What is the scope of the Travel Rule in Singapore?
As explained in Schedule 1 of the Payment Service Act, part 3, the Travel Rule applies to a "payment service provider when it sends or receives digital payment tokens by value transfer on the account of the value transfer originator, or the value transfer beneficiary. However, it will not apply to a transfer and settlement between the payment service provider and another financial institution where the payment service provider and the other financial institution are acting on their behalf, i.e. as the value transfer originator and the value transfer beneficiary".
The Payment Service Act, part 3, further defines "Digital Payment Tokens (DPT) providers" - the definition of DPT service providers includes the transfer of DPTs, the provision of custodial wallet services for DPTs, and the facilitation of the exchange of DPTs without possession of money or DPTs by the DPT service provider.
Who is the supervisory body for VASPs in Singapore?
Monetary Authority of Singapore (MAS)
What is the Travel Rule threshold in Singapore (MAS)?
SGD 1500
However, the following information still needs to be exchanged even for transactions below this threshold:
originator and beneficiary names, and
originator and beneficiary account numbers.
What are MAS' requirements for Travel Rule information to be exchanged?
originator's name;
originator's account number, where an account is used to process the transaction. If no account number is available, a unique transaction reference number should be provided;
originator's address, official personal document number, customer identification number or date and place of birth.
beneficiary's name;
beneficiary's account number. If no account number is available, a unique transaction reference number should be provided.
Other obligations related to the Travel Rule in Singapore:
Every virtual asset service provider (VASP) has the obligation to identify the originator VASPs and verify their identity.
Every originator VASP needs to record the following information before transferring funds:
know your customer (KYC) information on the originator
"adequate details of the value transfer so as to permit its reconstruction, including but not limited to, the date of the value transfer, the type and value of digital payment token(s) transferred and the value date" with the value date being defined as "the date of receipt of funds by the value transfer beneficiary" (Schedule 1 of the Payment Service Act, part 3).
VASPs, when dealing with unhosted wallets (also known as self-hosted wallets), should collect the information on the beneficiary and originator and make it available to the Authorities if requested to do so. They also need to apply enhanced due diligence whenever they transact with unhosted wallets. For example, determine the purpose of the transaction, customer due diligence on the beneficiary (and its beneficial owner), including additional checks to manage risks of impersonation, e.g. verifying ownership of unhosted wallets, enhanced monitoring of customer account, and consider filing suspicious activity report if warranted.
Get in touch with 21 Analytics to find out how we can help you verify unhosted wallet ownership. We developed a customer-friendly and privacy-respecting solution to establish the power of disposal over a wallet: Address Ownership Proof Protocol.
When do you need to comply with the Travel Rule in Singapore?
NOW. When applying for a license (needed to operate as a VASP in Singapore), you must be able to demonstrate how you will comply with the Travel Rule.
What else do you need to know about the Travel Rule in Singapore?
Existing VASPs operating in Singapore were required to notify MAS and submit license applications by 28 July 2020.
If a DPT service provider requires more time to implement the Travel Rule, it should (a) conduct a risk-based analysis taking into account the risk profiles of its customers and counterparties and (b) apply effective risk mitigation measures accordingly. One example of such risk mitigation measures is for the DPT service provider to restrict its VA transactions to a closed-loop within its own customer base, where only verifiable first party transfers for VA transactions are allowed outside the closed-loop and enhanced monitoring is done on those transactions.
