The legal basis for a group programme

Read the PDF edition (2 pages)

Both regimes require or assume a group-wide approach, but with different reach.

PSN02 requires a payment service provider incorporated in Singapore to develop a group policy on AML/CFT and to extend it to all its branches and subsidiaries, in Singapore and abroad.¹ The group policy must ensure that the overseas entities apply AML/CFT measures consistent with the notice to the extent that host-country law permits. Where the host-country standard is lower than Singapore's, the Singapore standard applies. Where host-country law prevents the application of the Singapore standard, the firm must inform MAS and take additional measures to manage the resulting risk. The policy must also provide for the sharing of information within the group for CDD and risk-management purposes, with safeguards for confidentiality. This provision applies only where the Singapore entity is the parent or has subsidiaries. A Singapore MPI that is itself a subsidiary of a Swiss holding is not required by PSN02 to impose anything on its parent or sister companies.

Swiss law is more fragmented. For financial intermediaries supervised directly by FINMA, which means banks, securities firms, fund managers and the other licence holders of Part E, Arts 5 and 6 of the FINMA Anti-Money Laundering Ordinance (AMLO-FINMA; GwV-FINMA) apply. They require global monitoring of legal and reputational risks and the application of the Swiss principles to foreign branches and group companies.² For SRO-affiliated intermediaries under Art. 2 para. 3 AMLA, which is what a Zug crypto custodian or broker usually is, the AMLO-FINMA does not apply directly. The SRO regulations do not generally impose a group-wide duty.³ The Swiss entity's obligations are its own and stop at its own customers. A Zug SRO member is therefore under no Swiss legal duty to run a group programme, although the FATF standard (Recommendation 18) assumes one and a well-run group adopts one for its own protection.⁴

The practical conclusion is that the group programme is anchored in Singapore law where the Singapore entity is the parent, and is a matter of good practice and FATF alignment where the Swiss entity is the parent. In either case, the programme should be a single document with a common core and jurisdiction-specific annexes, approved by the board of each entity, since each regulator will want to see that its licensee's board owns the policy applied to it.

Notes

1. MAS Notice PSN02, para. 15 (group policy), requiring a Singapore-incorporated payment service provider to develop a group policy, to extend it to overseas branches and subsidiaries, to apply the stricter of the Singapore and host-country standards where they differ, and to inform MAS where host-country law prevents compliance. ↩
2. FINMA Anti-Money Laundering Ordinance (AMLO-FINMA; GwV-FINMA, SR 955.033.0), Arts 5–6 (global monitoring of legal and reputational risks, group-wide application of principles), applicable to financial intermediaries under Art. 2 para. 2 AMLA. ↩
3. Anti-Money Laundering Act (AMLA; GwG, SR 955.0), Art. 2 para. 3 and Art. 24 ff. (self-regulatory organisations); the regulations of VQF, SO-FIT, PolyReg and the other SROs set the due-diligence standards for their members and do not generally extend to foreign group companies. See Part F, Chapter I. ↩
4. FATF Recommendation 18 and its Interpretive Note, requiring financial groups to implement group-wide AML/CFT programmes including policies for sharing information within the group, applicable to all branches and majority-owned subsidiaries. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.