducting digital payment token services to have in place an in-house local compliance officer given the higher risk posed and the complexity of the business. The applicant must also develop appropriate compliance management arrangements, including at least, the appointment of a suitably qualified compliance officer at the management level. This individual is expected to have sufficient expertise in the areas relevant to the business activities, and authority to oversee the compliance function of the applicant, although he may be assisted by other staff in day-to-day operations. If this officer has yet to be employed at the point of application, he/she must, at the minimum, have been identified at the point of application and must be employed and appointed prior to the applicant commencing business. The applicant should also put in place proper governance structure to oversee compliance and AML/CFT issues. Depending on the scale of the business and its group structure, the applicant can consider having the compliance officer regularly reporting compliance and AML/CFT issues to the board or a board committee and for decision on matters which is beyond the authority of the compliance officer. This is in line with Outcome 3 of the Guidelines on Individual Accountability and Conduct, where a financial institution’s governance framework is expected to support its senior managers’ performance of their roles and responsibilities, with a clear and transparent management structure ad reporting relationships. The applicant should note that regardless of the arrangement chosen, the sole￾proprietor, partners, or directors and CEO of the applicant are ultimately responsible for all compliance and regulatory matters and must maintain adequate oversight over the arrangements. Accordingly, senior management and compliance officer of the applicant are expected to be able to demonstrate their sufficient understanding of the compliance and ML/FT

Guidelines on Licensing for Payment Service Providers 16 risks which the applicant faces in relation to its business activities and the measures which they have put in place to effectively manage the risks.

Guidelines on Licensing for Payment Service Providers 17 Appendix 3 A3 Guidance on Information required for Licence Applications The applicant should ensure that it fully meets the admission criteria, and has ensured that the application is complete, free of errors and inconsistencies, and accompanied by the requisite supporting documents stated in the application form. Information Required in Proposed Business Plan In particular, it should include the following information in its proposed business plan: The applicant should provide a clear description of its business model and plans, which are supported by the professional experience and expertise of the proposed management team. The business plan should illustrate compliance with the PS Act and relevant subsidiary legislation, and include the information below: • Jurisdictions serviced. • Profile of target clientele. • Proposed products and services. The applicant should indicate clearly its assessment of which payment services will be conducted at each stage of the transaction process. Where the applicant intends to provide more than one product or service, the applicant should provide a separate assessment for each product or service. • Detailed funds flow plan and channels, including transaction and/or process flow diagrams. If there is more than one product or service, or more than one type of transaction and/or process flow, one diagram should be provided for each flow. The diagrams should: o Describe the beginning to end of a typical transaction, starting from the sources of funds that the applicant will accept (e.g. bank transfers, cash, cards) until where the obligation to the customer is fully discharged. o Illustrate both the interactions between the customer and the applicant and the flow of funds. o Have timelines indicated, including service level agreements with third parties, and payment and settlement cycles, where applicable. o Highlight where it uses innovative technology (e.g. use or offering of digital tokens, distributed ledger technology) or a different manner of delivering products or services from that commonly seen in the market. o Include all third parties involved (e.g. other payment service providers, banking partners, intermediaries, other agents) and show their roles in the process.

Guidelines on Licensing for Payment Service Providers 18 • Implementation plans, including the anticipated timeline for business/product launch, as well as systems, processes, and third parties that will perform a key role in its operations. • Whether the payment services are incidental to, or bundled with, any other products or services offered by the applicant. • Brief description of any other activities regulated by MAS that it conducts or intends to conduct e.g. financial advisory, dealing in securities etc. • Brief description of any exempted and unregulated activities that it currently conducts or intends to conduct. • For applicants that are part of a global payment services group: o Role of the applicant within the group, including the functions or services that it will receive and/or provide to related corporations within the group, if any. Where available, the applicant should provide an estimate of the level of resources (in terms of headcount and time spent) in the other related corporations that will support the operations in Singapore. o Confirmation that all its entities are adequately licensed/registered, with the licensing/registration details of each entity. Applicants should provide copy of its licence/ certification of registration or information of its licensing/registration status on the regulators’ websites. Applicants should disclose any regulatory enforcement action/investigation which any of its entities may have been a party to.

Guidelines on Licensing for Payment Service Providers 19 Applicants should also refer to Table A3-1 below for activity-specific guidance on information to include in the proposed business plan. Table A3-1 - Activity-specific guidance Activity Type Information to include in proposed business plan • The applicant should provide the rationale for the limits set and how they will be monitored. It should also indicate the jurisdictions from which loading and redemption can be done (for online services, indicate accordingly and highlight if there are any restrictions). Activity A Account issuance service • Applicants who operate personal payment accounts should describe their planned monitoring measures to comply with the stock and flow restrictions in section 24 of the PS Act. The description should set out all relevant systems, policies and procedures, including the thresholds that will be set, the frequency of monitoring, and the remedial measures in the event that the account approaches the limit. Activity B Domestic money transfer service • The applicant should demonstrate how it will meet the timelines of three and seven business days for domestic and cross-border money transfer respectively as prescribed in MAS Notice PSN07. The applicant should detail the proposed remedial measures in the event that the prescribed timeline cannot be met. Activity C Cross-border money transfer service Activity D • The applicant should provide details on the agreements entered into with merchants, including payment and settlement cycles, and due diligence conducted on merchants. Merchant acquisition service

