Payments Regulatory Notices in Singapore

This guide to mas payment services notices in Singapore sets out how the rules apply in practice, which authority is involved, what evidence decision-makers need and where the common mistakes lie. It is written for boards, founders, general counsel and advisers working through Singapore.

MAS payment services notices in Singapore: the short answer

In Singapore, a Monetary Authority of Singapore (MAS) Notice is never a freestanding compliance label. For payment businesses, each Notice operates only within the statutory and regulatory perimeter set by the Payment Services Act (PS Act) and its subsidiary legislation. Asking “Which MAS Notice applies to us?” is therefore the wrong starting point. The right starting point is: Which activities does our business conduct that fall within the PS Act licensable services, and which regulatory instruments then attach to those activities?

The hierarchy matters. The PS Act and subsidiary legislation set the legal obligations. MAS Notices specify binding, operational requirements that sit under that legislation—for example, Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) requirements for specified payment services and for digital payment token (DPT) services. Guidelines and FAQs articulate supervisory expectations but do not override the Act or Notices. MAS’s own ongoing-requirements page for payment service providers directs firms to Notices PSN01, PSN02, PSN03, PSN04, PSN07 and PSN08 depending on the obligation area, and reminds licensees that systems, policies and procedures must be maintained to meet PS Act and other legislative requirements.

Practically, executive teams should map the firm’s business model to the PS Act services, identify the corresponding Notices, and then build an auditable evidence trail that the firm’s systems and controls meet those Notices and the statute. Before signing off any policy set or board attestation, confirm the current consolidated version and the latest amendment notes of each relevant instrument on MAS’s website. Treat Notices as part of a living control environment that evolves with your permissions, risk profile and product set—not as a one-off filing exercise. For context and perspective on financial regulation trends, see our perspective.

Scope, authority and the distinction that changes the answer

Understanding where a MAS Notice sits in the regulatory stack is the distinction that changes many decisions. At a high level:

• Primary law: the PS Act defines the regulatory perimeter for payment services carried on in or from Singapore and sets core obligations for licensees.
• Subsidiary legislation: regulations and orders made under the PS Act provide detailed rules and exemptions.
• MAS Notices: binding instruments issued by MAS under statutory powers that prescribe operational requirements—commonly around prudential matters, risk management, AML/CFT, technology risk, conduct and reporting.
• Guidelines, circulars and FAQs: non-legislative materials that clarify expectations and supervisory approaches but do not create obligations beyond the statute and Notices.

For payment providers, MAS’s official “Ongoing requirements for payment service providers” page is the anchor. It directs licensees to specific Notices for areas such as AML/CFT and risk management (including, notably, PSN01 and PSN02 for AML/CFT), and to other Notices (such as PSN03, PSN04, PSN07 and PSN08) depending on the obligation. The page also makes clear that a licensee must maintain systems, policies and procedures to meet PS Act requirements and other applicable legislation. That framing is important: the Act remains the top of the pyramid, with Notices giving the detailed, enforceable instructions that a licensee must implement.

Two further scoping distinctions prevent costly missteps:

• Activity-driven applicability: Whether a Notice applies depends on what you do—not what you call your product. If any of your activities fall within a PS Act service, the relevant Notice attaches to those activities. Rebadging a feature or outsourcing a component does not move you outside the perimeter if the substance remains captured.
• Entity and service scope: Some Notices apply to all licensees, while others target specific services (e.g., AML/CFT requirements tuned to the risk profiles of different payment services). Read the definitions and application clauses before you assume coverage. Where you operate multiple services under one licence, more than one Notice will usually apply.

Executives also ask how Guidelines and FAQs interact with Notices. The answer is that Guidelines and FAQs guide interpretation and supervisory expectations, and MAS may reference them in assessing effectiveness. However, where there is tension, the Act and Notices prevail. A robust compliance position aligns with the Act and Notices first, then ensures the governance narrative shows thoughtful application of relevant Guidelines and FAQs.

Process, documents and evidence

Boards and senior management should expect a disciplined mapping and evidence process. In mature payment businesses, that process produces a clear chain from activity to rule to control to evidence.

