The governance that MAS expects
PSN02 closes with the requirements that make everything before it work: internal policies, procedures and controls approved by senior management, a compliance function with adequate resources and independence, an audit function that tests the programme, screening of employees and ongoing training.1 The notice places responsibility on the board and senior management by name. MAS's supervisory approach treats a control failure as a governance failure first and a technical failure second. Its enforcement actions therefore almost always cite the board's or management's oversight alongside the specific breach.
The governance model that MAS expects is the one it applies to banks, scaled to the firm. There are three lines of defence. The business owns the risk and performs the first controls. The compliance function sets the policy, monitors and reports. Internal audit tests both. A board or board committee receives regular reporting on AML/CFT matters, approves the risk assessment and the policies at least annually and minutes its discussion. A compliance officer has direct access to the board and the authority to stop a transaction or a relationship. A DPT start-up with thirty employees cannot replicate a bank's structure, and MAS does not expect it to. It does expect the functions to exist, to be separated where separation is possible, and to be documented where it is not.
Notes
- MAS Notice PSN02, para. 16 (internal policies, compliance, audit and training), requiring the licensee to develop and implement adequate internal policies approved by senior management, to appoint a compliance officer at management level, to maintain an independent audit function and to conduct employee screening and training. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.