The payment services industry in Singapore is fast-growing, and new payment solutions are making digital payments quicker, cheaper and more convenient for consumers while also giving rise to new risks. The increasing complexity of payment service models mean that the lines between the various payment services are getting increasingly blurred. There are also concerns that payment service providers may facilitate money laundering or terrorist financing via the use of illicit cross-border transfers, anonymous cash-based payment transactions and the structuring of payment flows to avoid reporting thresholds. Fragmentation and technology risks have come to the fore with advancements in technology emphasising the need to address the lack of interoperability inherent in the existing payments landscape (which was largely cash and cheque-based) and the vulnerability of new forms of payment services to cyber-attacks and personal data leaks.
Recognising the need to address these developments, Singapore enacted the Payment Services Act 2019 ("PS Act"), which consolidated the preceding payments legislation into a single statute as well as expanded the scope of payment services regulation (e.g. by adding certain regulated services such as merchant acquisition services and digital payment token services). Extensive consultation was done and industry feedback was sought by the Monetary Authority of Singapore ("MAS") prior to the enactment of the PS Act, which came into force on 28 January 2020. The PS Act unifies and streamlines Singapore's payments regulatory regime into a single activity-based framework which provides a modular, risk-based approach to allow a single licence holder to potentially undertake multiple payments-related regulated activities.
The PS Act comprises two parallel regulatory frameworks: (1) a licensing regime; and (2) a designation regime. The former focuses on payment services provided to end-customers and merchants, and regulates seven key payment services. More details of the licensing regime is set out in the Payment Services in Singapore section below. The latter enables MAS to designate payment systems and regulate operators, settlement institutions and participants of such payment systems for financial stability, efficiency and/or competition reasons. More details on the designation regime is set out in the Payment Systems section below. Further details on the PS Act are also set out below.
This topic guide should be used as a tool to navigate the payment services regulatory regime in Singapore.
Payment Services in Singapore – Licensing Regime
Licensing Regime
Payment service providers may offer different combinations of these services, and each payment service is regulated commensurate to the risks that it poses.
Payment Service
|
Description
|
(1) Account issuance service
|
Issuing, maintaining or operating a payment account in Singapore (e.g. e-wallet, debit card, credit card or bank account)
|
(2) Domestic money transfer service
|
Providing local money transfer services in Singapore (e.g. providing payment gateway services or payment kiosk services)
|
(3) Cross-border money transfer service
|
Providing inbound and/or outbound remittance services in Singapore
|
(4) Merchant acquisition service
|
Providing merchant acquisition services (i.e., where the service provider contracts with a merchant to accept and process payment transactions, which results in a transfer of money to the merchant)
|
(5) E-money issuance service
|
Issuing e-money in Singapore to allow a person to pay merchants (for goods and services) or transfer e-money to another person (e.g. peer-to-peer transactions)
|
(6) Digital payment token (DPT) service*
|
Buying or selling DPTs, or providing a platform to allow persons to exchange DPTs in Singapore (e.g. cryptocurrency exchanges)
|
(7) Money-changing service
|
Buying or selling foreign currency notes in Singapore.
|
*The Payment Services (Amendment) Act 2021, which has been passed in Parliament on 4 January 2021 but has not yet come into operation, expands the scope of "DPT service" to cover, among other things, transfer of DPTs, custody or safeguarding of DPTs, and facilitating the exchange of DPTs without possession of money or DPTs.
Three Classes of Licenses
The PS Act provides for the following three classes of licences and regulatory requirements differ according to the risks posed by the scope and scale of services a licensee is allowed to provide thereunder:
- Money-changing licence: A licensee can only provide money-changing services.
- Standard payment institution ("SPI"): An SPI may provide any combination of the seven payment services subject to certain threshold limits:
- the monthly average total value of all payment transactions accepted, processed or executed by the licensee over a calendar year must not exceed S$3 million (or its equivalent in a foreign currency) for one payment service, or S$6 million (or its equivalent in a foreign currency) for two or more payment services;
- where the licensee provides an e-money account issuance service, the sum of: (a) the daily average total value of all e-money stored in any payment account issued by the licensee to a person resident in Singapore over a calendar year; and (b) the daily average total value of all e-money issued in Singapore and stored in any payment account issued by the licensee to any person the licensee has not determined to be resident outside Singapore over a calendar year must not exceed S$5 million (or its equivalent in foreign currency); and
- where the licensee provides an e-money issuance service, the daily average total value of all specified e-money that is issued by the licensee must not exceed S$5 million (or its equivalent in foreign currency).
- Major payment institution ("MPI"): An MPI may provide any combination of the seven payment services. A person that crosses the thresholds above must obtain an MPI licence.
(See Section 6 of the PS Act and also Guidelines on Licensing for Payment Service Providers [PS-G01].)
Risk Mitigation
The PS Act seeks to mitigate risks in four key areas across relevant payment services:
- User Protection: MPIs are required to safeguard certain customer monies ("relevant money") against their own insolvency by using any of the following means:
- an undertaking from a safeguarding institution (e.g. a bank) to be fully liable to the customer for the relevant money;
- a guarantee given by a safeguarding institution for the amount of relevant money;
- depositing the relevant money in a trust account maintained with a safeguarding institution; or
- in such other manner as may be prescribed
(See Section 23 of the PS Act and Regulations 14-16 of the Payment Services Regulations 2019). Separately, see also Guidelines for E-Payments User Protection)
- Money laundering/terrorist-financing risks: Certain payment services attract heightened anti money-laundering and countering the financing of terrorism requirements.
(See Notice PSN01 Prevention of Money Laundering and Countering the Financing of Terrorism – Specified Payment Services, Notice PSN01A Prevention of Money Laundering and Countering the Financing of Terrorism - Persons Providing Account Issuances Services who are Exempted under the Payment Services (Exemption for Specified Period) Regulations 2019, Notice PSN01AA Prevention of Money Laundering and Countering the Financing of Terrorism - Persons Providing Account Issuances Services who are Exempted under the Payment Services (Exemption for Specified Period) Regulations 2019, Notice PSN02 Prevention of Money Laundering and Countering the Financing of Terrorism – Digital Payment Token Service, and Notice PSN10 Prevention of Money Laundering and Countering the Financing of Terrorism - Exempt Payment Service Providers.)
- Interoperability: MAS is given formal powers to ensure interoperability of payment solutions, in the interests of customers and market development. See below the Powers, Payment Investigation and Enforcement section of the topic guide.
- Technology risk: MAS is given powers to impose technology risk management requirements, including cyber risk management requirements, on all licensees. These requirements ensure that there is adequate risk governance and the implementation of adequate controls, particularly in areas such as user authentication, data loss protection and cyber-attack prevention and detection.
(See PSN05 Notice Technology Risk Management, PSN06 Notice on Cyber Hygiene, Guidelines on Risk Management Practices – Technology Risk, FAQ – Notice on Cyber Hygiene and MAS/TCRS/2021/03: Advisory on Addressing the Technology and Cyber Security Risks Associated with Public Cloud Adoption.)
In accordance with the MAS' risk-focused licensing regime, the MAS has also set out in an infographic how these risks relate to each of the seven payment services:
*extracted from MAS Infographic on PS Act.
We also set out below the subsidiary legislation to the PS Act, and a non-exhaustive list of guidance and reference materials applicable to payment services in Singapore:
Reference should also be had to the MAS website and the Singapore Statutes Online website for the most updated legislation, regulatory guidance and reference materials.
