Note on Payment Services Act
Article by Ronald JJ Wong.
Updated 20 January 2020
The Payment Services Act (“PSA”) will commences on 28 January 2020.
MAS has issued the Guidelines on Licensing for Payment Service Providers, Guideline No: PS-G01 (18 December 2019) and specimen forms for PSA.
Summary of Considerations for Payments Service Providers
If you provide any service, incidental to your core business or otherwise, which involves payments, consider if you are regulated under the PSA.
Consider whether your service falls within any exemptions under the PSA.
If you have been offering certain services prior to the PSA’s commencement, notify MAS of the same between 28 January and 27 February 2020 to enjoy a limited period of licence-exemption.
Prepare for all necessary requirements, including policies and procedures to achieve compliance with the PSA, PS Regulations and MAS Notices. These include:
Governance and ownership requirements
Base capital requirements
Security furnished to MAS
Safeguarding clients funds
Competency and fit & proper requirements of key individuals
Registered office and place of business
Compliance arrangements
Technology risk management
Audit arrangements
Anti-money laundering and countering financing of terrorism arrangements
Cyber-hygiene and security
Business conduct requirements
Periodic reporting to MAS
Disclosures and communications
E-payment user protection
Make the necessary licence application to MAS.
Exclusions / Non-Exclusions from Regulated Activities
No incidental service exemption:
There is no exemption for payment services that are incidental to a core business. Incidental payment services are expressly regulated in the PSA (sections 2(4), 5(2)).[i] Express disapplication of the holding in Chinpo Shipping Co (Pte) Ltd v. Public Prosecutor [2017] 4 SLR 983 (HC),[2] where the court held that the MCRBA prohibits unlicensed business of accepting moneys for transmission to persons outside Singapore rather than the mere act to that effect, and the provision of remittance as a service in its own right rather than simply as an incident to a core business.
MAS has given the example of online marketplace operators offering payment services to facilitate transactions in the marketplace—such operators must have a licence.[3] MAS views that such incidental services carry similar regulatory risks to payment services that are not related or not incidental.
However, payment services provided by any person regulated or exempt under the (i) Financial Advisers Act; (ii) Insurance Act; (iii) Securities and Futures Act; (iv) Trust Companies Act, that is solely incidental to or necessary solely for the carrying on of any regulated activity under these Acts are excluded from the PSA as the AML CTF risks are regulated under other MAS regulations.[4]
Excluded: limited purpose e-money.
Part 2 and Part 3 of First Schedule, PSA defines excluded payment services. This includes any service relating to only limited purpose e-money.[ii] This includes:
e-money used to pay for goods or services by the issuer (or limited network of providers which has arrangement with issuer);
loyalty programs e-money / credit,
e-money that can only be used for payment or part payment of goods or services provided by merchants within the physical premises operated, owned or managed by the issuer (or its related corporations or associated companies) (subject to conditions, e.g. no refund or withdrawal, not exceeding $1,000 in account).
Excluded: limited purpose digital payment tokens / virtual currencies.
Means non‑monetary customer loyalty or reward point, any in‑game asset, or any similar digital representation of value that (a) cannot be returned to its issuer, transferred or sold in exchange for money; and (b) may only be used
in the case of a loyalty of reward point, for payment or pay payment of, or in exchange for, goods or services, or both, provided by its issuer or any merchant specified by its issuer; or
for in‑game asset, for the payment of, or in exchange for, virtual objects or virtual services within an online game, etc.
Types of Licences
There are three types of licences as set out in section 6 of the PS Act:
apply for a money-changing (“MC”) licence if it only intends to carry out money-changing service; or
in any other case, apply for;
a Standard Payment Institution (“SPI”) licence if it intends to conduct payment services below the specified thresholds; or
a Major Payment Institution (“MPI”) licence if it intends to conduct payment services without being subject to the specified
The thresholds are set out in section 6(5) of the Act and are, in summary:
S$3m monthly transactions for any activity type
S$6m monthly transactions for two or more activity types
S$5m of daily outstanding e-money
Main difference between SPI and MPI:
Base Capital – SPI: S$100,000; MPI: S$250,000.
Security: monthly ≤ S$6 million $100,000; > S$6 million: $200,000.
MPI providing (a) a domestic money transfer service; (b) a cross‑border money transfer service; (c) a merchant acquisition service; (d) an e‑money issuance service, must safeguard e-money floats or customers’ funds: 1) an undertaking or guarantee by any bank in Singapore or prescribed financial institution to be fully liable to the customer for such monies; 2) a deposit in a trust account; or 3) any other safeguards as may be prescribed by MAS.
