Technology Lawyers Singapore: Paynow Cross‑border, MAS Licensing & Compliance (2026)

Singapore’s real‑time payment infrastructure is expanding rapidly beyond domestic borders, and technology lawyers Singapore‑wide are fielding urgent questions from payment service providers (PSPs), banks and fintechs about the legal implications. Multiple PayNow cross‑border linkages, connecting Singapore to India’s UPI, Malaysia’s DuitNow and Thailand’s PromptPay, have moved into production or advanced piloting during 2024–2026, while the multilateral Project Nexus platform is poised to accelerate cross‑border instant payments further. MAS has simultaneously refreshed its licensing guidance and supervisory expectations under the Payment Services Act 2019 (PSA), creating a compliance environment where entities enabling or accepting these flows must reassess licences, AML/CFT controls, contracts and operational readiness.

This guide provides an actionable compliance roadmap, from licence mapping through contract clause drafting, for decision‑makers who need to move quickly.

Executive Summary & Immediate Decisions

For chief legal officers, compliance leads and product heads at PSPs and merchants considering PayNow cross‑border integration, the following five takeaways should drive immediate action:

• Licensing trigger review. Any entity facilitating cross‑border money transfers via PayNow linkages must hold, or apply for, the appropriate PSA licence, typically a Major Payment Institution (MPI) licence for higher‑volume or multi‑service operations (MAS, Licensing for Payment Service Providers).
• AML/CFT recalibration. Cross‑border real‑time payment flows introduce new money‑laundering typologies. Existing batch‑based transaction monitoring systems are unlikely to meet MAS expectations for instant, irrevocable cross‑border transfers.
• Contract and SLA overhaul. Settlement finality, foreign‑exchange risk allocation, chargeback mechanics and liability caps must be addressed in participant agreements, these clauses differ materially from domestic PayNow terms.
• Data protection compliance. Linking PayNow with foreign rails involves cross‑border personal data transfers that must satisfy PDPA requirements and any MAS‑specific data‑management expectations.
• Timeline urgency. Industry observers expect that with multiple linkages already live and Project Nexus approaching production, MAS supervisory scrutiny of unlicensed or under‑prepared participants will intensify throughout 2026. Entities should complete their licensing and compliance reviews during user‑acceptance testing (UAT), not after launch.

The practical recommendation is straightforward: begin a structured licensing gap analysis, engage Singapore technology lawyers with payments expertise, and run parallel workstreams for AML tuning, contract drafting and technical integration testing.

How PayNow Cross‑Border Linkages Work, Rails, Flows & Settlement

PayNow cross‑border linkages enable real‑time retail payments between Singapore and partner countries by connecting their respective fast‑payment systems. The architecture varies by corridor, but the core participants remain consistent: an originating PSP (the payer’s institution in the sending country), a receiving PSP (the payee’s institution in the destination country), and in many cases a sponsoring or settlement bank that handles foreign‑exchange conversion and net settlement between the two systems (MAS, Cross‑border Payment Linkages).

The payment message flows from the payer’s app through the originating PSP, across the linkage infrastructure, to the receiving PSP, which credits the payee in local currency. Settlement between the two country‑systems typically occurs on a deferred‑net basis, with designated settlement banks managing FX exposure according to pre‑agreed rates and cut‑off times. The key legal characteristic is that these are irrevocable credit transfers, once the receiving PSP confirms credit, the transaction cannot be unilaterally reversed, which has significant implications for dispute resolution and chargeback allocation.

PayNow ↔ UPI / DuitNow / PromptPay Mechanics

The PayNow–DuitNow linkage between Singapore and Malaysia, and the PayNow–PromptPay linkage with Thailand, operate as bilateral connections where the respective national payment system operators coordinate message routing and settlement (ABS, PayNow/DuitNow Factsheet). The PayNow–UPI corridor with India follows a similar bilateral architecture. In each case, users initiate transfers using mobile‑number or virtual‑payment‑address proxies, and the receiving system resolves the proxy to a local bank account. FX conversion is handled at the point of transfer, with rates typically set by the settlement bank or a designated FX provider within the linkage arrangement.

Project Nexus Overview and Production Status (2026)

Project Nexus, coordinated by the BIS Innovation Hub, represents a multilateral approach to cross‑border instant payments. Rather than building individual bilateral links between every pair of countries, Nexus provides a standardised coordination layer that connects multiple domestic instant‑payment systems through a common protocol. Industry observers expect that as Nexus approaches full production, it will substantially reduce the bilateral‑negotiation burden and allow PSPs with a single integration to reach multiple corridors. For Singapore technology lawyers advising PSPs, Nexus introduces additional governance considerations: scheme rules are multilateral rather than bilateral, and compliance obligations may layer on top of existing MAS requirements (MAS, Cross‑border Payment Linkages).