Guidelines on Licensing for Payment Service Providers 20 Activity E E-money issuance service • The applicant should indicate the currency that the e￾money will be denominated in and explain how it will ensure that the e-money is issued in a timely manner. • The applicant should also provide a list of account issuers and third parties that support and accept the e-money, if any, and explain how it will ensure that the balance is recorded and reflected accurately by all parties involved. Activity F Digital payment token service • The applicant must conduct a holistic risk assessment of all the digital tokens and digital token services (e.g. exchange platform, custody) that they intend to support or provide, including its token listing governance process. It should provide a full list of digital tokens supported (including tokens that are not DPTs), indicate its assessment of the nature of the token under MAS’ regulatory framework (e.g. if it is a security token or a payment token). • The applicant should provide information on its consumer access measures and business conduct measures in place for safeguarding and segregation of customers’ assets, maintain access and operational controls to customers’ DPTs in Singapore, daily reconciliation of customers’ accounts and provision of monthly account statements to customers, risk management controls (control of movement of customers’ assets), disclosures to customers. Activity G Money-changing service • The applicant should provide a list of the currencies that it will offer and the sources of the foreign currency notes. It should also explain how it derives the exchange rates offered. Legal opinion Applicants are required to provide a legal opinion on the regulated payment services to be offered given the applicant’s proposed business model. The legal opinion should include (but not be limited to) the following: • A clear and concise summary of the applicant’s business model, as well as each of the service(s) and product(s) the applicant intends to offer (including asset/fund flows and parties involved for each service/product where applicable). • An assessment of whether the proposed service(s) or product(s) are regulated payment services under the PS Act. The assessment should include a detailed and comprehensive analysis of how each regulated payment service is or is not applicable to each proposed service or product. The assessment should also consider all relevant Legislation, Notices, Guidelines, Circulars and FAQs.

Guidelines on Licensing for Payment Service Providers 21 • If any of the proposed service(s) or product(s) are assessed to be exempted or excluded from regulation, a detailed explanation of how the relevant exemption or exclusion applies. • An acknowledgement that the legal opinion will be disclosed to the Authority. Information Required on Compliance, Risk Management, Systems & Controls Technology risk management The applicant should set out its framework for assessing and managing technology risks, and implement measures to protect customer data, transactions and systems that are commensurate with the level of risk and complexity of the financial services offered and the technologies supporting such services. The applicant should refer to the Notice on Technology Risk Management [FSM-N13], Notice on Cyber Hygiene [FSM-N14], and Guidelines on Risk Management Practices – Technology Risk for guidance on IT risk management principles and supervisory expectations.

Guidelines on Licensing for Payment Service Providers 22 Safeguarding The applicant should provide details of the intended safeguarding arrangement, including name of safeguarding institution and draft contract if available, and systems and/or processes that will be used to comply with the timelines in section 23 of the PS Act. Where the applicant will be using more than one safeguarding measure and/or safeguarding institution, it should indicate the intended coverage of each safeguarding measure (e.g. by value at each safeguarding institution, or by each type of safeguarding measure). The applicant should also indicate in its business model description or the transaction and/or process flow diagram where it has assessed its safeguarding obligation to start and end. If the application is approved, the applicant will be required to provide documentary evidence that the safeguarding arrangement is in place prior to commencing business. Applicants that choose to safeguard by undertaking or banker’s guarantee will also be required to provide a legal opinion that the arrangement fulfils the requirements in section 23 of the PS Act. SPI threshold monitoring SPI licence applicants should describe their planned threshold monitoring measures to comply with the thresholds in section 6 of the PS Act. The description should set out all systems, policies and procedures that will be used, including the limits that will be set, the frequency of monitoring, and the measures that will be taken in the event that the applicant approaches the threshold. Compliance and audit The applicant should provide the following information and documents that are in line with the nature of the proposed business model: • AML/CFT policies and procedures that demonstrate compliance with MAS Notices PSN01 and/or PSN02, as well as the relevant sanctions requirements. This should include the framework for assessing and maintaining oversight of agents and third￾party partners (local and overseas). • Enterprise-wide money-laundering/terrorism financing risk assessment (“EWRA”). Applicant should include an assessment on the proliferation financing risk and tax evasion risk in the EWRA. • AML/CFT governance, escalation and reporting arrangements. This should include details of the involvement of the sole-proprietor, partners, or directors and CEO and other senior management in the oversight and resolution of AML/CFT issues that may arise in the course of the licensee’s business. • Implementation plans of compliance management arrangements, including the processes that have been rolled out, and systems that will be used. • Name and Curriculum Vitae (“CV”) of the compliance officer, including details of any formal compliance accreditation e.g. ACAMS, IBF accreditation. If there is/will

