Fintech Regulation in Singapore — What you need to know, simplified

• Check if you qualify for the MAS Sandbox programme
• Identify if and which licences your business model needs
• Take steps to make sure you meet the necessary requirements to apply for your licence
• If the licences are too difficult to obtain, explore partnerships with partners who already have the licence

• Obtain consent of individuals for your collection and use of their personal data
• Have a privacy policy, to be made available to the public
• Implement the privacy policy
• Appoint a data protection officer
• Build in physical and computer safeguards to prevent wrongful access of personal data
• Control and limit access to personal data
• Educate employees to avoid accidental breaches
• Make sure that users have access to modify or delete their personal data
• Respond to data-related requests promptly
• Check the Do-Not-Call Registry before you send marketing content out

• Determine your FinTech business model’s risk of money laundering and financial terrorism
• If your risk is low, do a simplified customer due diligence
• If your risk is high, do enhanced due diligence
• Promptly report any suspicious activity

• MAS is creating a Sandbox program to allow experimentation
• MAS is also reducing requirements for crowdfunding (lower capital and reporting requirements)
• There will be a standalone Cybersecurity Bill to keep ace with the evolving cybersecurity landscape

Issued by Monetary Authority of Singapore (MAS)

• Deal in securities (minimum group shareholders’ funds of S$200M)
• Trade futures contracts
• Finance securities
• Providing custodial services for securities
• Trade leveraged FOREX
• Advise on corporate finance matters
• Manage funds (>S$1B of global funds)
• Manage REITs

Exemptions:

• Banks, merchant banks, finance companies, and insurance companies
• Individuals acting on the behalf of someone who already holds a CMS licence or is exempt

Examples of companies:

• CoAssets – digital crowdfunding platform (granted CMS Licence from MAS)
• Crowdo — digital crowdfunding and lending, requires investors to be accredited (received provisional CMS from MAS, only for Singapore operations)
• Infinity Partners — high-end Singapore financial advisory (holds CMS licence)
• Funding Societies, MoolahSense and Capital Match (will now have to apply for a CMS Licence)

• Must be a corporation
• Established track record, management skills and financial soundness for past 5 years
• Operate out of a physical space in Singapore
• Have future business plans
• Have strong internal compliance
• Satisfy minimum financial requirements set out by the SFA
• Satisfy base capital requirements
• Covered by professional indemnity insurance
• CEO or director must be Singaporean
• At least 2 members on board
• At least 2 full-time employees for each regulated activity that the corporation is seeking licence for
• Each of said employees to have a representative’s licence for activity

Cost for a new licence — S$1,000 Annual fees — depends on business

Issued by Monetary Authority of Singapore (MAS)

• Advise on investment products
• Issue reports on investment products
• Market any collective investment schemes
• Arrange life insurance products

Exemptions:

• Banks, merchant banks, finance companies, insurance companies, insurance brokers and holders of a CMS Licence
• Individuals acting on the behalf on an exempt person (from FA licence)
• Singaporean residents who acts as a financial adviser who gives advice on investment products (excluding life insurance policies) <30 “accredited investors”

Examples of companies:

• iFast Corporation – internet-based investment products distribution platform (holds both FA Licence and CMS Licence)
• In comparison, WeInvest (does not require FA Licence) is a wealth-management  platform that aggregates financial info to let users search and compare over 20,000 products and matched to a broker (does not give financial or investment advice)

• Must be a corporation
• Has established physical presence in Singapore
• Established track record, management skills and financial soundness for past 3 years
• Have future business plans
• Have strong internal compliance
• Satisfy base capital requirements
• Covered by professional indemnity insurance (>$500k and allowable deductible <20% of applicant’s NAV)
• CEO & Executive Director must each have >5 years experience in financial advisory, >3 years in management capacity and proper academic qualifications
• CEO or director must be Singaporean
• At least 2 members on board
• At least 2 full-time employees for each activity seeking licence for

Cost of a new licence — S$500

Subsequent annual fee – S$2,000

• Must be a corporation
• Has established physical presence in Singapore
• Have strong internal compliance
• Satisfy minimum capital requirements
• Including employees, officers and substantial shareholders

Annual fee – S$35,000 for head or main office of finance company and $5,000 for each branch office or sub-branch office

Under the Moneylenders Act
Issued by Insolvency and Public Trustee’s Office (ITPO) – Ministry of Law and the Registry of Money Lenders

Examples of companies:
Capital Match —  peer-to-peer lending (excluded and does not require a Moneylenders Licence as it lends only to companies)
If P2P platform lends to individual, it is an uncertain area as there are  no precedents.