MAS Licensing, Payment Services Act Mapping for Technology Lawyers Singapore

The Payment Services Act 2019 (PSA) is the primary legislation governing PSP licensing Singapore entities must navigate when offering PayNow cross‑border services. The PSA defines seven categories of payment services, and a PSP’s licensing obligation depends on which categories its activities fall within and the volume or value of transactions it processes (Payment Services Act 2019).

For PayNow cross‑border flows, the most commonly triggered service categories are cross‑border money transfer service (facilitating an outbound or inbound transfer of money from or to Singapore) and, depending on the PSP’s role, domestic money transfer service or merchant acquisition service. A PSP that merely connects a merchant to receive incoming cross‑border PayNow payments may trigger the merchant‑acquisition category, while a PSP that initiates outbound transfers on behalf of its customers clearly falls within cross‑border money transfer.

The answer to the frequently asked question, do companies need a specific MAS licence?, is almost always yes. Any entity carrying on a business of providing a payment service in Singapore must hold a licence unless a specific exemption applies. MAS licensing guidance makes clear that the licensing requirement is activity‑based, not entity‑based: if the activity constitutes a regulated payment service, a licence is required regardless of whether the entity considers itself a “technology company” rather than a financial institution (MAS, Licensing for Payment Service Providers).

Licence Types & Baseline Requirements

PSPs approaching the PSA thresholds that separate SPI from MPI status, based on average monthly transaction volume or the float held, should model their projected PayNow cross‑border volumes carefully. Industry observers expect that cross‑border real‑time payment volumes will grow rapidly once linkages reach full production, meaning an entity that qualifies as an SPI today may breach MPI thresholds within months of launch.

Common MAS Supervisory Concerns for Cross‑Border Linkages

MAS has signalled heightened attention to several areas when PSPs participate in cross‑border payment linkages:

• Outsourcing and third‑party risk. Where a PSP relies on a scheme operator, settlement bank or technology vendor to perform critical functions in the cross‑border chain, MAS expects robust outsourcing arrangements including service‑level agreements, audit rights and business‑continuity provisions.
• Cross‑border data flows. Payment data transmitted to foreign counterparties or through multilateral hubs must comply with MAS Technology Risk Management Guidelines and PDPA cross‑border transfer requirements.
• Scheme‑level risk. PSPs must understand and manage settlement risk, FX risk and operational risk arising from participation in bilateral or multilateral payment linkage schemes (MAS, Cross‑border Payment Linkages).

AML/CFT & Transaction Monitoring for Real‑Time Cross‑Border Payments

Cross‑border real‑time payments present distinct AML/CFT challenges that go beyond the controls typically designed for domestic PayNow transactions. Under the PSA and the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act (CDSA), licensed PSPs must implement customer due diligence (CDD), ongoing monitoring, sanctions screening, and suspicious transaction reporting (STR) obligations. The introduction of PayNow cross‑border rails demands that these controls be recalibrated for speed, volume and jurisdictional complexity.

The core challenge is timing. Domestic PayNow transactions settle in seconds, and cross‑border linkages aim for comparable speed. Traditional batch‑based transaction monitoring, where alerts are generated and reviewed hours after execution, is fundamentally inadequate for irrevocable real‑time transfers. PSPs must implement pre‑execution screening (sanctions, PEP, adverse media) and near‑real‑time post‑execution monitoring capable of flagging suspicious patterns before funds can be further dissipated.

Transaction Monitoring Rules & Red Flags for Cross‑Border QR/UPI Flows

Effective monitoring for cross‑border QR payments and PayNow UPI flows should incorporate rules tailored to the specific risk typologies of instant cross‑border transfers:

• Velocity rules. Flag accounts conducting an unusual number or value of cross‑border transfers within short timeframes, particularly where the pattern deviates from the customer’s declared profile.
• Jurisdiction‑based risk scoring. Apply enhanced monitoring to corridors identified as higher‑risk based on FATF mutual evaluations and MAS guidance on country/territory risk.
• Proxy‑abuse detection. Monitor for patterns suggesting misuse of mobile‑number or virtual‑payment‑address proxies, such as multiple proxies linked to a single beneficial owner or rapid proxy‑switching.
• Structuring indicators. Detect transactions structured just below reporting thresholds or split across multiple PayNow cross‑border corridors to avoid detection.
• Mule‑account indicators. Flag newly opened accounts that rapidly begin receiving high‑value cross‑border credits, particularly where the account holder has no declared business purpose for such receipts.