Guidelines on Licensing for Payment Service Providers 23 be a separate AML/CFT compliance officer, name and CV of the AML/CFT compliance officer, including details of any formal AML/CFT accreditation. • Staffing arrangements and reporting lines for the compliance function if it is not already provided as part of the organisational chart. This should include details on all outsourced compliance functions, including where the outsourced provider and team is located, relationship between the applicant and the outsourced provider (e.g. vendor, parent company), licensing/registration status of the outsourced provider, and oversight arrangements. • Internal and external audit arrangements. Consumer Protection Applicants intending to provide DPT service should provide the following information and documents that are in line the nature of the proposed business model: • Policies and procedures setting out how the applicant would comply with consumer protection requirements prescribed by the Payment Services (Amendment) Regulations 2024 that include, but are not limited to, safeguarding and segregation of clients’ assets, consumer access, complaints handling, user protection, mitigation of conflicts of interest. Shareholding Chart • The applicant should provide the complete shareholding chart (up to the ultimate controller(s)) who are natural person(s). • If the applicant does not have any 20% controller, the applicant will have to provide a written confirmation. • Table below provides computation examples to illustrate the approach in determining a 20% controller(s). Examples of 20% controller of a Licensed Payment Service Provider (“PSP”)10 A person is a “20% controller” of the PSP as defined in section 2(1) of the Payment Services Act 2019 (“PS Act”) if the person alone or acting together with the person’s associates has an interest in at least 20% of the shares in the PSP or is in a position to control at least 20% of the votes in the PSP. An “associate” is as defined in section 2(2)(c) of the PS Act. 10 The examples are not exhaustive and are on the assumption that there is no other relationship or arrangement (formal or informal) between such persons which may affect the determination as to whether a person is a 20% controller of a PSP.

Guidelines on Licensing for Payment Service Providers 24 Example 1: ABC Pte Ltd is 20% owned11 by V Pte Ltd; V Pte Ltd is 20% owned by W Pte Ltd; W Pte Ltd is 51% owned by X Pte Ltd; X Pte Ltd is 51% owned by Y Pte Ltd; and Y Pte Ltd is 20% owned by Z Pte Ltd. In this example, V Pte Ltd, W Pte Ltd, X Pte Ltd and Y Pte Ltd are each 20% controllers of ABC Pte Ltd, and their percentage (%) of interest in shares in and voting power in ABC Pte Ltd should each be indicated as 20%. Specifically:

• V Pte Ltd is a 20% controller of ABC Pte Ltd as V Pte Ltd has an interest in 20% of the shares or is in a position to control 20% of the votes in ABC Pte Ltd, as provided in the definition of “20% controller” in section 2(1) of the PS Act.
• W Pte Ltd is a 20% controller of ABC Pte Ltd since (i) V Pte Ltd is an associate of W Pte Ltd by virtue of section 2(2)(c)(v) of the PS Act as W Pte Ltd is in a position to control 20% of the votes in V Pte Ltd; and (ii) W Pte Ltd, together with its associate V Pte Ltd, has an interest in or is in a position to control 20% of the votes in ABC Pte Ltd.
• X Pte Ltd is a 20% controller of ABC Pte Ltd since (i) W Pte Ltd is an associate of X Pte Ltd pursuant to section 2(2)(c)(iii) or 2(2)(c)(iv) of the PS Act in light of X Pte Ltd controlling more than 50% of the voting power in W Pte Ltd; (ii) V Pte Ltd is an associate of X Pte Ltd by virtue of section 2(2)(c)(v) of the PS Act because X Pte Ltd, together with its associate W Pte Ltd, is in a position to control 20% of the votes of V Pte Ltd; and (iii) X Pte Ltd, together with its associate V Pte Ltd, has an interest in or is in a position to control 20% of the votes in ABC Pte Ltd. 11 In these examples, a reference to “A being x% owned by B” means that B holds x% of the issued share capital in A which entitles B to control x% of the votes in A.

Guidelines on Licensing for Payment Service Providers 25

• Y Pte Ltd is a 20% controller of ABC Pte Ltd since (i) X Pte Ltd is an associate of Y Pte Ltd and W Pte Ltd is also an associate of Y Pte Ltd pursuant to section 2(2)(c)(iii) or 2(2)(c)(iv) of the PS Act in light of Y Pte Ltd controlling more than 50% of the voting power in X Pte Ltd and X Pte Ltd controlling more than 50% of the voting power in W Pte Ltd; (ii) V Pte Ltd is an associate of Y Pte Ltd by virtue of section 2(2)(c)(v) of the PS Act because Y Pte Ltd, together with its associates X Pte Ltd and W Pte Ltd are in a position to control 20% of the votes in V Pte Ltd; and (iii) Y Pte Ltd, together with its associate V Pte Ltd, has an interest in or is in a position to control 20% of the votes in ABC Pte Ltd.
• Z Pte Ltd is not a 20% controller of ABC Pte Ltd as Z Pte Ltd does not have an interest in or is not in a position to control 20% of the votes in ABC Pte Ltd, whether alone or with its associates. This is because V Pte Ltd (which has an interest in 20% of the shares or is in a position to control 20% of the votes in ABC Pte Ltd) is not an associate of Z Pte Ltd as it does not meet any of the criteria in section 2(2)(c) of the PS Act to qualify as an associate. Example 2: ABC Pte Ltd is 20% owned by U Pte Ltd, 20% owned by V Pte Ltd and 60% owned by W Pte Ltd; U Pte Ltd and V Pte Ltd are each 51% owned by X Pte Ltd; X Pte Ltd is 20% owned by Y Pte Ltd and 20% owned by Z Pte Ltd. In this example, every entity is a 20% controller of ABC Pte Ltd. The percentage of interest in shares and control of voting power of U Pte Ltd and V Pte Ltd in ABC Pte Ltd should each be indicated as 20%; the percentage of interest in shares and control of voting power of W Pte Ltd in ABC Pte Ltd should be indicated as 60%; the percentage of interest in shares and control of voting power of X Pte Ltd in ABC Pte Ltd should be indicated as 40%; and the percentage of interest in shares and control of voting power of each of Y Pte Ltd and Z Pte Ltd in ABC Pte Ltd should be indicated as 40%. Specifically:
• U Pte Ltd, V Pte Ltd and W Pte Ltd are 20% controllers of ABC Pte Ltd, as U Pte Ltd and V Pte Ltd each has an interest in 20% of the shares or is in a position to

Guidelines on Licensing for Payment Service Providers 26 control 20% of the votes in ABC Pte Ltd, and W Pte Ltd has an interest in 60% of the shares or is in a position to control 60% of the votes in ABC Pte Ltd.