Other compliance requirements likely the same for SPI and MPI in terms of type but different in terms of degree.
Variation or change of licence – A licensee must apply for a variation or change of licence in Form 2 if it intends to (i) add or remove any payment service, or (ii) change its licence
Designated payment systems. MAS may designate any payment system under PSA (s 42). Similar to current scheme in POSA.
DPS generally are payment systems with potential significant adverse impact on the wider financial system of Singapore, e.g. it’s widely used or recognised.
MAS may impose additional conditions or restrictions on DPS. Obligations under PSA (s 47-71) include: to notify MAS of certain prescribed events, including new businesses and acquisitions, to submit periodic reports to MAS, to seek MAS and Court approval for transfers of the business, to seek MAS approval for change in shareholder controllers of the DPS and appointments of CEOs and directors, and annual audit.
Different category from SPI and MPI. SPI or MPI may be designated.
Notification & Exemption
Persons who, before the commencement date of the PSA, carried on an account issuance service, domestic money transfer service, merchant acquisition service, e-money issuance service and/or DPT service (specific payment services), should notify MAS of the date on which they commenced the business of providing the specific payment services.
MAS has issued a sample of the Notification Form for the Purpose of Exemption for Holding a Licence under the Payment Services Act for the Specified Period (Notification Form).
Notifications will be accepted via the online version of the Notification Form on MAS website between 28 January 2020 and 27 February 2020.
Persons who make a successful notification will be exempt from having to apply for and hold a licence with respect to the specific payment services for the specified period (six months from 28 January 2020 for providers of a DPT service and 12 months from 28 January 2020 for the other relevant payment services).
Admission Criteria
Governance and ownership requirements
Governance/Ownership Requirements for Money-Changing Licence
Sole-proprietor
The applicant must be a Singapore citizen.
The applicant must have a minimum of 1 year's relevant working or business experience on a full-time basis.
Partnership or Limited Liability Partnership (LLP)
The majority of its partners should be Singapore citizens. If there are only two partners, only one needs to be a Singapore citizen.
Each partner must have a minimum of 1 year's relevant working or business experience on a full-time basis.
Singapore-owned Company
More than 50% of the equity shareholdings should be beneficially owned and effectively controlled by Singapore citizens.
A majority of the board of directors of the company should be Singapore citizens. If there are only two directors, only one of the directors needs to be a Singapore citizen.
Each executive director must have a minimum of 1 year's relevant working or business experience on a full-time basis.
Singapore incorporated wholly-owned subsidiary of a foreign bank, or a foreign company primarily engaged in money- changing
The parent company must:
Be of significant size. In case of a foreign bank, it needs to rank among the top banks in the country where it is incorporated.
Possess a good track record and reputation.
Be adequately regulated and supervised by its home supervisory authority for AML/CFT.
Governance/Ownership Requirements for Standard or Major Payment Institution Licence
Singapore- incorporated company OR Singapore branch of a foreign- incorporated company
At least one Executive Director[5] of the applicant is a Singapore citizen or permanent resident; or,
At least one Executive Director of the applicant is a Singapore Employment Pass holder and at least one other director of the applicant is a Singapore citizen or permanent resident
Fit and Proper requirements[6]
Competency of Key Individuals - sufficient experience, educational qualifications and professional certification in payment services or financial services.
Permanent place of business or registered office - office area where books and records securely held. At least one person to be present to address any queries or complaints from [7]
Base Capital – SPI: S$100,000; MPI: S$250,000
Security - cash deposit with MAS or a bank guarantee in the prescribed
Compliance Arrangements - commensurate with nature, scale and complexity of “Ultimate responsibility and accountability rest with sole-proprietor, partners, or directors and CEO, and compliance officer”.
Technology Risk Management - for online financial services, penetration test of proposed online financial services, remediate all high-risk findings identified, and conduct independent validation on the effectiveness of the remediation
Identify risks and develop SOPs regarding IT systems, cloud computing & storage, outsourced IT vendors, software migration, cybersecurity, encryption, data loss & backup, system availability and recovery, data centre, user access control.
It’s a risk management framework, i.e. highly dependent on your specific business operations and systems.
Penetration testing should be conducted prior to commissioning new system which offers internet accessibility and open network interfaces.
Source code review for vulnerabilities, errors, poor coding practices.
Audit Arrangements - independent audit arrangements regarding procedures, controls, and compliance with regulatory requirements. Audit may be conducted by an internal audit function within the applicant, an independent internal audit team from the head office of the applicant, or outsourced to a third party service provider.