A practical approach looks like this:

1. Map activities to the PS Act perimeter. Catalogue each customer journey and operational step that may constitute a licensable payment service. Record assumptions, scoping decisions and legal interpretations, noting where you have sought advice or clarifications. Be explicit about cross-border touchpoints and customer location, which can change the analysis.
2. Identify applicable instruments. For each captured activity, record the relevant provisions of the PS Act and any subsidiary legislation. Then identify the specific MAS Notices that attach to those activities. For AML/CFT, for example, MAS has separate Notices for specified payment services and for DPT services.
3. Translate each requirement into a control. Assign ownership, articulate the control objective, define the procedure and set measurable performance indicators. Where Notices require risk-based approaches, document your methodology, data inputs and thresholds.
4. Evidence implementation and effectiveness. Retain the policies, customer risk assessments, screening logs, monitoring alerts, exception rationales, audit trails, board minutes and management information (MI) that jointly prove both design and operating effectiveness. For technology and outsourcing controls, keep architecture diagrams, change records and supplier diligence files aligned with the Notice requirements.
5. Validate against the current text. Before any quarterly certification, internal audit review, or regulatory engagement, confirm you are working from the latest consolidated text and amendment notes for each instrument on MAS’s site. Version control your policy artefacts accordingly.

Key artefacts decision-makers typically review include:

• Regulatory mapping matrix linking each business activity to provisions of the PS Act, subsidiary legislation and relevant Notices.
• Board-approved policy suite, including AML/CFT frameworks tailored to the specific payment services carried on, with risk appetite statements and metrics.
• Procedural runbooks for onboarding, sanctions screening, transaction monitoring, investigation, reporting, record-keeping and escalation.
• Training curriculum and completion records for relevant roles, with content aligned to obligations in the Notices.
• Risk assessments at enterprise, product and customer segment levels, together with methodology notes and data lineage.
• Management information dashboards showing key indicators, breaches, remedial actions and thematic findings from assurance functions.
• Third-party management evidence where functions are outsourced, including due diligence summaries, contractual clauses, monitoring reports and exit planning.

Finally, memorialise your regulatory position. If you rely on any exemptions or interpretive positions, keep a contemporaneous file note tying the position back to the statute and Notices, with dates and approvals. This helps continuity through personnel changes and supports credible engagement with MAS.

Operational or commercial implications

Understanding how Notices operate in the hierarchy has immediate operational and strategic implications for payment businesses and investors.

Product and market entry timing: Because applicability is activity-driven, changes in product design can pull you into or out of a given Notice’s scope. Building a regulatory design review into product governance avoids launch surprises. Investors should diligence this by checking whether the target’s regulatory map updates in lockstep with product changes.

Licensing strategy and scalability: Where a firm aggregates multiple payment services under one licence, different Notices may impose distinct control sets. Operating model decisions—centralised versus business-line-specific controls, shared utilities and outsourcing—should be assessed against how each Notice measures effectiveness. Scalability depends on whether you can demonstrate that common controls remain effective for each covered service.

Data and technology architecture: Many Notice obligations translate into specific data capture, retention and monitoring needs. If you cannot query risk-relevant data quickly and consistently across systems, you may meet the policy requirement but fail the effectiveness test. Technology roadmaps should therefore be anchored in the evidential needs implied by the Notices applicable to your services.

Third-party and partnership risk: Distributing through partners or embedding services in other platforms does not dilute obligations where your activities remain within the PS Act perimeter. Contracts should allocate responsibilities consistent with the Notices, and you should retain sufficient oversight to evidence compliance. Commercial partnerships that cannot support these oversight rights can become regulatory bottlenecks.

Board oversight and accountability: Notices often translate statutory obligations into board-level responsibilities—risk assessments, resource adequacy, and periodic reviews. Boards should receive MI aligned to Notice requirements, not just generic operational KPIs. Where management requests risk appetite changes to support commercial growth, directors should test those requests against how the Notices expect risk to be managed and evidenced.

Regulatory engagement posture: A firm that can speak in the hierarchy’s language—Act, subsidiary legislation, Notice, control, evidence—engages more credibly with MAS. This can influence how supervisory interactions unfold, how remediation timetables are agreed, and how proposed innovations are assessed.

MAS payment services notices in Singapore: building a Notice map

A Notice map links each licensable service to the instruments that attach to it, the controls that implement each obligation and the evidence that shows those controls work. It turns a list of documents into a living control environment.

