MAS Consults on Proposed Regulatory Measures for Digital Payment Token Services

October 2022

In October 2022, MAS issued a consultation paper to consult on proposed regulatory measures for licensees and exempt payment service providers that carry on a business of providing a digital payment token (DPT) service under the Payment Services Act 2019 (“PS Act”) (collectively known as “DPT service providers” or DPTSPs).

In the consultation paper, MAS set out its observations, policy considerations, and proposed regulatory measures in key areas: (a) consumer access; (b) business conduct; and (c) technology.

(A) Consumer Access

(i) Scope of Consumer Access Measures

MAS proposes that DPTSPs apply consumer access measures to any customer:

(a) who is not an AI or institutional investor; and

(b) who is resident in Singapore (in the case of an individual) or formed or incorporated in Singapore (in the case of a partnership or corporation).

MAS is concerned that retail customers may not have the financial wherewithal to withstand large losses that are likely to ensue from speculative trading of markets that they do not fully understand. MAS proposes that DPTSPs put in place consumer access measures for retail customers resident in Singapore. DPTSPs need not do so for AIs or institutional investors, who are generally regarded as better able to access professional advice.

MAS also considered the criteria and thresholds to be applied in determining whether a customer is an AI, in relation to DPT holdings, and considers that the current SFA definitions and thresholds for determining whether a customer is an AI are relevant.

For DPTs, MAS is considering more clearly defining whether and how the value of DPT holdings should be taken into account in a customer’s net personal assets when determining AI eligibility. As a separate exercise MAS will consult the industry on the treatment of DPT holdings for the purposes of determining AI eligibility by DPTSPs. In this regard, MAS is considering allowing MAS-regulated single-currency pegged stablecoins to count towards AI determination without being subject to any caps. Such stablecoins will be subject to additional requirements to uphold the promise of the peg and stability in value of single-currency pegged stablecoins.

(ii)  Risk Awareness Assessment

MAS proposes that a DPTSP should assess that a retail customer has sufficient knowledge of the risks of DPT services before providing any DPT service to that customer. A DPTSP should assess the retail customer’s knowledge of the following risks: (a) sharp fluctuations in the prices of DPTs and the loss of all monies put into DPTs; (b) inability to readily sell their DPTs, such as during illiquid market conditions or system outages; (c) losing access to their DPTs in the event of a technological or operational issue, such as if private keys are lost or irretrievable; and (d) losing their DPTs in the event of fraud, theft, sabotage or cyber attack.

For retail customers assessed not to have sufficient knowledge of the risks of DPT services, MAS is considering the possible next steps that the DPTSP could take. These may include: providing educational materials to the retail customer to strengthen the customer’s knowledge of the risks of DPT services; having the appropriate processes to facilitate and encourage retail customers to review the educational materials and improve their knowledge of risks, such as cooling off periods between assessments and having the appropriate processes to ensure a fair and robust assessment, such as using a diverse question bank that generates different questions for subsequent assessments.

(iii) Restriction on Offering of Incentives

MAS proposes that DPTSPs should not offer any monetary or non-monetary incentives: (a) to retail customers to participate in a DPT service; or (b) to any person (e.g., an existing customer or a celebrity) to refer a DPT service to retail customers.

This proposal is meant to ensure that any gift or incentive does not unduly influence the decision of the retail customer to purchase any financial product or service, since the offering of incentives to retail customers, such as free trading credits or DPTs, can entice retail customers to participate in DPT services without fully considering the risks involved.

(iv)  Restrictions on Debt-Financed and Leveraged DPT Transactions

MAS is also proposing that DPTSPs should not:

(a) provide to a retail customer any credit facility (whether in the form of fiat currencies or DPTs) to facilitate the retail customer’s purchase or continued holding of DPTs;

(b) enter into any leveraged DPT transaction with a retail customer or facilitate a retail customer’s entry into any leveraged DPT transaction with any other person; nor

(c) accept any payments 24 made by the retail customer using a credit card or charge card, in connection with the provision of any DPT service.

As DPT prices are highly volatile and subject to sharp price swings, the use of any form of credit or leverage in the trading of DPTs would result in the magnification of losses and could cause the customer to lose more than the whole amount put in. Retail customers should not borrow to purchase DPTs.

(B)  Business Conduct

To establish baseline conduct norms for DPTSPs, MAS proposes to introduce business conduct standards for DPTSPs in key areas of concern, taking into consideration industry best practices and regulatory proposals introduced in other jurisdictions.