Annual Audit Requirements - section 37 of the PS Audit of accounts and transactions, and compliance with the relevant regulations and requirements.
Letter of Responsibility and/or Letter of Undertaking - from the applicant’s majority shareholders, parent company and/or related
Other Factors - MAS may also take into consideration factors such as:
track record and financial condition of the applicant, its holding company or related corporations, where applicable;
operational readiness of the applicant, including ability to comply with regulatory requirements;
whether the applicant, its holding company or related corporations are subject to proper supervision by a competent regulatory authority;
commitment of the applicant’s holding company to operations in Singapore; and
whether the public interest will be served by granting a
Ongoing Requirements
Anti-Money Laundering and Countering the Financing of Terrorism (“AML/CFT”) Requirements - Notices on the Prevention of Money Laundering and Countering the Financing of Terrorism [PSN01 and/or PSN02] and Notice on Reporting of Suspicious Activities & Incidents of Fraud [PSN03].
Periodic Returns - submit periodic regulatory returns in accordance with the PSR. The requirements are set out in the Notice on Submission of Regulatory Returns [PSN04].
Cyber Hygiene - Notice on Cyber Hygiene [PSN06] (effective 6 August 2020) and put in place appropriate safeguards to protect customer information.
Secure admin accounts. Security patches applied to address vulnerabilities to every system timely. Written set of security standards for every system. Network perimeter to restrict unauthorized network traffic. Malware protection. Multi-factor authentication for all admin accounts and accounts to access customer info.
Business Conduct - PSA, PSR and Notice on Conduct [PSN07]. Include safeguarding of customers’ monies, record of transactions, issuance of receipts, adhering to the prescribed time period for transmission of money, display of exchange rate and fees, and notification of normal business hours. Comply with all prohibitions and restrictions, including personal payment account stock and flow restrictions,[8] as well as prohibited business
Disclosures and Communications - Accurate representation on the scope of its licence and provide the disclosures set out in the Notice on Disclosures and Communications [PSN08] . Ensure customers receive timely updates regarding any material changes to the
Annual Audit Requirements - annual audit of accounts and transactions, and compliance with regulations and requirements. Auditor must submit a report to MAS in Form 4.
Licensees should also understand and apply the relevant MAS Guidelines such as the Guidelines on Technology Risk Management and E-payments User Protection Guidelines, and keep abreast of regulatory
E-payments user protection guidelines obligations include:
Informing account holder of their user protection duties.
Notify account holders of outgoing transactions.
Allow account user to confirm payment transaction and recipient credentials.
Have reporting channel for unauthorized or erroneous transactions.
Assess and investigate claims by account holders of unauthorized transactions, process holders’ claims.
[1] MAS Guidelines On Licensing For Payment Service Providers, Guideline No: PS-G01, 18 December 2019, page 3.
[2] Case summary https://www.supremecourt.gov.sg/news/case-summaries/chinpo-shipping-company-private-limited-v-public-prosecutor
[3] Response to Feedback Received on Proposed Payment Services Bill MAS P0212017.
[4] Paragraph 2(i) of First Schedule: any payment service mentioned in Part 1 of this Schedule that is provided by any person licensed, approved, registered or regulated, or exempt from being licensed, approved, registered or regulated, under any of the following Acts, in any case where the payment service is solely incidental to or necessary solely for that person to carry on that person’s business in any regulated activity for which that person is so licensed, approved, registered, regulated or exempt from being licensed, approved, registered or regulated:
(i) Financial Advisers Act (Cap. 110);
(ii) Insurance Act (Cap. 142);
(iii) Securities and Futures Act (Cap. 289);
(iv) Trust Companies Act (Cap. 336);
[5] As set out in section 2 of the PS Act, executive directors should be involved in the day-to-day running of and making of executive decisions on behalf of the business or operations of the applicant. They are expected to be resident in Singapore to oversee the activities of the licensee. Nominee directors such as investors, legal advisers or corporate secretaries are not Executive Directors. Non- Executive Directors provide oversight as members on the Board of Directors, but are not involved in the day-to-day business or operations of the licensee. The job titles and designations of directors should reflect the substance of the role and responsibilities of the individual.
[6] Sole-proprietor, partners, or directors and CEO, shareholders and employees, as well as the applicant itself, are fit and proper, in accordance with the Guidelines on Fit and Proper Criteria [FSG-G01]. The entity and group should not have any adverse reputation, particularly with regard to financial crime.
