RegWatch: Guidelines to Notice PSN02 on Prevention of Money Laundering and Countering the Financing of Terrorism — Digital Payment Token Services

Merkle Science’s RegWatch provides expert commentary on the impact of recent regulatory developments from our partners. This article has been contributed by Aaron Chua, Manager at Ingenia Consultants a Singapore-based financial services compliance consultancy.

With the introduction of the Payment Services Act 2019 (‘’PS Act”), the Notice PSN02 was introduced on the 5th December 2019, and came into effect on the 28 January 2020. Subsequent to that in March 2020, the MAS published the AML Guidelines that shall be read in conjunction with the Notice PSN02 which provides guidance to all digital payment token service providers on the requirements in Notice PSN02.

Whilst a significant portion of the AML Guidelines took reference from the existing guidelines that were provided for the other segments of the financial service industry e.g., entities regulated under the Securities Futures Act, Banking Act, etc., there are a few notable differences to Notice PSN02, possibly to address the differences in the conduct of business for a financial institution that carries out digital payment token service.

Non-face-to-face business relations

MAS and regulators from various jurisdictions are cognizant of the shift in consumers’ expectations of fully digital experiences as online financial services platform gain global traction. To reflect this shift, MAS has in the AML Guidelines expanded on the additional checks that digital payment token service providers could take to verify the identity of the customer to manage the risk of impersonation.

While MAS encourages the use of MyInfo as a verified source of identification information, MAS supports the use of technology solutions that can mange the impersonation risks. Other measures include collection of customer device identifiers, IP addresses, with associated time stamps, geo-location data, real-time conferencing that is comparable to face-to-face communication.

To assess the effectiveness of any technology solutions used to manage impersonal risks, the payment service provider shall engage an independent qualified consultant to assess the effectiveness of the technology solution in managing the risk of impersonation.

Ongoing Monitoring & Transaction Monitoring System

MAS has spelled out in the Guidelines that enhanced monitoring should be conducted for higher-risk situations and extend beyond the immediate transaction between the payment service provider or its customer or counterparty e.g., payment service provider may need to trace previous transactions of the digital payment token as far back as necessary to reasonably assess whether the circumstances are unusual or suspicious.

Additionally, the payment service provider shall also make further inquiries when the following circumstances happen:

1. frequent and cumulatively large transactions with no apparent reason;
2. frequent transfers of digital payment tokens to the same recipient;
3. frequent transactions to buy or sell digital payment tokens over a short period of time;
4. multiple transfers of digital payment tokens such that amount of each value transfer is not substantial, but the total of which is substantial.

The payment service provider is also required to determine what constitutes suspicious, complex, unusually large or unusual pattern of transactions which includes analyzing transaction characteristics that are abnormal in size and frequency to customers of similar profile, coming to and from a higher risk country, etc. More examples are provided by MAS in the AML Guidelines what situations would constitute suspicious transactions and if any transaction is deemed to be reportable to the STRO, should be reported through SONAR.

The payment service provider is also required to immediately freeze any funds, financial assets or economic resources owned or controlled, directly or indirectly, by the specific individuals and entities identified by the UN Security Council to be contributors of a particular threat or breach of international peace and security that the payment service provider has in its possession, custody or control, which includes digital payment tokens and a STR to be filed promptly.

Additionally, MAS has indicated that virtual assets can be exploited as a payment method, marketed product or targeted item. Payment methods where ransom payment in virtual assets are paid; marketed product where scams sell virtual assets; targeted items where unauthorized transactions are involved with virtual assets through hacking.

Conclusion

Consequently, a payment service provider that provides digital payment token services should have robust customer due diligence measures to ensure that there are adequate checks on the source of wealth and source of funds and to have sufficient ongoing monitoring mechanisms to mitigate the risks that the payment service provider is not being abused for ML/TF either by complicit involvement of the account holders, or due to unusual movements arising from hacks or scams.

For more details read the full guidelines published by the MAS here.