• X Pte Ltd is a 20% controller of ABC Pte Ltd. U Pte Ltd and V Pte Ltd are associates of X Pte Ltd by virtue of section 2(2)(c)(iii) or 2(2)(c)(iv) of the PS Act. As U Pte Ltd and V Pte Ltd have an interest in a total of 40% of the shares in or control a total of 40% of the votes in ABC Pte Ltd, this means that X Pte Ltd, together with its associates U Pte Ltd and V Pte Ltd, has an interest in a total of 40% of the shares in or is in a position to control the exercise of a total of 40% of the votes in ABC Pte Ltd.
• Y Pte Ltd is a 20% controller of ABC Pte Ltd. X Pte Ltd is an associate of Y Pte Ltd by virtue of section 2(2)(c)(v) of the PS Act. As X Pte Ltd has an interest in a total of 40% of the shares in or controls a total of 40% of the votes in ABC Pte Ltd (via its control of U Pte Ltd and V Pte Ltd), this means that Y Pte Ltd, together with its associate X Pte Ltd, has an interest in a total of 40% of the shares in or is in a position to control an aggregate of 40% of the votes in ABC Pte Ltd.
• The analysis for Y Pte Ltd applies similarly to Z Pte Ltd.

Guidelines on Licensing for Payment Service Providers 27 A4 Annual Licence Fees Appendix 4 Under section 10 of the PS Act, licence fees are to be paid annually. A licensee will pay fixed annual fees that correspond to the licence type and types of payment services it conducts. Licensees engaging in two or more payment services will have to pay the sum of all licence fees applicable for each payment service, with some exceptions for account issuance. The annual licence fee for each payment service is set out in the Schedule to the PSR. All licence fees paid are non-refundable. The licensee should have a GIRO arrangement with MAS for the payment of licence fees on an annual basis. The licensee should ensure that its GIRO arrangement details are updated and there are sufficient funds in its bank account on the deduction date stated on the fee advice. Pro-rated licence fee for new licence holders For new licensees that are not licensed on 1 January of the year, the licence fee payable for the first calendar year of it being licensed is computed based on the pro￾rated amount of the fixed annual licence fee for the period from the licence issue date to 31 December of the same year. Example 1 shows the computation of the first year’s licence fee. Example 1 A company is issued a MC licence on 1 December 2021. Licence Issuance Date 1 December 2021 Pro-rated fee payable for the first calendar year (for the period 1 December 2021 - 31 December 2021 i.e. 31 days) (31/365) * $1,500 = $127.40 Annual licence fee payable for subsequent calendar years $1,500 Pro-rated licence fee for upward variations Where a licensee adds a new payment service and/or varies its licence to a higher licence class, the applicable licence fee is also pro-rated for the period from the issue date of the new licence (that reflects the additional payment service or new licence class) to 31 December of the same year. Examples 2A and 2B below show the scenario where an existing licensee is granted approval to add a new payment service and variation of licence class respectively. For subsequent payment of annual licence fees, the annual fee of the additional payment service will be added to the existing annual fee.

Guidelines on Licensing for Payment Service Providers 28 Example 2A A company is issued an SPI licence on 1 January 2021 to conduct the following activities:

1. Account Issuance Service
2. Cross-Border Money Transfer Service The company decides to add a new service to its licence to provide money-changing service, and a new licence is issued on 1 December 2021. Licence Issuance Date 1 January 2021 Fee payable for the first calendar year (for the period 1 January 2021 - 31 December

$5,000 New Licence Issuance Date 1 December 2021 Additional pro-rated fee payable for the first calendar year for the new service (for the period 1 December 2021 - 31 December 2021 i.e. 31 days) (31/365) * $6,500 = $552.05 Total licence fee paid in 2021 $5,552.05 Annual licence fee payable for subsequent calendar years $6,500

Guidelines on Licensing for Payment Service Providers 29 Example 2B A company is issued an SPI licence on 1 January 2021 to conduct the following activities:

1. Account Issuance Service
2. E-money Issuance Service The company decides to vary its licence to an MPI licence conducting the same activities, and a new licence is issued on 1 December 2021. Licence Issuance Date 1 January 2021 Fee payable for the first calendar year (for the period 1 January 2021 - 31 December

$5,000 New Licence Issuance Date 1 December 2021 Pro-rated fee payable for the first calendar year (for the period 1 December 2021 - 31 December 2021 i.e. 31 days) (31/365) * $10,000 = $849.32 Total licence fee paid in 2021 $5,849.32 Annual licence fee payable for subsequent calendar years $10,000