• May be sole-proprietorship, partnership or a company
• Person responsible for the management of the moneylending business has to pass a Moneylender’s test prior to applying for licence
• Business premises has to be deemed suitable by the Registrar for Moneylending
• Security deposit of S$20,000 for every place of business

Moneylender’s Test Fee – $130

Licence Application Fee  – $600

Annual Licence Fee – $1,320

Issued by Monetary Authority of Singapore (MAS)

Examples of companies:

• There is Cash2Cash, which is a peer-to-peer currency exchange platform in Singapore. It allows people to exchange foreign currency using their mobile phones (not licensed, as it is purely peer-to-peer)
• However, an example may be found in the UK. freemarketFX – a currency exchange platform wherecompanies can directly match their currency requirements with their peers for a fixed commission charge of 0.2% (authorised by the Financial Conduct Authority in the UK)

• May be a company or partnership
• Established track record, management skills and financial soundness previous years
• Has established physical presence in Singapore
• If sole proprietorship, must be a Singapore citizen
• If company, >51% of equity controlled by Singaporean citizen
• Wholly-owned Singapore subsidiary of a foreign bank, or a foreign company primarily engaged in money-changing — track record
• Anti-money laundering in place
• Additional criteria for board

New Application Fee – $200

Licence Fee for first place of business – $1,300

Issued by Monetary Authority of Singapore (MAS)

Examples of companies:

• MatchMove Pay — fintech startup that aims to bring online and mobile payments to Southeast Asia (granted a remittance Licence)
• Toast — blockchain-powered remittance company catering to Singapore’s migrant workers (currently applying for a Remittance Licence)

• May be a company
• Established track record, management skills and financial soundness previous years
• >51% of equity controlled by Singaporean citizen
• Wholly-owned Singapore subsidiary of a foreign bank, or a foreign company primarily engaged in money-changing — track record
• Business plans that include anti-money laundering and countering the financing of terrorism policies and procedures
• Satisfy minimum capital requirements (at least S$100,000)
• Additional criteria for board

New Application Fee – $500

Licence Fee for first place of business – $4,000

Issued by Monetary Authority of Singapore (MAS)

• Assumes risk or undertakes liability in Singapore under policies
• Receives proposals for policies in Singapore
• Issue policies in Singapore
• Collect or receive premiums on policies in Singapore

Examples of companies:

• Direct Asia Insurance which has the goal of changing the insurance business in Asia by providing customers with the ability to buy insurance products directly, cutting out middlemen and brokers.

• Must be a corporation
• Established track record, management skills and financial soundness previous years
• Have business plans that reflect the risk profile
• Robust risk management systems and processes that are commensurate with the size and complexity of business
• Satisfy minimum capital requirements (funding solvency & capital)

Licence fees – on a case by case basis, MAS may prescribe different annual fees for different classes of insurance business or for different types of licenced insurers/insurance brokers.

Issued by Monetary Authority of Singapore (MAS)

• Receives money on current or deposit account
• Pays and collects cheques drawn by or paid in by customers
• Makes advances to customers

There are currently no online-only fintech banks in Singapore. An example can be found in the UK, Tandem – a digital-only financial services company (granted a UK banking licence) and Atom Bank – an online-only bank (granted a UK banking licence)

• Must be a corporation
• Established track record, management skills and financial soundness previous year
• Applies to any parent company or major shareholders.
• Factors to be taken into consideration – Ranking of the applicant and its parent institution in the world and home country in terms of total assets and capital strength, strength of the home country supervision and the willingness and ability of the home supervisory authority to cooperate with MAS
• Satisfy the minimum financial requirements (Paid up Capital not less than $1.5 billion if incorporated in Singapore)
• Maintain a capital adequacy ratio of not less than 12%
• Have well-considered strategy in banking or financial service
• Have business plans which include a detailed assessment of the sustained economic viability as well as the nature and criticality of the business
• Robust risk management systems and processes that are commensurate with the size and complexity of proposed business

New Application Fee  – None
Licence Fee (for full banking licence) – $125,000

Additional branch – $10,000

Additional  limited purpose branch – $1,000

Licence Fee (for wholesale banking licence) – $100,000

Additional  limited purpose branch – $1,000 Licence Fee (for bank incorporated outside Singapore) – $75,000

Additional  limited purpose branch – $1,000

• Must have a personal data privacy policy which sets out the FinTech firm’s collection, use, purpose, disclosure and retention of an individual’s personal data, including how the individual may access and withdraw consent to his/her personal data being collected and used
• Said Privacy Policy must be made available to the public, usually to be put online on the website

• Inform the individual that their personal data will be collected and how it will be used in a way that a reasonable person would consider appropriate in the circumstances
• Must require positive action to confirm individual really consented; must use an opt-in mechanism and not an opt-out mechanism
• Consent must be voluntarily provided, usually when an individual takes an action like creating an account or buying a product / service

• PDPA specifically requires that organisations designate one or more individuals to be the organisation’s data protection officer
• His role — ensure organization complies with PDPA
• Business contact information of data protection officer needs to be made known to the public

