Singapore to Impose New Custody Rules on Crypto Service Providers

Segregation of Customers’ Assets

• A DPTSP must deposit assets (including DPTs) received from, or on account of, a customer in a custody account held on trust for the customer and maintained with a safeguarding institution(or itself).
• Individual customer assets may be commingled in the same custody account, but this must be kept separate from the DPTSP’s own assets.
• Assets in the custody account may not be used to pay the debts of a DPTSP.
• A DPTSP must apply a customer’s assets solely for the purposes agreed to by the customer.
• A DPTSP may not transfer any right or interest in the customer assets except where the transfer is in accordance with the customer’s written instructions obtained prior to each transfer, or is authorised by law.

Custody Account Requirements

• A DPTSP may choose to either maintain the custody account itself or with a safeguarding institution.
• Where the custody account is maintained with a safeguarding institution, the following requirements should be met:
  • The DPTSP must assess and be satisfied of the suitability of the safeguarding institution before opening the custody account and on an annual basis thereafter, and keep records of the grounds on which the DPTSP was satisfied.
  • The DPTSP should provide written notice to the safeguarding institution and obtain an acknowledgement that (i) all assets deposited in the custody account are held by the DPTSP on trust for its customers, (ii) the account is designated as a trust or customer’s account, and (iii) the safeguarding institution may not claim any lien over any assets in the custody account except in certain circumstances.
  • The DPTSP must assess and ensure that the safeguarding institution maintains adequate risk management controls to ensure the integrity and security of the transmission and storage of customer assets, and reduce the risk of loss of assets due to fraud or negligence.
• Where the custody account is maintained by the DTPSP itself, the DPTSP must ensure effective controls and segregation of duties to mitigate potential conflicts of interests.

Customer disclosures

• A DPTSP must disclose to its customers the safeguarding arrangement adopted by the DPTSP, including whether the assets will be commingled with other customer assets, the consequences if the safeguarding institution becomes insolvent, and the terms and conditions that would apply to the safeguarding of the customer assets.

Safeguarding of Customers’ Money

• The existing rules on safeguarding of customers’ money as set out in the PSR will be extended to DPTSPs. This means that going forward, DPTSPs will be required to safeguard all moneys received from, or on account of, a customer by:
  • obtaining an undertaking from a Singapore safeguarding institution to be fully liable for the customer money;
  • obtaining a guarantee from a Singapore safeguarding institution for the amount of customer money; or
  • depositing customer money into a trust account maintained with a Singapore safeguarding institution.

Daily Reconciliation and Record Keeping

• A DPTSP must reconcile on a daily basis the total amount of assets deposited in its customers’ custody accounts, and the total amount of customer assets required to be deposited in custody accounts.
• A daily reconciliation requirement will likewise be imposed in respect of customer money.
• A separate book entry must be recorded and maintained for each customer in relation to the customer’s assets, containing the particulars prescribed in the PSR.

Risk Management Controls

• A DPTSP must, in a manner that is commensurate with its business, maintain adequate systems, processes, controls, human resources and governance arrangements, to:
  • ensure the integrity and security of the transmission and storage of customer assets (including DPTs); and
  • reduce the risk of any loss of customer assets due to fraud or negligence.
• Movement of customer assets should be controlled by senior managers and personnel who are resident in Singapore.
• MAS expects DPTSP to keep at least 90% of its customers’ DPTs in cold wallets, while the remaining 10% may be kept in other wallets (e.g. hot wallets).
• MAS will not, at this time, require a DPTSP to ensure that devices storing means of access to a customer’s DPT is located in Singapore. However, DPTSPs are strongly encouraged to adopt technological solutions that enable the development of local custody solutions and strong risk management expertise.

Statement of Account

• A DPTSP must provide monthly statements of account to customers unless the DPTSP already provides account information on a real-time basis, there is no change to any particulars since the date of the last statement of account, or the customer has requested in writing not to receive the statements on a monthly basis.

Facilitating the Lending and Staking of Retail Customer Assets

• A DPTSP may not facilitate the lending and staking of a retail customer’s assets (including DPTs).
• Retail customers will not be prohibited from lending or staking their own assets outside of the DPTSP’s platform, but they will be doing so at their own risks.
• A DTPSP will not be restricted from enabling or facilitating the lending and staking of assets belonging to non-retail customers, but clear risk disclosures must be provided and the customer’s explicit consent must be obtained for such activities.