Guidelines on Licensing for Payment Service Providers 30 Appendix 5 A5 Rules of Engagement for the Application Review Process Initial Review and Information Request The review process of an application begins when a case officer is assigned and upon complete submission of all information and documents as required. Depending on the volume of applications received, the case assignment may not take place immediately upon MAS’ receipt of an application. Following a case assignment, the case officer will reach out to the applicant to inform the applicant of the necessary next steps, which may include an opening meeting. The case officer will check the complete set of submitted documents and this typically forms the initial round of information requests that the applicant will receive. The case officer will also make an initial review of the applicant’s business model and the payment service(s) it is applying for. In the course of the review process, there may be multiple rounds of requests for information and clarifications, depending on the completeness of the responses submitted by the applicant. The applicant should always ensure that the application meets the admission criteria as set out in these Guidelines, and contains the necessary information as required in Appendix 3 of these Guidelines before submitting the application. Where submissions are assessed as grossly incomplete or significantly deficient, MAS reserves the right to reject the applications. The applicant is also expected to have a contact person available at all times to follow up on these information requests and provide an adequate response on a timely basis. Should there be any changes to the contact person, the applicant is expected to inform MAS in a timely manner. It is crucial that applicants proactively and fully disclose all material information without any suppression to the case officer in a timely manner. In situations where applicants are found to have intentionally obfuscated, hidden or delayed their disclosures to the MAS without good reason, these will be considered as significant deficiencies. The applicant is reminded that it must use reasonable care to ensure that information and document provided to MAS is not false or misleading. An individual who contravenes section 94(1) or 94(2) of the Payment Services Act may be guilty of an offence and liable on conviction to a fine or imprisonment. Timeliness and Quality of Responses MAS typically provides the applicant with a deadline to respond to requests for information. If the applicant fails to respond within the stipulated time, MAS will deem the application to be withdrawn. Should the applicant require additional time to prepare the response, the applicant should inform the case officer in advance. The applicant must also balance the time needed to provide an adequate and comprehensive response against rushing out a hasty response in the hopes of speeding up the review. Failing to provide a satisfactory and comprehensive response

Guidelines on Licensing for Payment Service Providers 31 will be assessed as deficiencies that will result in an unfavorable consideration of the application. Interview The case officer will typically arrange for an interview with the applicant’s key management personnel and/or the compliance officer. All representatives of the applicant are expected to treat their interactions with the case officer seriously. The purpose of the interview is for the applicant to explain how it intends to manage the business and risks in compliance with regulatory requirements. Consultants, external legal counsel, and other third parties are not permitted to attend the interview. This is because the applicant remains responsible for meeting its regulatory obligations, even if it outsources any of its functions. Potential grounds for a case officer to form a reasonable basis that the applicant will not be able to discharge its obligations as a licensed entity adequately include, but are not limited to the following:

• Not turning up for the interview without a valid reason;
• Not being able to address questions clearly during the interview; or
• Verbally abusing the case officer. If there are material changes to the application after the interview but before there is an application outcome, the case officer may arrange for additional interview(s) with the applicant. Examples of such changes include any change in appointment of an applicant’s key personnel, or any change in the applicant’s business model. MAS’ Review Process Case officers have an obligation to conduct a comprehensive assessment of the applications. Even at the application stage, the aim of an applicant is to be licensed, and therefore be subject to ongoing supervision and oversight, as per the regulatory regime. The case officer will review the application in this context and expect the applicant to conduct itself as if it were already a regulated financial institution. Applicants who fail to do so will be assessed as potentially significant deficiencies, which could result in a rejection of the application. Placing Applications On-hold If there are any changes to the information provided in the application after submission, MAS should be notified immediately. In cases of significant/major changes to the application, applicants may wish to consider withdrawing their application and reapplying after the changes have been completed in view that the application will not be ready for review until then. MAS reserves the right to place any application that is assessed to be insufficiently ready for review, to be on-hold for six months in the event of an applicant’s major

Guidelines on Licensing for Payment Service Providers 32 corporate restructuring, substantial changes to key management personnel12, or material variations in the business model/activities, at any point during the review process. While such significant changes could be unforeseen on the applicant’s part, the on-hold period allows for resources to be redirected away from such incomplete applications, to ensure fairness to all other ready applicants in the queue. During this on-hold period, the onus is on applicant to ensure timely resolution/completion of all necessary changes and to provide MAS with the relevant documentation to be assessed at the end of the on-hold period. The default on-hold period is six months and is not extendable. If the significant change is not completed within the on-hold period, the application will be assessed to be insufficiently ready for review and the applicant should consider withdrawing the application. Withdrawal of applications Applicants have the right to withdraw its application at any time. After MAS’ review, an applicant with fundamental concerns that cannot be adequately addressed within a reasonable timeframe, or whose application has been assessed to be significantly deficient, may also be recommended to withdraw the application. The applicant should be aware that if the case officer has made such an assessment, the case officer would have determined that other applicants in similar positions have not received approvals. Robust controls are in place to ensure that case officers conduct a fair, objective, and verifiable assessment. Each application and its supporting documents are rigorously reviewed by a team comprising the case officer, supervising officers, as well as by the reviewing and approving authorities. As such, applicants should treat the review process and its outcomes seriously. If the applicant intends to resubmit the application, the applicant needs to ensure that it has fully addressed all concerns and deficiencies before doing so. Re-submission of an application without remediation of concerns previously raised by MAS is likely to result in rejection. 12 In relation to applications being placed on-hold, significant changes to key management personnel mainly refer to changes related to the key C-suite positions such as Chief Executive Officers, Chief Financial Officers, Chief Risk Officers and Chief Compliance Officers. However, applicants should also assess and highlight if there are other role changes that should be considered as key management personnel based on criticality to their business models and importance of reporting lines.