• Implement generally accepted standards of technology and operational security to protect the personal data in its possession
• Make sure there are physical and computer security and access controls to the personal data
• Also make sure that confidential documents containing the personal data are properly disposed of
• The PDPC has a guide to securing data in electronic medium links

• Limit access to personal data to only authorized personnel
• Ensure that only authorized personnel have agreed to ensure confidentiality of this information

• Employees may unwittingly / accidentally share personal information which exposes you to infringements of PDPA
• Educate your employees on PDPA regulation
• Set up Standard Operating Procedures for the collection, use, disclosure, access to, and retention, of personal data

• Individuals must be provided the option to correct and error or omission, update their personal data or withdraw consent to the use/collection/disclosure of their personal data
• If and once an individual withdraws consent, you have to destroy their data unless there are legal or business reasons to justify keeping it

• Respond to all data-related requests within 30 days

• The DNC allows individuals to opt out of receiving unsolicited marketing messages
• Check whether intended recipients are registered with the DNC before doing so (operational since 2 January 2014)
• Exemption — businesses are, however, allowed to promote related products and services to individuals with whom they have an “ongoing  relationship” without having to consult the DNC

• Clients (e.g. client type, ownership, industry, activity, profession and/or business)
• Products and Services
• Channel (e.g. delivery channels, account origin, involvement of third parties and intermediaries)
• Geographic location
• Other Qualitative Risk Factors (e.g. integration of IT systems, reliance on third party providers, account/client growth)

• AML Corporate Governance
• Management Oversight and Accountability
• KYC procedures; Client Due Diligence (“CDD”); Enhanced Due Diligence (“EDD”)
• Record Keeping and Retention
• Monitoring of risk areas
• Training of employees
• Detection and SAR filing (see below)

Designate an AML Compliance Officer/Unit

• Prior to the launch or use of new products, practices and technologies, the company should undertake a risk assessment to identify and assess the ML/TF risks that are associated with such new products, new business practices and the use of new technologies

• Train designated AML/CFT compliance officers and senior management on AML/CFT risks
• Conduct trainings for administration staff who are in a role where they could be handling activities that are potentially be ML/FT related.
• Training can include:
  • Legal framework, background and history pertaining to money laundering controls and terrorist financing
  • Penalties for AML violations, including criminal and civil penalties, fines, jail terms and internal sanctions
  • How to react to customers who want to circumvent KYC procedures or reporting requirements;
  • What to do when faced with a suspicious client or transaction;
  • Internal processes, procedure and policies on customer identification, verification procedures, and customer due diligence/KYC
  • Reporting requirements
  • Duties of employees

• Must have a clear customer acceptance policy that lays down explicit criteria for acceptance of customers
• Such criteria should be clearly defined in terms of the location of customer and his clients, mode of payments, source of customer’s funds, nature of his business activity, social and financial status etc)
• Develop customer identification procedures:
  • Identify customers, natural persons appointed to act on a customer’s behalf and beneficial owners
  • Verify their identity using reliable, independent sources (eg, sighting of passport/NRIC, certified true copies, coupled with utility bils)
  • Retain copies of all reference documents used to verify the identity of these persons
  • Ask for source of monies, origin of payment and method of payment
  • Determine if customer is a politically exposed person (“PEP”)
• With this collected data, conduct KYC; “KYC” refers to the steps taken to:
  • Establish the identify of the customer
  • Understand the nature of the customer’s activities (primary goal is to satisfy that the source of the customer’s funds is legitimate)
  • Assess money laundering risks associated with that customer for purposes of monitoring the customer’s activities
• Especially for account opening (eg, for crowdfunding, peer-to-peer lending platforms, payment and remittance service providers)

• Check if the customer originates from or is based in a country/jurisdiction known to have inadequate AML/CFT measures – If customer originates from listed country, conduct Enhanced CDD
• Also conduct Enhanced CDD if you suspect that money laundering or terrorist financing is involved

• Check for the following situations – in such circumstances, enhanced measures are required to be taken:
  • When dealing with Politically Exposed Persons (‘PEPs’)
  • When dealing with types of customers, business relations or transactions the financial institution assesses to present a higher risk for money laundering and terrorist financing; and
  • When dealing with business relations and transactions with any person originating from or based in countries and jurisdictions known to have inadequate AML/CFT measures
• EDD steps may include senior management approval, additional due diligence investigations, on-site visits, contractual certifications, third-party audits, source of funds certifications, gathering additional information to verify the customer’s identity or source of income, conducting an adverse media check
• You might choose to utilize a service like Thomson One World-Check to conduct your EDD

• Report any suspicious activity in a Suspicious Activity Reports (SAR) to Commercial Affairs Department of Singapore here
• Essentially, this is about whistle-blowing against the customer or client
• As long as the nature of the transaction is suspicious, report the SAR; guidelines have been given by MAS for certain industries as to what constitutes a suspicious activity (e.g. for Money-Changing and Remittance)