An exchange operator expanding into Southeast Asia quickly discovers that a Payment Services Act licence from the Monetary Authority of Singapore (MAS) is only the beginning. The harder question is whether the accompanying transaction monitoring program meets the examiners' expectations — and whether it will still meet them after the next rulebook update. Singapore's Digital Payment Token (DPT) service regime is precise, well-enforced and increasingly convergent with FATF Recommendation 15 standards. Getting transaction monitoring right from day one is not a compliance formality. It is the condition on which your banking relationships, your licence renewal and your ability to move funds across borders all depend.
Transaction monitoring setup in Singapore means designing, implementing and maintaining a risk-based system that detects suspicious activity across on-chain flows, off-chain fiat rails and the intersection of the two. Under the MAS regime, that obligation sits within a broader AML/CFT framework — one that regulators examine in detail, with expectations that go well beyond a basic watchlist screen. This page sets out the regulated basis, the practical build sequence, the cross-border complications and where counsel adds measurable value.
The regulatory basis: MAS, the Payment Services Act and FATF alignment
Singapore's transaction monitoring obligations for digital-asset businesses flow primarily from the Payment Services Act and the MAS Notice and Guidelines on Prevention of Money Laundering and Countering the Financing of Terrorism directed at DPT service providers. The MAS regime is grounded in the FATF Recommendations, with Recommendation 15 — which brought virtual assets and virtual asset service providers within the AML/CFT perimeter — serving as the structural anchor.
Every entity holding a DPT licence under MAS must maintain a transaction monitoring system that is commensurate with the nature, scale and complexity of its business. That phrase — commensurate with — carries significant weight in an examination. A startup exchange processing modest retail volumes will face different monitoring expectations than a prime brokerage serving institutional counterparties across multiple fiat currencies. MAS expects the firm itself to make that assessment, document it and be able to defend it.
The MAS regime distinguishes between three licence tiers under the Payment Services Act: a money-changing licence, a standard payment institution licence and a major payment institution licence. Each carries a different transaction and annual threshold profile, and those thresholds shape the intensity of monitoring obligations. Specific capital and threshold figures vary and should be confirmed against current MAS guidance before any licence application is filed.
In our cross-border practice, operators frequently underestimate the distance between registration and a fully defensible AML/CFT program. MAS has made clear — through its public guidance and through enforcement actions in the broader financial sector — that a system that produces no alerts is not a functioning monitoring system. It is a misconfigured one.
What transaction monitoring actually covers in a DPT business
Effective transaction monitoring for a Singapore DPT service provider spans three distinct layers: on-chain analytics, off-chain behavioral monitoring and the fiat-crypto interface where both converge.
On the on-chain side, MAS expects firms to use automated tools capable of assessing blockchain transaction risk — screening wallet addresses against sanctions lists and known illicit clusters, scoring transactions by risk indicators (mixer usage, darknet exposure, high-risk jurisdiction routing) and generating alerts for human review. The ecosystem of forensic analytics providers — including Chainalysis, TRM Labs and Elliptic — supplies the underlying data, but the firm is responsible for configuring the thresholds, assigning risk weights and ensuring the alert-review queue is adequately staffed.
Off-chain behavioral monitoring covers customer activity patterns: unusual withdrawal sequences, structuring indicators, rapid onboarding followed by immediate high-value transactions and counterparty concentration. These signals feed the same suspicious transaction reporting obligation as on-chain flags. The Suspicious Transaction Report (STR) framework requires timely reporting to the Suspicious Transaction Reporting Office (STRO) — a branch of the Singapore Police Force — when a firm knows or has reasonable grounds to suspect that a transaction involves proceeds of criminal conduct.
The fiat-crypto interface is where monitoring complexity concentrates. A customer depositing SGD through a local bank and immediately purchasing USDT for transfer to an overseas exchange generates signals in both rails. Monitoring must correlate the two. Firms that operate siloed AML systems — one for fiat, one for crypto — routinely fail to catch this pattern and expose themselves to examination findings.
How the Travel Rule operates in Singapore
The Travel Rule (the obligation to pass originator and beneficiary information with a virtual asset transfer) is a live, enforceable requirement under the MAS regime. Singapore adopted the FATF standard, requiring DPT service providers to collect, verify and transmit counterparty data when transferring virtual assets above the applicable threshold.