Guidelines on Licensing for Payment Service Providers 33 Appendix 6 A6 External Auditor Independent Assessment AML/CFT & Consumer Protection

1. Criteria for External Auditor(s) Appointed to Perform the Independent Assessment of AML/CFT & Consumer Protection The External Auditor(s) appointed by the applicant to conduct the independent assessment should meet the following criteria: Criteria Minimum Requirements
2. Qualifications, credentials, and track record of the External Auditor and its lead engagement partner a) The External Auditor should be a company, firm or limited liability partnership approved or deemed to be approved as an accounting corporation, accounting firm or accounting limited liability partnership, respectively, under the Accountants Act 2004. b) The External Auditor, as well as its lead engagement partner, must have made:

• at least one report in respect of a statutory audit pursuant to MAS regulations on a financial institution regulated or authorised by MAS, or
• at least one independent review/ assessment commissioned by MAS in the area of AML/CFT on a financial institution regulated or authorised by MAS.

2. Independence a) The External Auditor should be independent from the applicant, its group or group companies. b) In the provision of its services for purpose of conducting the independent assessment for the applicant, the External Auditor must satisfy itself that there are no conflicts of interest arising from its ongoing business relationships with the applicant, its group or group companies, up to the conclusion of its engagement.
3. Scope of Assessment Areas for assessment (required for new DPT licence applicants – report to be submitted with application form (Form 1): The following sets out the areas in (A) AML/CFT and (B) Consumer Protection to be assessed by independent External Auditor(s) at the time of licence application for new licence applicants intending to provide DPT services. A. Anti- Money Laundering and Countering the Financing of Terrorism (“AML/CFT”):

Guidelines on Licensing for Payment Service Providers 34 The External Auditor should assess each of the following areas, taking into consideration the nature, size, scale and complexity of the applicant’s proposed business, including its proposed products, services and delivery channels. I. Governance, Management Oversight and Risk Assessment – a. Review and assess the applicant’s proposed management oversight, governance framework and reporting structure. Taking into consideration the nature and scope of its proposed business: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, and ii. highlight any other areas of inadequacies to enable proper management oversight of ML/TF risks. b. Review the applicant’s proposed Enterprise-Wide Risk Assessment (“EWRA”) methodology, framework and processes against relevant AML/CFT regulatory requirements and guidelines to identify gaps. c. Review the applicant’s proposed three lines of defence for ML/TF risks, including its Compliance and Internal Audit function, as well as its proposed escalation channels to its Board and/or Senior Management to: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, and ii. highlight any other areas of inadequacies to enable proper management oversight of ML/TF risks. II. Customer Due Diligence (“CDD”) – a. Review and assess the applicant’s proposed internal policies, procedures and controls (“IPPCs”) on CDD in the following areas: i. Customer identification and verification; ii. Measures for non-account holders; iii. Timing for verification; iv. Non-face-to-face CDD measures (Indicate the proposed system); v. Customer risk rating framework; vi. Simplified CDD measures; vii. Enhanced CDD measures; viii. Name and sanctions screening (Indicate the proposed system(s), information sources and lists that the applicant screened against); ix. Ongoing monitoring, including transaction monitoring, on-chain monitoring and wallet screening, where relevant (Indicate the proposed system(s)/ vendors); and x. Partner due diligence.

Guidelines on Licensing for Payment Service Providers 35 b. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, and ii. highlight any other areas of inadequacies in the mitigation of ML/TF risks posed by its proposed business model. III. Suspicious Transactions Reporting (“STR”) – a. Review and assess the applicant’s proposed IPPCs on STRs in the following areas: i. investigation, escalation and reporting processes of suspicious transactions, ii. additional controls instituted for accounts/ customers with identified suspicious activities, and iii. post-mortem reviews of AML/CFT controls post STR filing. b. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels: iv. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, and v. highlight any other areas of inadequacies in the mitigation of ML/TF risks posed by its proposed business model. IV. Wire Transfers – a. Review and assess the applicant’s proposed IPPCs on wire transfer. Taking into consideration the nature and scope of the applicant’s proposed business: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, and ii. highlight any other areas of inadequacies in the mitigation of ML/TF risks posed by its proposed business model. This should include whether the applicant has clearly defined its roles and responsibilities in payment transactions (i.e. ordering institution, intermediary institution, beneficiary institution, and/or a combination of these roles). V. Value Transfers – a. Review whether the value transfer requirements set out in paragraph 13 of the MAS Notice PSN02 (the “value transfer requirements”) are applicable to the applicant’s proposed business. If so, please review items b. to c. below. If not, please review item d. below.

