A practical breakdown of MAS Notice PSN02 — what it requires, who it applies to, and how DPT service providers can stay compliant in Singapore.

If you operate a crypto exchange, digital asset custodian, or any platform facilitating the exchange or transfer of digital payment tokens in Singapore, MAS Notice PSN02 is the regulatory document that governs your AML/CFT obligations. It is not optional, and MAS has made clear — through a sequence of amendments, enforcement actions, and hard licensing deadlines — that it expects full compliance.

This article breaks down what PSN02 actually requires, who it applies to, how it has changed since it was first issued, and what non-compliance looks like in practice. Whether you are setting up a new operation, reviewing your existing compliance programme, or evaluating Singapore as a licensing jurisdiction, this guide gives you the operational clarity you need.

What Is MAS Notice PSN02?

MAS Notice PSN02 is Singapore’s primary AML/CFT regulatory notice for digital payment token (DPT) service providers. Issued by the Monetary Authority of Singapore under the Payment Services Act (PSA), it sets out the specific obligations that licensed DPT service providers must meet to detect, deter, and report money laundering and terrorist financing activity.

The Notice was first issued on 5 December 2019, alongside the commencement of the Payment Services Act. It has since been amended several times — most significantly in 2022, April 2024, and again in July 2025 — reflecting Singapore’s commitment to keeping its AML/CFT framework aligned with evolving FATF standards and the expanding scope of regulated DPT activities.

PSN02 sits within a broader regulatory architecture. The Payment Services Act provides the licensing foundation. The Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act (CDSA) and the Terrorism (Suppression of Financing) Act (TSOFA) provide the underlying criminal law. PSN02 translates these into concrete, operational requirements for DPT service providers specifically.

Who PSN02 Applies To

PSN02 applies to holders of a Standard Payment Institution (SPI) licence or a Major Payment Institution (MPI) licence who carry on a digital payment token service in Singapore. In practical terms, this covers four categories of activity:

• Dealing in DPTs (buying and selling)
• Facilitating the exchange of DPTs between customers
• Facilitating the transmission of DPTs
• Providing custodian wallet services

It is worth noting that PSN02 applies to the service, not just the corporate entity. A firm licensed for multiple payment services must treat its DPT obligations under PSN02 as a separate compliance stream from its other services. Customer due diligence performed under a cross-border money transfer service does not automatically satisfy CDD obligations for that same customer’s DPT transactions — the records and controls must be addressed independently for each licensed service.

From July 2025, a parallel framework also applies to Digital Token Service Providers (DTSPs) — entities incorporated in Singapore that provide digital token services to clients outside Singapore — under MAS Notice FSM-N27, issued pursuant to the Financial Services and Markets Act 2022. The AML/CFT obligations in FSM-N27 mirror those in PSN02, but DTSPs that had not secured a licence by 30 June 2025 were required to cease operations entirely.

PSN01 vs. PSN02: What Is the Difference?

PSN01 governs AML/CFT requirements for payment service providers generally — covering specified payment services such as account issuance, domestic money transfers, and merchant acquisition. PSN02 is the DPT-specific notice. The two notices run in parallel; a firm providing both DPT services and other payment services is subject to both.

The more important distinction is one of risk calibration. PSN02 carries a higher baseline of obligations than PSN01. MAS treats DPT services as presenting elevated money laundering and terrorist financing risks compared to traditional payment services. This is because digital payment tokens are typically internet-based, cross-border in nature, and — when unmonitored — provide greater anonymity than conventional financial instruments. PSN02’s requirements reflect that risk profile directly.

Core AML/CFT Obligations Under PSN02

PSN02’s obligations span the full compliance lifecycle — from customer onboarding through to record retention. The following outlines the main requirement areas in operational terms.

Risk Assessment and Risk Mitigation

Every DPT service provider must develop and maintain a written, board-approved AML/CFT policy. The starting point is a risk assessment covering the provider’s customer base, geographies, products, and delivery channels. Risk mitigation controls must be proportionate to the risks identified. The AML/CFT policy must reflect the current version of PSN02 and cover DPT-specific risk scenarios, including exposure to anonymity-enhancing technologies.

Customer Due Diligence (CDD)

CDD is required at the point of establishing a business relationship, before carrying out any transaction for a new customer, and on an ongoing basis throughout the relationship. For individual customers, this means identity verification using reliable, independent documents. For corporate customers, CDD must trace beneficial ownership down to the natural person level — any individual holding 25% or more of the entity must be identified and verified.