(i)   Segregation of Customers’ Assets and Risk Management Controls

Segregation

MAS proposes that DPTSPs should ensure that customers’ assets are segregated from the DPTSPs’ own assets and held for the benefit of the customer. MAS is also consulting whether an independent custodian should be appointed to hold customers’ assets.

Apart from informing the customer of the arrangements and risks involved in having their assets held by DPTSPs, DPTSPs should also put in place a process to conduct, on a daily basis, timely reconciliation of all customers’ assets, which are held on behalf of the customers by DPTSPs. DPTSPs should also provide customers with a statement of account, comprising information on the customer’s assets and transactions, minimally on a monthly basis.

Risk Management Controls

MAS is also seeking views on appropriate and effective measures to safeguard the private keys and storage of customers’ DPTs. Some of these control measures could include: (a) instituting processes that restrict any one staff from being able to authorise and effect the movement, transfer or withdrawal of customers’ DPTs; (b) controlling movement or transfer of DPTs between the DPTSP’s preapproved hot, warm and cold wallets; (c) implementing operational controls to prevent the loss of cryptographic keys of DPTs that are held or managed by DPTSPs; (d) storing a suitably high proportion of customers’ DPTs in cold wallets; and (e) establishing a compensation process to handle any loss of such customers’ DPTs, arising from incidents that is attributable to the operations of the DPTSP.

Restriction on DPTSTs’ use of customers’ DPTs

To safeguard retail customers’ DPTs from the risks of unregulated borrowing and lending, MAS proposes that DPTSPs should not mortgage, charge, pledge or hypothecate the retail customer’s DPTs. For non-retail customers, DPT service providers should provide a clear risk disclosure document and obtain the customer’s explicit consent.

(ii) Identification and Mitigation of Conflicts of Interest

To address and mitigate conflicts of interest, MAS proposes to require that:

(a) DPTSPs that execute orders to purchase and sell DPTs on behalf of their customers should not misuse any information relating to customers’ orders, and should prevent the misuse of such information by employees;

(b) DPT trading platform operators should not – (i) buy or sell DPTs for their own account; and (ii) permit their related corporations to buy or sell DPTs for their own account on the DPT trading platform.

(iii)  Disclosure of DPT Listing and Governance Policies

MAS proposes to require DPT trading platform operators to disclose:

(a) the criteria, due diligence, processes and fees applied in making a DPT available for trading on the DPT trading platform;

(b) the conditions under which DPTs may remain available for trading, be suspended or removed from trading;

(c) the processes by which DPTs are removed from trading, and the rights available to customers;

(d) the requirements to address unfair or disorderly trading practices of DPTs on the DPT trading platform; and (e) the settlement procedures of DPT transactions.

(iv)  Complaints Handling

MAS proposes that DPTSPs must have in place adequate policies and procedures to handle customer complaints.

(C)    Managing Technology and Cyber Risk

In addition to MAS’ Notice on Cyber Hygiene and MAS’ Technology Risk Management Guidelines which DPTSPs are now subject, MAS is proposing to extend to DPTSPs, the requirements in the Notice of Technology Risk Management that are currently applicable to other types of financial institutions, such as banks. The Notice if implemented for DPTSPs would require them to implement secure coding, robust cryptographic key management, and controls to ensure the availability and security of IT systems. Additionally DPTSPs, would have to:

(a)    put in place a framework and process to identify critical systems;

(b)   ensure that the maximum unscheduled downtime for each critical systems does not exceed a total of 4 hours within any period of 12 months;

(c)    establish a recovery time objective of not more than 4 hours for each critical system;

(d)    notify MAS as soon as possible, but not later than 1 hour, upon the discovery of a system malfunction or IT security incident, which has a severe and widespread impact on the bank’s operations or materially impacts the bank’s service to its customers, and submit a root cause and impact analysis report to MAS within 14 days; and

(e)    implement IT controls to protect customer information from unauthorised access or disclosure.

Additionally, MAS is seeking the public’s views on effective systems, procedures and arrangements that DPT trading platform operators should implement, in order to promote fair, orderly, transparent trading of DPTs offered for sale on their trading platform. It also seeks views on effective measures, including the implementation of market surveillance mechanisms, to detect and deter unfair trading practices.

MAS’s consultation paper can be found at https://www.mas.gov.sg/-/media/MAS/News-and-Publications/Consultation-Papers/2022-Proposed-Regulatory-Measures-for-DPT-Services/Consultation-Paper-on-Proposed-Regulatory-Measures-for-Digital-Payment-Token-Services-v2.pdf