Guidelines on Licensing for Payment Service Providers 36 b. Review and assess the applicant’s proposed IPPCs on value transfers. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, including targeted financial sanction obligations, transaction monitoring and name screening of originators and beneficiaries; ii. highlight any other areas of inadequacies in the mitigation of ML/TF risks posed by its proposed business model; and iii. determine whether the applicant has identified its roles and responsibilities in a value transfer (i.e. ordering institution, intermediary institution, beneficiary institution, and/or a combination of these roles), highlighting any gaps and recommendations. c. Where value transfers do not comply with the value transfer requirements (e.g. value transfer information cannot be exchanged due to lack of interoperability with other travel rule solutions), review and assess the applicant’s proposed enhanced risk mitigating measures. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines. This should include but not limited to those set out in paragraph 13-7 of the Guidelines to MAS Notice PSN02, and ii. highlight any other areas of inadequacies in the mitigation of ML/TF risks posed by its proposed business model. d. Where the value transfer requirements are not applicable (e.g. DPT transfers to/ from self-hosted wallets), review and assess the applicant’s proposed enhanced risk mitigating measures to: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines. This should include but not limited to those set out in paragraph 13-7 of the Guidelines to MAS Notice PSN02, and ii. highlight any other areas of inadequacies in the mitigation of ML/TF risks posed by its proposed business model. VI. New Products and Technologies – a. Review and assess the applicant’s proposed IPPCs on new products and technologies (i.e. tokens), particularly for higher risk products and services. The assessment should include periodic risk assessments and ongoing monitoring processes following the launch of new products and services. b. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, and

Guidelines on Licensing for Payment Service Providers 37 ii. highlight any other areas of in adequacies in the mitigation of ML/TF risks posed by its proposed business model. VII.Correspondent Accounts – a. Review whether the correspondent account requirements set out respectively in paragraph 13 of the MAS Notice PSN01 and paragraph 12 of the MAS Notice PSN02 (the “correspondent account requirements”) are applicable to the applicant’s proposed business. b. Where the relevant correspondent account requirements are applicable to the applicant’s proposed business, review and assess the applicant’s proposed IPPCs on correspondent accounts. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, and ii. highlight any other areas of inadequacies in the mitigation of ML/TF risks posed by its proposed business model. VIII. Agency Arrangements – a. Review whether the agency arrangement requirements set out respectively in paragraph 14 of the MAS Notice PSN01 and paragraph 12A of the MAS Notice PSN02 (the “agency arrangement requirements”) are applicable to the applicant’s proposed business. b. Where the relevant agency arrangements requirements are applicable to the applicant’s proposed business, review and assess the applicant’s proposed IPPCs on agency arrangements. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels: i. identify any gaps against relevant AML/CFT regulatory requirements and guidelines, and ii. highlight any other areas of inadequacies in the mitigation of ML/TF risks posed by its proposed business model. B. Consumer Protection: I. Safeguarding of Customers’ Moneys – a. Review and assess the applicant’s proposed safeguarding arrangement against relevant regulatory requirements and guidelines. b. Where the applicant has yet to put in place a safeguarding arrangement for customers’ moneys:

Guidelines on Licensing for Payment Service Providers 38 i. review and assess the applicant’s proposed plan and timeline for meeting the safeguarding requirements to identify gaps, and ii. highlight any other areas of inadequacies to enable proper safeguarding arrangement. Sections II to V below are to be read with reference to the Payment Services (Amendment) Regulations 2024 (“Amendment Regs 2024”) and the accompanying Guidelines on Consumer Protection Measures by Digital Payment Token Services Providers (“Guidelines”). II. Segregation of Customers’ Assets – a. Review and assess the applicant’s proposed IPPCs on the segregation and custody of customers’ assets against relevant regulatory requirements and guidelines. b. Where the applicant’s proposed business model allows for the commingling of customers’ assets with its own assets, review and assess its proposed IPPCs (including the operational processes in ensuring segregation of customers’ assets) to: i. identify any gaps against relevant regulatory requirements set out in the Amendment Regs 2024, including but not limited to Regulation 18C (b) and Guidelines, and ii. highlight any other areas of inadequacies to enable proper segregation of customers’ assets. III. Safeguarding of Customers’ Assets – a. Review and assess the applicant’s proposed IPPCs and proposed customer disclosures on its maintenance of a trust account (for purposes of segregation of customers’ assets) to: i. identify any gaps against relevant regulatory requirements set out in the Amendment Regs 2024, including but not limited to Regulations 18B, 18C, 18D,18E and Guidelines, and ii. highlight any other areas of inadequacies to enable proper safeguarding of customers’ assets. IV. Risk Management Controls for Customers’ Assets – a. Review and assess the applicant’s proposed IPPCs and proposed systems (where relevant) on the mitigation of conflict of interest between its duties relating to the safeguarding of customers’ assets and its business interests to: i. identify any gaps against relevant regulatory requirements set out in the Amendment Regs 2024 and Guidelines, including but not limited to Regulation 18G of the Amendment Regs 2024 and paragraph 3.4.2 of the Guidelines, and

Guidelines on Licensing for Payment Service Providers 39 ii. highlight any other areas of inadequacies to enable proper mitigation of the risk of dissipation of customer assets. Details on the External Auditor’s criteria and scope of assessment can be found (here). C. Technology & Cybersecurity Risks: Required for DPT licence applicants upon the grant of an in-principal approval

1. Criteria for External Auditor Appointed to Perform the Independent Assessment of Technology and Cybersecurity risks The External Auditor appointed by the applicant to conduct the independent assessment should meet the following criteria: Criteria Minimum Requirements
2. Qualifications, credentials, and track record of the External Auditor and its lead engagement partner / engagement leader a) The External Auditor should be a company, firm or limited liability partnership approved or deemed to be approved as an accounting corporation, accounting firm or accounting limited liability partnership, respectively, under the Accountants Act 2004. b) The External Auditor, as well as its lead engagement partner/ engagement leader13, must have made:

• at least one report in respect of a statutory audit pursuant to MAS regulations on a financial institution regulated or authorised by MAS, or
• at least one independent review/ assessment in the area of technology and cybersecurity risks on a financial institution regulated or authorised by MAS.