In practice, compliance depends on three operational decisions. First, the firm must select a Travel Rule messaging protocol — MAS does not mandate a single solution, but the firm must be able to demonstrate that its chosen protocol is interoperable with the receiving VASP's system and that data is transmitted before or simultaneously with the transfer. Second, the firm must implement a sunrise problem procedure for transfers to VASPs in jurisdictions that have not yet adopted the Travel Rule — MAS guidance addresses this, and firms that apply a blanket exemption for non-compliant jurisdictions will find that position difficult to defend on examination. Third, the firm must have a process for handling unhosted wallets — transfers to self-custodied addresses require enhanced due diligence rather than Travel Rule messaging, but the distinction must be documented.
We regularly advise DPT service providers on Travel Rule architecture, particularly where the firm operates across multiple jurisdictions with different threshold rules. A Singapore-licensed entity routing transfers through a group entity in the EU will face both MAS requirements and MiCA's Transfer of Funds Regulation obligations. Aligning those two regimes without creating duplicate data-collection friction is a structural question, not a technology one.
For a scoped assessment of your Travel Rule architecture and whether it meets current MAS expectations, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts — the entity structure, the user base, the correspondent banking — change the analysis materially. Map your options.
Building the monitoring program: sequence and practical steps
A defensible transaction monitoring program in Singapore is built in a defined sequence, and each step conditions the next. Skipping the risk assessment to save time at the start typically doubles the remediation cost later.
The first step is a business risk assessment (BRA) — a documented evaluation of the firm's inherent AML/CFT risks, covering customer types, product set, delivery channels and geographic exposure. MAS expects the BRA to be reviewed at least annually and updated whenever there is a material change to the business. The BRA drives every downstream configuration decision: alert thresholds, due diligence levels and the intensity of monitoring for specific customer segments.
The second step is customer risk segmentation. Customers are assigned to risk tiers — typically low, medium and high — based on factors including nationality, business type, source of funds, jurisdiction of counterparties and transaction velocity. High-risk customers trigger enhanced due diligence (EDD) and more granular monitoring. The segmentation model must be documented and must be capable of being explained to an examiner.
The third step is rule and scenario configuration in the monitoring system itself. Rules should be aligned to the risk scenarios identified in the BRA — not copied from a generic template. A firm focused on institutional OTC trading will configure different scenarios than one running a retail spot exchange. MAS has signalled in supervisory guidance that firms with poorly tuned systems generating either no alerts or an unmanageable volume of low-quality alerts are equally concerning.
The fourth step is governance: the policies, the Money Laundering Reporting Officer (MLRO) appointment, the escalation matrix, the STR filing process and the staff training program. MAS expects the MLRO to have genuine authority and sufficient seniority to make filing decisions without commercial pressure. In our practice, we have seen firms where the MLRO role was assigned to a junior compliance officer with no reporting line to the board — that structure does not survive examination.
The fifth step is testing. Before going live, the monitoring system should be tested with synthetic transaction sets designed to trigger each configured scenario. Post-launch, the firm should run regular look-back reviews to verify that alerts are being generated at expected rates and that the review queue is being cleared within defined timeframes.
Cross-border complications: tax, banking and multi-jurisdiction operating structures
Operating a Singapore DPT business within a multi-jurisdiction group structure introduces monitoring complications that a single-entity analysis misses entirely.
On the banking side, Singapore's correspondent banks apply their own AML/CFT screens to DPT service providers. A firm that obtains a MAS licence without a functioning monitoring program in place before the banking conversation will find that the licence alone does not open accounts. Banks are assessing the firm's own AML/CFT posture — not just its regulatory status. Firms that present a mature, documented monitoring program at the account-opening stage consistently report shorter onboarding timelines and fewer conditions attached to the account relationship.
On the tax side, a Singapore entity within a group that includes entities in the EU, the UAE or the Cayman Islands faces group-level obligations that interact with Singapore monitoring requirements. The OECD's common reporting standard (CRS) and the US FATCA regime impose information-reporting obligations that draw on much of the same customer data as AML/CFT compliance. Firms that design AML/CFT data architecture without reference to tax information exchange obligations typically build two parallel data systems — an expensive and operationally fragile structure that a unified design would avoid.
For operators running both a Singapore-licensed entity and an EU-licensed entity under MiCA's CASP authorisation regime, the interplay between MAS's monitoring expectations and ESMA's own guidance creates a dual-standard environment. The Travel Rule threshold, the EDD trigger levels and the STR filing timelines may differ. Allied counsel in the relevant jurisdiction can coordinate the analysis, but the architecture must be resolved before the firm goes live in either market — not after.
In a recent matter, a payments company with a Singapore DPT licence and a European operating entity discovered that its Travel Rule messaging solution was interoperable only with VASPs using one protocol standard, excluding a significant share of its counterparty network. We advised on a protocol migration plan and on the interim enhanced-due-diligence procedures that covered the gap period. The firm was able to present a remediation roadmap to both MAS and its European regulator before either had initiated a formal review.