Enhanced Due Diligence (EDD) is required for higher-risk customers, including politically exposed persons (PEPs) and customers connected to higher-risk jurisdictions. MAS expects source-of-wealth checks to be genuinely substantiated, not merely declared by the customer.

Ongoing Transaction Monitoring

DPT service providers must monitor transactions on a continuous basis to detect patterns or activity inconsistent with a customer’s stated profile. Transaction monitoring systems must be configured with appropriate thresholds and reviewed regularly. Configuration and tuning logs should be retained as evidence of an active, maintained monitoring function.

Suspicious Transaction Reporting

Where there are reasonable grounds to suspect that a transaction or activity involves the proceeds of crime or is linked to terrorism financing, the firm must file a Suspicious Transaction Report (STR) with the Suspicious Transaction Reporting Office (STRO). There is no minimum transaction value for STR filing — the obligation is triggered by suspicion, not by amount.

Sanctions Screening

All customers and counterparties must be screened against relevant sanctions lists, including UN Security Council lists and MAS-designated targets. Screening must occur at onboarding and on an ongoing basis. Singapore’s sanctions framework includes specific regulations relating to North Korea and Iran, which DPT service providers must integrate into their screening programmes.

Record Keeping

Customer due diligence records, transaction records, internal investigation records, and audit documentation must be retained for a minimum of five years. Records must be maintained in sufficient detail to reconstruct individual transactions and to demonstrate, on request, the compliance decisions and risk assessments that informed them.

Third-Party Reliance

PSN02 permits a DPT service provider to rely on a third party to perform CDD measures, but only under strict conditions. The service provider must be able to obtain CDD records from the third party immediately on request, and must be satisfied that the third party is subject to AML/CFT requirements consistent with FATF standards and is supervised for compliance. Responsibility for CDD remains with the licensed entity — it cannot be delegated or contracted away.

Group-Wide Policies

Where a DPT service provider operates within a group structure — including branches or subsidiaries — PSN02 requires the implementation of group-wide AML/CFT policies. This ensures that compliance standards are applied consistently across the group, regardless of where individual entities are incorporated or operating.

Internal Controls, Audit, and Training

Firms must maintain an independent, adequately resourced audit function capable of regularly assessing the effectiveness of AML/CFT controls. Senior management is expected to exercise active oversight — not merely sign off on documents. Staff at all levels must receive regular, appropriate training on AML/CFT regulations, internal policies, and their personal obligations under the law.

The Travel Rule: A PSN02-Specific Requirement

One of the most technically demanding obligations in PSN02 is compliance with the FATF Travel Rule, which requires originator and beneficiary information to travel with a DPT transfer. In Singapore, this requirement is embedded directly in PSN02 and applies to all DPT transfers of SGD 1,500 or above.

For any qualifying transfer, the originating institution must transmit the following information to the beneficiary institution before or at the time of the transfer:

• Originator’s full name
• Originator’s account number (or DPT wallet address)
• Originator’s country of residence

The Travel Rule applies to both inbound and outbound flows. Where a transfer involves an entity that is not a regulated financial institution or a FATF-supervised DPT service provider, PSN02 requires the firm to apply enhanced risk mitigation measures. This means the identity of both sender and recipient must be established and assessed before the transfer is executed or accepted.

Practically, Travel Rule compliance requires technology infrastructure — either a proprietary solution or integration with a Travel Rule protocol provider — that can transmit, receive, and verify counterparty information at scale. This is frequently one of the most resource-intensive elements of a PSN02 compliance build.

How PSN02 Has Evolved: 2022 to 2025

PSN02 has not been static. Understanding its revision history matters because firms operating under an older compliance programme — one that predates the 2022 or 2024 amendments — may be operating on an outdated foundation.

The significant milestones are:

• 2021 (PSA Amendment Act): Parliament passed amendments expanding the scope of regulated DPT services to include custodial wallet services and facilitation of DPT exchange, even where the provider does not take possession of the assets.
• April 2024: A revised PSN02 took effect, aligned with the commencement of the Payment Services (Amendment) Act 2021. The April 2024 Notice extended AML/CFT obligations to the newly scoped-in DPT services, required Singapore-incorporated PSPs to implement group-wide AML/CFT policies, and introduced reporting fields for transactions involving anonymity-enhancing technologies.
• July 2025: A further amendment to PSN02 took effect from 1 July 2025, coinciding with the DTSP licensing deadline under the FSMA. From this point, the parallel FSM-N27 notice governs entities that provide digital token services outside Singapore under the FSMA framework.