2. Independence a) The External Auditor should be independent from the applicant, its group or group companies. b) In the provision of its services for purpose of conducting the independent assessment for the applicant, the External Auditor must satisfy itself that there are no conflicts of interest arising from its ongoing business relationships with the applicant, its group or group companies, up to the conclusion of its engagement. 13 The engagement leader should be of sufficient seniority, and has adequate experience and expertise in the area of technology and cybersecurity risks (tech risk). The onus is on the applicant to ensure that it appoints a suitably qualified independent External Auditor to perform an independent assessment of its policies, procedures and controls on tech risk.

Guidelines on Licensing for Payment Service Providers 40 2) Scope of Assessment The following sets out Technology and Cybersecurity Risks areas to be assessed by an Independent External Auditor, that will be imposed as in-principal approval (IPA) condition. Technology And Cybersecurity Risks: I. Cyber Hygiene – a. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels, i. identify any gaps against relevant regulatory requirements set out in MAS Notice FSM-N14 Cyber Hygiene; and ii. highlight any areas of improvements required to mitigate cyber hygiene risks. II. Data Loss Prevention – a. Review and assess the applicant’s proposed IPPCs on data loss prevention in the following areas: i. Protection of sensitive data (including customer data) during transmission and storage; ii. Detection and prevention of unauthorised access or disclosure (including communication, transfer and storage) of sensitive data (including customer information); and iii. Protection of cryptographic keys for custodial wallet (for DPT applicants). b. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels, iv. identify any gaps against applicable technology risk management regulatory requirements set out including but not limited to MAS Notice FSM-N13 Notice on Technology Risk Management and section 11 of the Guidelines on Technology Risk Management; and v. highlight any areas of improvements required to mitigate technology risks posed by its proposed business model. III. Penetration Testing – a. Review and assess the applicant’s proposed IPPCs on penetration testing systems, including: i. frequency of the penetration testing that is determined based on factors such as system criticality and the system’s exposure to cyber risks. For systems that are directly accessible from the Internet, the applicant should conduct

Guidelines on Licensing for Payment Service Providers 41 penetration testing to validate the adequacy of the security controls at least once annually or whenever these systems undergo major changes or updates; and ii. Service Level Agreements (“SLAs”) to rectify penetration testing findings that is commensurate with the associated risk levels. b. Review and assess whether the penetration test(s) performed (within the last 12 months) on the applicant’s proposed online financial service(s) are relevant and adequate to identify critical security weaknesses. c. Taking into consideration the applicant’s proposed business model, products, services, funds flows and delivery channels, i. identify any gaps against applicable technology risk management regulatory expectations set out including but not limited to section 13.2 of the Guidelines on Technology Risk Management; and ii. highlight any areas of improvements required to mitigate technology risks posed by its proposed business model. IV. Digital Wallet and Smart Contracts – a. Review the applicant’s proposed IPPCs and assess whether the proposed IPPCs include the following controls that are commensurate with the applicant’s proposed business model, products, services, funds flows and delivery channels: i. Adherence to security-by-design principles (including proper access control, thorough testing, regular updates to stable versions, static and dynamic code analysis) throughout its system development life cycle for its proposed system(s) and smart contracts, if relevant; ii. Development of smart contracts, including controls to ensure smart contracts are secure from cyber threats and vulnerabilities by having secure development, DevSecOps, and testing, to prevent unauthorised access, data breaches, and exploitation of security flaws; iii. Controls to ensure high availability of critical systems, as well as recovery of system(s) and business resumption priorities (including root cause and impact analysis) to ensure swift recovery strategy for such system(s); iv. Adoption of techniques, such as multi-party computation and threshold signature schemes, to secure custodial wallets; v. Implementation of network isolation between the custodial wallet systems and other information systems/ Internet to prevent unauthorised connections; and vi. Segregation of cryptographic key components for custodial wallets to ensure that no single individual or system has access to the complete key at any time (i.e. adhere to the “never alone” principle by requiring at least two authorised personnel to coordinate and approve key management operations).

Guidelines on Licensing for Payment Service Providers 42 3) External Auditor’s Declaration The External Auditor(s) is(are) required to complete and sign a declaration that it meets the minimum criteria in experience and expertise as set out in 1) above. The External Auditor(s) engaged is(are) also required to declare and confirm on the work steps it had undertaken, which includes the following: i. External Auditor had conveyed its assessment and findings to the applicant’s Management team, and the applicant has acknowledged the factual accuracy of the External Auditor’s findings and/ or observations. ii. External Auditor had obtained and reviewed relevant policies and procedures for the purposes of conducting the independent assessment. iii. External Auditor had conducted interviews with the key management personnel (“KMP”). iv. External Auditor had conducted walkthroughs of key processes, including proposed system(s) to be used with the key process owners and/or KMP. The External Auditor’s Declaration required for submission can be found (here).