MAS Guidelines on PSP Audit
MAS Guidelines on PSP Audit
Based on the MAS Guidelines on Audit of Payment Service Providers (PS-G04), here is an overview of the key audit requirements, expectations, and mandatory review areas for payment service providers (PSPs):
1. Annual Audit Requirements & Submissions
Timeline & Appointment: Pursuant to section 37 of the Payment Services Act 2019 (PS Act) and Regulation 20 of the Payment Services Regulations 2019 (PS Regs), a PSP must appoint an external auditor annually and submit a report via Form 4 within 6 months after the financial year end.
Single Auditor Requirement: PSPs must not engage separate auditors for different parts of the annual audit; the same appointed auditor must cover the annual accounts, the Independent Assurance Report, and all management findings/observations.
Form 4 Components: Submissions must include the audited accounts, the Independent Assurance Report (based on AGS1, Appendix 3B, per SSAE 3000 Revised), and the management letter detailing findings, observations, and recommendations.
2. Immediate Reporting of Serious Breaches
Under Section 37(9) of the PS Act, external auditors are required to immediately report serious issues directly to the Monetary Authority of Singapore (MAS), including:
Customer monies not being properly segregated or safeguarded.
Base capital falling below minimum requirements.
Conducting regulated activities without a proper licence.
Unauthorized changes in controllers, Board of Directors, or CEO.
Systemic and severe risk management/control gaps, criminal fraud/dishonesty, or significant capital reductions of at least 50%.
Note: This statutory duty of the auditor does not replace the PSP's own independent obligation to immediately notify MAS upon discovering any serious breach or severe control gap.
3. Baseline Audit Expectations
Audits must be commensurate with the business model's risk level and complexity, covering key risk areas such as Money Laundering and Terrorism Financing (ML/TF), loss of customer monies, and technology risks.
Mandatory Annual Audit Areas: All PSPs must undergo annual audit coverage for:
Safeguarding of relevant monies and customer assets.
Accuracy and completeness of figures reported in PSN04.
Compliance with base capital requirements.
Exemption criteria observance for PSPs offering exempted products under PSN01.
Remediation of findings from prior external audits and MAS inspections.
4. Mandatory End-to-End Review (New Licensees & Services)
Timing: Newly licensed PSPs (or those introducing newly licensed payment services) must ensure that auditors perform a comprehensive end-to-end review of risk management systems and controls one year after the commencement of operations or the new service.
(a) AML/CFT Review Scope: Must cover enterprise-wide ML/TF risk assessment, compliance arrangements, customer due diligence (CDD), name screening, ongoing monitoring, wire/value transfers, record keeping, suspicious transaction reporting (STR), and management oversight.
(b) Technology Risk Review Scope: Must cover areas such as cyber hygiene practices, tech risk governance, IT project management/security by design, software application development, IT resilience, access controls, cryptography, and online financial services (commensurate with the IT system complexity).
Would you like to explore how these guidelines apply to a specific operational area or review cycle within your organization?
Appointing Bestar as External Auditor: Complete Guide for Payment Service Providers (PSPs) & Singapore Companies
Appointing a qualified external auditor is a statutory requirement under the Singapore Companies Act and section 37 of the Payment Services Act 2019 (PS Act). Under MAS Guideline PS-G04 (Guidelines on Audit of Payment Service Providers), the Monetary Authority of Singapore enforces strict requirements regarding single-auditor oversight, mandatory annual audit areas, and end-to-end reviews.
Bestar provides end-to-end statutory audit, regulatory assurance, and advisory services tailored for licensed payment service providers, financial institutions, and corporate entities across Singapore and Asia.
Key Regulatory Requirements under MAS Guideline PS-G04
When appointing an external auditor for a licensed PSP, your firm must meet the following MAS compliance standards:
Single Auditor Rule: PSPs cannot engage separate auditors for different parts of the annual audit. The same appointed auditor must manage the annual accounts audit, the Independent Assurance Report, and all management letter observations.
Form 4 Filing Deadline: The audit report must be submitted via MAS online portals within 6 months of your financial year-end.
Mandatory Annual Coverage: Annual audits must verify five key regulatory areas:
Safeguarding of customer monies and assets (PS Act Sections 21A/23).
Accuracy and completeness of reported figures in Form PSN04.
Compliance with base capital requirements.
Exemption criteria for exempted products under PSN01.
Full remediation of prior findings from external audits and MAS inspections.
Mandatory 1-Year End-to-End Review: Newly licensed PSPs or entities launching newly licensed payment services must undergo an end-to-end review of AML/CFT and Technology Risk Management one year post-commencement.
Why Appoint Bestar as Your External Auditor?
Single-Point Accountability: Bestar handles financial statement audits, SSAE 3000 (Revised) / AGS1 Appendix 3B Independent Assurance Reports, and management letter submissions in full compliance with MAS Form 4 criteria.
In-House Expertise: All business valuation, statutory audit, and regulatory assurance processes are managed directly in-house without third-party outsourcing.
Proactive Gap Remediation: Bestar helps identify and remediate internal control gaps prior to filing, strengthening your risk management profile ahead of supervisory reviews.
Price Match Guarantee: Bestar matches or betters any written statutory audit fee quotation provided by competing CPA firms in Singapore.
Step-by-Step: How to Appoint Bestar
[Board Resolution / AGM Approval] ➔ [Notice of Change of Auditor] ➔ [Engagement Letter Execution] ➔ [Audit Planning & Data Room Setup]
Board & Shareholder Resolution: Pass a board resolution and shareholder approval (or written consent) to appoint Bestar Assurance PAC / Bestar as external auditor under Section 205 of the Singapore Companies Act.
Clearance & Transition: Bestar manages the professional clearance process with outgoing auditors to ensure a smooth transition without regulatory friction.
Formal Engagement Execution: Sign the formal engagement letter defining the audit scope, Form 4 timelines, and assurance standards.
Data Preparation: Provide required audit documentation, including customer risk profiles, transaction records, Enterprise-Wide Risk Assessments (EWRA), and past audit findings.
Frequently Asked Questions
What is the deadline for submitting the MAS Form 4 audit report?
The Form 4 audit report, including audited financial statements and the Independent Assurance Report, must be submitted to MAS within 6 months after your financial year-end.
Can a PSP split its financial audit and AML/CFT assurance between two different firms?
No. Under MAS Guideline PS-G04, PSPs must appoint a single external auditor to cover financial accounts, SSAE 3000 assurance, and control observations.
What immediate reporting duties apply to serious regulatory breaches?
Under Section 37(9) of the PS Act, auditors must immediately report severe breaches to MAS—including safeguarding failures, base capital shortfalls below minimums, unauthorized director/CEO changes, or capital reductions exceeding 50%. PSPs retain an independent legal duty to notify MAS immediately upon discovery.
To request a proposal or schedule an audit planning session:
Official Email: admin@bestar-asia.com (Official communications are handled via email)
Headquarters: Solstice Business Center, 23 New Industrial Road, #04-08, Singapore 536209
Comments