[7] As set out in MAS Notice PSN07, licensees must appoint at least one person to be present at its permanent place of business or registered office for a minimum of 10 days a month and a minimum of eight hours on each of those days during its normal business hours, unless:
it has notified all its customers in writing and in advance of any planned non-operating days that will prevent it from meeting the specified days and hours; or
there are circumstances beyond the control of the licensee that could not reasonably have been foreseen that prevent it from meeting the specified days and
[8] Personal payment accounts will be subject to a stock cap, which is the maximum amount of funds that can be held in a personal payment account at any given time. They will also be subject to an annual flow cap. This is the maximum cumulative amount of yearly outflows from the personal payment account, other than to the user’s designated bank accounts. The stock and flow caps were calibrated with due regard to consumer needs and existing industry practices, and will be set initially at $5,000 and $30,000 respectively: https://www.mas.gov.sg/news/speeches/2019/payment-services-bill
[i] Section 2(4) For the purposes of sections 5(2) and 13(13) and paragraph 2(i) of the First Schedule, a payment service, or the provision of a payment service, is incidental to any other business carried on by a person, if the payment service —
(a) is carried on, offered or provided by that person to support that other business; and
(b) is provided by that person in connection with the carrying on of that other business.
Section 5(2) For the purposes of subsection (1), where a person provides any type of payment service while the person carries on any business (called in this subsection the primary business)—
(a) the person is presumed to carry on a secondary business of providing that type of payment service, regardless whether the provision of that type of payment service is related or incidental to the primary business; and
(b) the presumption in paragraph (a) is not rebutted by proof that the provision of that type of payment service is related or incidental, or is both related and incidental, to the primary business.
[ii] “limited purpose e‑money” means any of the following types of electronically stored monetary value:
(a)
any electronically stored monetary value that is, or is intended to be, used only in Singapore for any of the following purposes:
(i)the payment or part payment of goods or services (or both) provided by the issuer of the electronically stored monetary value;(ii)the payment or part payment of goods or services (or both) provided by any member of a limited network of providers of goods or services, being a network that has a commercial arrangement with the issuer of the electronically stored monetary value for every member of the network to accept the electronically stored monetary value as payment or part payment for goods or services (or both) provided by the member;(iii)
the payment or part payment of goods or services (or both) provided by any person within any one or more physical premises owned, operated or managed by the issuer of the electronically stored monetary value, or any related corporation or associated company of that issuer, in a case where all of the following conditions are satisfied:
(A)the user of the electronically stored monetary value is not contractually entitled to receive any refund of any unused portion of the electronically stored monetary value in any currency;(B)if the electronically stored monetary value exceeds $100 (or its equivalent in a foreign currency), any unused portion of the electronically stored monetary value cannot be refunded to the user of the electronically stored monetary value in any currency, unless the issuer identifies and verifies the identity of that user;(C)the electronically stored monetary value cannot be withdrawn by the user of the electronically stored monetary value, from any payment account maintained for that user, in exchange for any currency;(D)the amount of electronically stored monetary value contained in any payment account maintained for the electronically stored monetary value cannot exceed $1,000 (or its equivalent in a foreign currency);
(b)
any electronically stored monetary value that is, or is intended to be, used only in Singapore in a case where —
(i)all of the electronically stored monetary value is issued by a public authority; or(ii)a public authority has undertaken to be fully liable for the value of all of the electronically stored monetary value issued by the issuer of the electronically stored monetary value, in the event of any default by the issuer in honouring a valid payment made using the electronically stored monetary value;
(c)
any electronically stored monetary value, that —
(i)is denominated in any currency;(ii)is issued as part of a scheme, the dominant purpose of which is to promote the purchase of goods, or the use of services, provided by the issuer of the electronically stored monetary value or any merchant specified by that issuer;(iii)is issued to a user of the electronically stored monetary value upon the purchase of goods, or the use of services, provided by the issuer of the electronically stored monetary value or any merchant specified by that issuer;(iv)is used for the payment or part payment of goods or services (or both) provided by the issuer of the electronically stored monetary value or any merchant specified by that issuer;(v)is not part of a financial product;(vi)cannot be withdrawn by the user of the electronically stored monetary value, from any payment account maintained for that user, in exchange for currency; and(vii)if the electronically stored monetary value exceeds $100 (or its equivalent in a foreign currency), cannot be refunded to the user of the electronically stored monetary value in any currency, unless the issuer of the electronically stored monetary value identifies and verifies the identity of that user;
This article was first posted on www.ronaldjjwong.com at the following link.
The author is a Director at Covenant Chambers LLC and runs his own practice that specialises in Corporate and Commercial advisory amongst other areas/matters.
The information is not legal advice, and should not be treated as such. Should you require legal advice on any specific matter, you may refer to our list of lawyers under "Firm" on the header bar above.