The enterprise-wide risk assessment

Read the PDF edition (2 pages)

Before any customer is onboarded, PSN02 requires the firm to identify and assess the money-laundering and terrorism-financing risks it faces across customers, countries, products, services, transactions and delivery channels. The assessment must be documented, kept current and approved by senior management.¹ MAS inspectors read this document first. Its quality determines how the inspection proceeds, because every later control is tested against the risks the firm itself has identified. A firm that rates its own risk as low across the board invites the inspector to find the risks it missed.

The Guidelines expect the assessment to consider the national risk assessment's findings on the DPT sector, the FATF virtual-asset guidance and red-flag indicators, the firm's own customer data and the typologies specific to its products. For a DPT business the product-level analysis should distinguish at least fiat-to-DPT exchange, DPT-to-DPT exchange, custody and transfers to and from unhosted wallets. It should separately treat transfers to and from other service providers, stablecoin conversion, over-the-counter block trades and any lending, staking or yield product offered to non-retail customers.² Each carries a different inherent risk. Custody of a corporate treasury presents a different profile from retail fiat on-ramping. A fully documented assessment says why.

Country risk for a Singapore DPT firm

Country risk is where Singapore firms most often fall short of MAS's expectation, because the natural customer base of a Singapore DPT exchange is regional and includes jurisdictions with weak AML frameworks. MAS requires firms to give particular attention to the countries that the FATF has called for countermeasures against or placed under increased monitoring, and to any jurisdiction that MAS itself designates by notice.³ Beyond that list the firm must build its own country-risk model. A defensible model combines the FATF lists, the Basel AML Index or an equivalent, the Transparency International Corruption Perceptions Index, sanctions exposure and the firm's own experience, weighted and documented. MAS does not prescribe the weights. It asks whether the firm can explain them.

Notes

1. MAS Notice PSN02, para. 4 (assessing risks and applying a risk-based approach); Guidelines to Notice PSN02, section on enterprise-wide risk assessment. ↩
2. Guidelines to Notice PSN02, section on risk assessment and risk mitigation; FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs, October 2021, paras 30–90 on risk factors. ↩
3. MAS Notice PSN02, para. 8 (enhanced CDD for higher-risk countries); FATF, High-Risk Jurisdictions subject to a Call for Action and Jurisdictions under Increased Monitoring, as updated at each FATF plenary. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.