The April 2024 amendments also introduced a compliance attestation requirement. Entities seeking or renewing a DPT service licence must submit an attestation report completed by a qualified external auditor confirming that their AML/CFT controls meet the requirements of PSN02.

Enforcement Reality: What Non-Compliance Costs

MAS’s recent enforcement activity makes clear that AML/CFT breaches carry real consequences. Please note that MAS has not published a comparable composition action against DPT licensees under PSN02.

In June 2025 it imposed S$960,000 in penalties on five cross-border money transfer MPIs for breaches of Notice PSN01 — the first public AML/CFT composition action against payment institutions under the PSA.

In July 2025 it imposed S$27.45 million on nine financial institutions connected to the 2023 S$3 billion money-laundering case.

Both actions show MAS will fine institutions for weak CDD, screening and monitoring.

Common failure patterns identified in MAS supervisory examinations include:

• Inadequate customer risk assessment and documentation
• Weak source-of-wealth verification for high-risk customers
• Transaction monitoring gaps
• Poor escalation procedures and senior management oversight

Beyond financial penalties, the consequences of non-compliance extend to licence revocation, public reprimand, and prohibition orders against individuals. For DPT service providers that have invested in licensing and infrastructure, the reputational and operational cost of an enforcement action dwarfs the cost of building adequate compliance from the outset.

For firms providing DPT services outside Singapore through a Singapore-incorporated entity, the stakes became higher still from 30 June 2025. Firms that failed to obtain a DTSP licence under the FSMA before that date were required to cease operations, with no transitional period. Non-compliance with that deadline exposes directors and officers to criminal penalties including fines of up to SGD 250,000 and potential imprisonment.

Building a PSN02-Compliant Programme

A PSN02-compliant AML/CFT programme is not a single document — it is an integrated system of policies, procedures, technology, and governance. The following elements are foundational:

• Written AML/CFT policy: Board-approved, current (reflecting the July 2025 version of PSN02), and covering DPT-specific risk scenarios.
• Risk assessment: Documented, regularly reviewed, and linked directly to the controls implemented.
• CDD framework: Tiered by risk level, covering both individual and corporate customers, with UBO identification down to the natural person level.
• Transaction monitoring system: Configured with DPT-appropriate rules, with tuning logs and regular reviews.
• Travel Rule infrastructure: Capable of transmitting and receiving originator/beneficiary information for qualifying DPT transfers.
• Sanctions screening: Applied at onboarding and on an ongoing basis, covering all relevant lists.
• STR process: Clearly defined escalation path from staff to the nominated AML/CFT officer to STRO filing.
• Record retention: Five-year minimum for all CDD and transaction records, in a retrievable format.
• Audit function: Independent, resourced, and operating on a regular review cycle.
• Training programme: Role-appropriate, documented, and updated when regulations change.

Firms operating within a group structure must also ensure that their group-wide AML/CFT policies are documented and applied across all relevant entities.

For those at the stage of applying for a DPT service licence under the PSA, or reviewing an existing programme against the 2024 and 2025 amendments, working with experienced regulatory counsel reduces the risk of building a compliance framework that does not withstand MAS scrutiny. Our AML and compliance practice assists DPT service providers in designing and stress-testing AML/CFT programmes specifically against MAS’s current expectations. If you are also at the licensing stage, our crypto and VASP licensing team can guide you through the full application process, including the attestation report requirement.

Key Takeaways

MAS Notice PSN02 sets a demanding but navigable AML/CFT standard for DPT service providers in Singapore. Its core requirements — risk assessment, CDD, transaction monitoring, Travel Rule compliance, sanctions screening, STR filing, and record keeping — are consistent with FATF standards and have been progressively tightened through amendments in 2022, 2024, and 2025.

MAS’s enforcement posture is no longer theoretical. Composition penalties, licence revocations, and public reprimands have all been used in the payment services space. The June and July 2025 enforcement rounds signalled that MAS is conducting active supervisory examinations and acting on what it finds.

For founders and compliance officers building or reviewing a Singapore DPT operation, the starting point is always the current text of PSN02 — not an older version, and not general guidance written before the 2024 amendments. If your programme has not been reviewed against the April 2024 and July 2025 versions of the Notice, it should be.

Singapore remains one of the most credible licensing jurisdictions for digital asset businesses globally. Achieving and maintaining PSN02 compliance is the operational price of operating in that environment — and for firms that get it right, it is also a genuine competitive advantage. You can explore Singapore and other leading crypto licensing jurisdictions through our jurisdiction advisory practice, or review our client success cases to see how we have guided DPT businesses through the licensing and compliance process.