What MAS examiners look for in a transaction monitoring review
MAS examinations of DPT service providers' AML/CFT programs focus on substance over documentation. A thick policy manual with thin implementation is a finding, not a defense.
Examiners typically assess seven elements: the adequacy of the BRA; the quality of customer risk segmentation; the configuration logic of the monitoring system; the alert review process and average clearance time; the STR filing history and the quality of individual reports; the Travel Rule implementation, including sunrise-problem procedures; and the MLRO's governance authority and reporting lines. Each element is examined against the firm's documented procedures and against the actual transaction data.
A common examination finding is alert fatigue — a system configured to generate too many low-quality alerts, resulting in a review queue that is cleared by rubber-stamping rather than genuine analysis. MAS views this as a systemic control failure, not a resource problem. The response it expects is a tuning exercise with documented rationale, not additional headcount.
A second common finding is Travel Rule data gaps — specifically, transfers where the originator or beneficiary data was not collected or was collected but not transmitted. MAS will look at a sample of historical transfers and trace the data chain end to end. Gaps in that chain, even for transfers below the reporting threshold, signal a process weakness that is likely to generate a formal recommendation.
If a prior examination raised monitoring findings or your current program has gaps you need to close before a scheduled review, write to OBOLUS at info@oboluslaw.com. A second read can surface the structural reason for the gap and the route to remediation. Map your options.
Self-assessment: is your Singapore monitoring program examination-ready?
Before a scheduled MAS examination — or before engaging a new correspondent bank — the following checklist gives a working view of program maturity. It does not replace a formal legal review, but it identifies the most common deficiency areas quickly.
First: is your business risk assessment current, dated within the last twelve months and updated for any product or geographic change made since the last review? Second: does your customer risk segmentation model produce materially different treatment for high-risk customers — including documented EDD files, source-of-wealth evidence and enhanced ongoing monitoring? Third: have you reviewed your monitoring system's alert rate in the last quarter and confirmed that the rate is consistent with your transaction volume and risk profile — neither zero nor unmanageably high?
Fourth: does your Travel Rule implementation cover all transfers above the applicable threshold, with documented procedures for unhosted wallets and for counterparty VASPs in non-compliant jurisdictions? Fifth: are your STR filings documented with a clear decision trail — including records of transactions reviewed and not filed, with the analyst's reasoning? Sixth: does your MLRO have a direct reporting line to senior management or the board, and is the role occupied by someone with the authority to make filing decisions without commercial override?
If any of these answers is uncertain, that uncertainty is the examination risk. A formal program assessment before the examination window opens is consistently more efficient than a remediation exercise after findings are issued.
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – the firm's full compliance and AML/CFT practice, from program design to examination support.
- VASP business risk assessment under heightened scrutiny – structured risk assessments for VASPs facing elevated regulatory attention or banking due diligence.
- CASP authorisation under MiCA in Lithuania – EU licensing pathway for operators who need a MiCA-compliant CASP authorisation alongside a Singapore DPT licence.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule requires a virtual asset service provider (VASP) to collect, verify and transmit identifying information about the originator and beneficiary of a virtual asset transfer to the receiving VASP. Under the MAS regime, this applies to transfers above the applicable threshold. The firm must use a recognized messaging protocol and maintain records of transmitted data. Transfers to unhosted wallets require enhanced due diligence rather than Travel Rule messaging, but the distinction must be documented and defensible on examination.
Who must act as MLRO for a crypto firm?
The Money Laundering Reporting Officer (MLRO) must be a fit-and-proper individual with genuine authority to make suspicious transaction reporting decisions without commercial pressure. MAS expects the MLRO to have adequate seniority — typically at the senior management level — and a direct reporting line to the board or equivalent governance body. The role cannot be treated as a nominal appointment. The MLRO is personally responsible for the quality and timeliness of the firm's suspicious transaction reporting.
How do regulators audit crypto AML programs?
MAS examinations of DPT service provider AML/CFT programs assess substance over documentation. Examiners review the business risk assessment, customer risk segmentation, monitoring system configuration, alert clearance records, STR filing history and Travel Rule implementation. They sample actual transaction data to verify that the documented procedures are being followed in practice. Programs that generate zero alerts, carry persistent review backlogs or show Travel Rule data gaps are typically the subject of formal recommendations — which, if unaddressed, can escalate to licence conditions or enforcement action.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit — so that the structure you build is the structure that banks, regulators and counterparties will accept. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst — specialising in MAS DPT compliance frameworks, AML/CFT program design and multi-jurisdiction regulatory alignment for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.