MAS Notice PSN02 transaction monitoring is the starting point for anyone running a digital payment token business in Singapore. PSN02 is the AML/CFT notice for licensed digital payment token (DPT) service providers, and it is often confused with MAS Notice 626, which governs banks. The two cover similar ground but were written for different businesses, and PSN02 is written around token transfers, with its own value transfer, screening and non-face-to-face requirements.
This article explains who PSN02 applies to, what its transaction monitoring expectations look like in practice, and how DPT providers should think about transfers that involve counterparties outside the regulated financial sector.
Who PSN02 applies to and how it differs from Notice 626
MAS Notice PSN02 is issued under section 16 of the Financial Services and Markets Act 2022 and applies to holders of a payment services licence under the Payment Services Act 2019 that carry on a digital payment token service. It took effect on 4 April 2024 and was last revised on 30 June 2025, with the amendments effective from 1 July 2025. The Payment Services Act itself came into force on 28 January 2020. Notice 626 applies to banks, while PSN01 covers other payment services.
PSN02 permits simplified customer due diligence where risks are low, but it cannot be used where a customer's transactions exceed S$20,000 cumulatively in a year, where a high-risk jurisdiction is involved, or where money laundering or terrorism financing is suspected. A provider that borrowed its programme from a bank-oriented template should check it against PSN02 itself, because the notice is built around value transfers and online onboarding.
What PSN02 requires for ongoing monitoring
Paragraphs 6.25 and 6.26 require a provider to monitor business relations on an ongoing basis and to scrutinise transactions so that they are consistent with its knowledge of the customer, the customer's business and risk profile and, where appropriate, the source of funds. Paragraph 6.28 requires special attention to complex, unusually large or unusual patterns with no apparent economic or lawful purpose, and paragraph 6.29 requires systems and processes, commensurate with the provider's size and complexity, to monitor relationships and to detect and report suspicious patterns.
Providers must inquire into the background and purpose of those transactions and document the findings (paragraph 6.30), keep customer due diligence information up to date, particularly for higher-risk customers (6.31), and where they retain a customer despite suspicion, document why, apply enhanced monitoring and obtain senior management approval for higher-risk customers (6.32 and 6.33). Providers may not rely on a third party to conduct ongoing monitoring (11.3), and they must screen customers, connected parties, beneficial owners and the originators and beneficiaries of value transfers, including periodically after onboarding (6.49 to 6.51). MAS Notice PSN02 transaction monitoring is therefore a provider's own responsibility, whatever tools it buys.
Token transfers, the Travel Rule and non-regulated counterparties
Paragraph 6.27 requires enhanced risk mitigation where a transfer of a digital payment token goes to or comes from an entity that is not a financial institution under the Financial Services and Markets Act or a FATF-consistent supervised foreign institution. In practice, that captures transfers involving self-hosted wallets and unregulated counterparties, and a provider should be able to show what extra steps it takes and why.
Paragraph 13 sets out the value transfer, or Travel Rule, requirements. For transfers of S$1,500 or less, the ordering institution includes the originator and beneficiary names and account numbers or unique transaction references. Above S$1,500 it must also identify and verify the originator and include further originator information such as an address, identification number or date and place of birth. Beneficiary institutions must take reasonable measures, including post-event or real-time monitoring where feasible, to identify transfers that lack the required information, and must have risk-based policies on whether to execute, reject or suspend them.
Reporting, records and testing the programme
Providers must submit suspicious transaction reports promptly, including for attempted transactions and regardless of amount, to the Suspicious Transaction Reporting Office (paragraph 16.2), keep a single internal reference point for staff referrals, and retain records for at least five years (paragraph 14.3). A provider's first non-face-to-face business contact triggers a further duty: it must appoint an external auditor or independent consultant to assess the effectiveness of its impersonation controls and send the report to MAS within a year (paragraphs 6.37 and 6.38).
MAS will expect documented calibration, evidence that alerts are reviewed and decisions recorded, and an independent audit function (paragraph 17.5). Always check the current text of PSN02 on the MAS website, because the notice was revised in 2025 and further changes are possible. A programme built around MAS Notice PSN02 transaction monitoring expectations should be tested against the notice itself, not against bank-oriented templates.