The scenario below shows how a multi-service firm builds one.

The hierarchy guides the work: statute first, Notices second, guidelines and FAQs as expectations that shape implementation.

Firms that build the map once and maintain it through product changes find board attestations, audits and investor diligence much easier, because the same document answers all three.

Illustrative scenario: a licensee adds a new service line

Illustrative only; the facts are invented to show the decision points.

A licensed payment service provider offering domestic transfers plans to add a digital payment token service. Its compliance manual lists Notices by title, and the team proposes to add PSN02 to the list and update the policy.

The first decision point is activity mapping. Counsel starts from the PS Act services the firm will perform after the change, including the new DPT service, and records which permissions are needed.

The second decision point is Notice identification. For each service, the team identifies the attaching Notices. PSN01 continues for the transfer business and PSN02 applies to the DPT line, and the team checks the ongoing-requirements page for other Notices relevant by obligation area.

The third decision point is evidence. For each obligation, the map records the control, the owner and the evidence produced. Before the board attests, the team confirms it has mapped against the current consolidated version and latest amendments of each Notice.

Questions that decide the outcome

Our payment services practice helps licensees build and maintain Notice maps. MAS payment services notices in Singapore are a living control environment; firms that maintain their map of MAS payment services notices in Singapore can attest with confidence.

Common mistakes

Experienced teams still encounter recurring traps. The most common include:

• Treating a Notice as a checklist, not a risk framework. Many Notice obligations require risk-based calibration. Copying another firm’s controls without linking them to your risk assessment leaves a gap between text and practice.
• Starting with the Notice rather than the activity. Teams sometimes shortlist Notices by title and build policies from there. The correct approach is to map activities to the PS Act, then select the Notices that attach to those activities.
• Ignoring service-by-service nuances. Where a firm offers multiple services, it is easy to over-generalise and miss a service-specific requirement within a Notice’s scope clause.
• Assuming outsourcing transfers obligations. Operational execution may be outsourced; regulatory accountability remains with the licensee. Without contractual rights and monitoring to evidence effectiveness, outsourcing can increase exposure.
• Not version-controlling regulatory texts. Policies can drift from current law if teams do not confirm consolidated versions and scan amendment notes before approvals, audits and attestations.
• Overlooking interaction with other legislation. MAS’s ongoing-requirements page reminds firms to maintain systems to meet PS Act and other legislation. If you fixate on one Notice, you can miss adjacent obligations triggered by your business model.
• Weak MI and board records. Boards often receive summaries that are too high-level to demonstrate effective oversight against specific Notice expectations.

Action plan and decision points

The following steps help decision-makers structure work, record judgements and know when to escalate. Tailor to your services and governance model.

Decision-maker checklist

Use this checklist to pressure-test readiness and governance discipline:

• Have we mapped our activities to the PS Act services and recorded the rationale, including cross-border considerations?
• Which MAS Notices apply to each service we provide, and do we have a single source of truth for the current consolidated versions?
• Where a Notice requires a risk-based approach, do we have a documented methodology, calibrated thresholds and MI that demonstrates effectiveness?
• Can we retrieve, within days, evidence of both design and operating effectiveness for our key controls?
• Do our product and market entry processes include a regulatory design review that reassesses Notice applicability before launch?
• Are outsourcing and partnership agreements aligned to our obligations under the relevant Notices, with enforceable oversight rights?
• Does the board receive MI that directly maps to Notice requirements, not just general operational KPIs?
• Do internal audit and compliance testing plans align to the Notices’ control expectations and our risk profile?
• Have we confirmed amendment notes and consolidated texts immediately before policy approvals, audits and regulator engagements?
• If we were asked tomorrow, could we show a clear line from statute to Notice to control to evidence for each service?

Sources and official materials

Official sources consulted for this insight are listed below. Always verify the latest consolidated instrument and any amendment notes on MAS’s site before acting.

• Ongoing Requirements for Payment Service Providers
• Notice PSN01 AML CFT Specified Payment Services
• Notice PSN02 AML CFT Digital Payment Token Service

Sources checked 17 October 2026. Current law and guidance should be checked before acting.

To discuss how these requirements map to your specific services and operating model, please book a consultation. For a view of how our cross-disciplinary teams support financial services mandates, visit our practices.

Frequently asked questions

General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.