Recordkeeping, Suspicious Transaction Reporting & Liaison with MAS

PSPs must retain records of all cross‑border PayNow transactions, including originator and beneficiary information, for a minimum period as specified under the CDSA and PSA regulations. Suspicious transaction reports (STRs) must be filed with the Suspicious Transaction Reporting Office (STRO) promptly upon forming suspicion, the irrevocable nature of real‑time cross‑border transfers makes early detection critical, as recovery of funds post‑credit is significantly more difficult than with traditional payment channels. PSPs should establish clear internal escalation procedures and maintain open communication channels with MAS for regulatory queries related to cross‑border AML/CFT obligations.

Operational, Technical and Contract Obligations, What to Include

The contractual framework governing PayNow cross‑border participation must address risks that are either absent or less acute in domestic real‑time payments. Technology lawyers advising PSPs and merchants should ensure that participant agreements, merchant contracts and interbank arrangements contain comprehensive provisions across settlement, liability and operational performance.

Key areas requiring contractual attention include:

• Settlement finality and timing. Define when settlement is deemed final and irrevocable, specify the settlement cycle (same‑day, T+1 or as determined by the linkage scheme), and allocate the risk of settlement failure between participants.
• FX risk allocation. Specify which party bears the risk of exchange‑rate fluctuation between transaction initiation and settlement, and whether rates are locked at the point of transfer or at settlement.
• Chargebacks and reversals. Because cross‑border PayNow transfers are credit‑push and generally irrevocable, traditional chargeback mechanisms do not apply. Contracts must establish alternative dispute‑resolution procedures for unauthorised or erroneous transactions.
• Liability caps and indemnities. Allocate liability for system failures, delayed settlement, FX losses, fraud and regulatory penalties, including appropriate indemnification for losses caused by the counterparty’s non‑compliance with AML/CFT or licensing obligations.
• Data protection. Address PDPA cross‑border data‑transfer obligations, data‑retention requirements and incident‑notification procedures for personal data breaches occurring within the payment chain.
• SLA KPIs. Set measurable service levels for system availability (e.g., 99.9% uptime), transaction‑processing latency, reconciliation cadence and incident‑response times.

Sample Contract Clause Bank

The following clause summaries illustrate the type of provisions that should appear in PayNow cross‑border participant agreements. These are indicative only and should be adapted to specific commercial circumstances with the assistance of qualified counsel.

• Settlement clause. “Settlement of cross‑border PayNow transactions shall be effected on a [same‑day / T+1] net basis through the designated settlement bank. Settlement shall be deemed final and irrevocable upon confirmation by the settlement bank. The Originating PSP bears all settlement risk until finality is confirmed.”
• Chargeback and dispute clause. “The parties acknowledge that cross‑border PayNow transfers are irrevocable credit transfers and are not subject to card‑scheme chargeback procedures. Disputes regarding unauthorised or erroneous transfers shall be resolved through the bilateral dispute‑resolution procedure set out in Schedule [X], with initial escalation to be completed within [5] business days.”
• Indemnity clause. “Each party shall indemnify and hold harmless the other party against all losses, claims and regulatory penalties arising from the indemnifying party’s breach of applicable AML/CFT obligations, licensing requirements, or data‑protection laws in connection with cross‑border PayNow transactions processed under this Agreement.”

Technical Controls & Testing

Before going live with cross‑border QR payments or PayNow UPI flows, PSPs should complete rigorous end‑to‑end integration testing covering message‑format validation, proxy resolution, FX‑rate application, settlement reconciliation and exception handling. Reconciliation should be performed on at least a daily basis during initial production, with automated matching of transaction records between the originating and receiving systems. PSPs should also implement real‑time alerting for reconciliation breaks exceeding defined thresholds and conduct periodic penetration testing of the cross‑border integration layer to satisfy MAS technology‑risk expectations.

PayNow Compliance Checklist, Immediate Actions for PSPs, Merchants and Banks

The following checklist provides a structured action plan for entities preparing to participate in PayNow cross‑border flows. Each item should be assigned to a responsible owner with a target completion date.

1. Licence review. Map all PayNow cross‑border activities to PSA service categories. Confirm whether current licence (SPI/MPI) covers cross‑border money transfer service. If not, initiate application or variation.
2. Capital adequacy. Model projected cross‑border transaction volumes against PSA thresholds. Assess whether SPI thresholds will be breached and prepare for MPI upgrade if necessary.
3. AML/CFT tuning. Recalibrate transaction monitoring rules for real‑time cross‑border flows. Implement pre‑execution sanctions screening and near‑real‑time post‑execution monitoring.
4. CDD enhancement. Review customer onboarding procedures for cross‑border payment users. Apply enhanced due diligence for higher‑risk corridors.
5. Contract review. Update participant agreements, merchant contracts and settlement‑bank arrangements with cross‑border‑specific clauses (settlement, FX, liability, chargebacks).
6. Scheme participation. Confirm eligibility and complete onboarding with relevant scheme operators (ABS for PayNow, PayNet for DuitNow, NPCI for UPI).
7. Technical integration testing. Complete end‑to‑end UAT covering message flows, proxy resolution, FX application, reconciliation and exception handling.
8. Data protection. Assess PDPA cross‑border data‑transfer obligations for payment data shared with foreign counterparties. Implement appropriate safeguards.
9. Incident response. Establish cross‑border incident‑response procedures, including escalation paths to MAS, scheme operators and foreign counterparties.
10. MAS reporting. Confirm all notification and reporting obligations to MAS are understood and operationalised, including any scheme‑specific reporting requirements.

Risk Scenarios & Enforcement Outlook, MAS Supervisory Priorities

Industry observers expect MAS to prioritise several enforcement themes as PayNow cross‑border linkages reach full production in 2026:

• Unlicensed payment services. Entities facilitating cross‑border PayNow flows without holding the appropriate PSA licence face enforcement action, including directions to cease operations and potential criminal liability under the PSA.
• Inadequate AML/CFT controls. PSPs that fail to recalibrate their transaction monitoring for real‑time cross‑border payments are likely to attract supervisory attention, particularly where suspicious transactions are identified retrospectively that monitoring systems should have flagged.
• Outsourcing failures. Where critical payment‑processing functions are outsourced to foreign technology vendors without adequate contractual protections, audit rights and business‑continuity arrangements, MAS may require remediation or impose conditions on the PSP’s licence.
• Inadequate disclosure. Insufficient disclosure to customers regarding FX rates, fees, settlement times and the irrevocable nature of cross‑border transfers may result in conduct‑related enforcement action.

MAS has demonstrated its willingness to take firm action against payment‑services licensees that fall short of regulatory expectations. The establishment of a new payments entity by MAS and the Association of Banks in Singapore (ABS) in 2025 further signals the regulator’s intent to strengthen governance and oversight across the national payments infrastructure (MAS, 2025 Media Release). The likely practical effect will be increased scheme‑level compliance requirements flowing through to individual PSP participants.

Case Study, PSP Onboarding a Merchant for PayNow Cross‑Border

Consider a Singapore‑incorporated PSP, holding an SPI licence for domestic money transfer and merchant acquisition, that receives a request from a large e‑commerce merchant to accept incoming PayNow–UPI payments from Indian customers.

The PSP’s legal team identifies three immediate issues. First, receiving cross‑border money transfers from India on behalf of the merchant likely triggers the cross‑border money transfer service category under the PSA, which is not covered by the PSP’s existing SPI licence. An MPI licence application, or at minimum a licence variation, is required before go‑live. Second, the PSP’s existing AML/CFT framework is designed for domestic PayNow flows; the legal team works with compliance to implement jurisdiction‑based risk scoring for the India corridor, velocity rules calibrated for cross‑border patterns, and pre‑execution sanctions screening against the UPI beneficiary identifier.

Third, the PSP’s merchant agreement contains no provisions for cross‑border settlement risk, FX allocation or the absence of traditional chargeback rights. The legal team drafts supplementary terms addressing settlement timing (T+1 via the designated settlement bank), FX risk borne by the merchant post‑lock, an alternative dispute‑resolution procedure for erroneous credits, and an indemnity from the merchant for losses arising from the merchant’s failure to comply with KYC/KYB obligations for its end‑customers. UAT is conducted with live test transactions across the PayNow–UPI linkage, and reconciliation procedures are validated before the MPI licence application is submitted to MAS.

Sources

1. Monetary Authority of Singapore, Licensing for Payment Service Providers
2. Monetary Authority of Singapore, Cross‑border Payment Linkages
3. Association of Banks in Singapore, PayNow/DuitNow Factsheet
4. Payment Services Act 2019 (Singapore)
5. PwC, Payments: State of Play 2026 (Singapore)
6. MAS Media Release, MAS and ABS to Establish New Payments Entity (2025)