Licence thresholds, safeguarding, restrictions on promoting payment tokens and unauthorised transaction claims are where AI agents help Singapore fintech compliance teams. The agents monitor, review and draft; people keep every licence decision, report and customer outcome. MAS payment services licensing, the Technology Risk Management Guidelines, FEAT and the PDPA apply.
What does fintech compliance involve in Singapore?
The licence class sets the scope. Under Singapore's payments law, MAS licenses money-changers, standard payment institutions and major payment institutions, with requirements that rise with size and the services offered, including digital payment token services. A fintech that grows past certain thresholds must move to a higher class, and compliance watches those thresholds.
Safeguarding is a core test for major payment institutions. Customer money must be protected through the methods MAS allows, and compliance checks daily that safeguarded amounts match what customers are owed.
Marketing and conduct follow. MAS restricts how digital payment token service providers promote their services to the public, and expects all payment providers to treat customers fairly. MAS's guidelines on e-payments user protection set duties for handling unauthorised and erroneous transactions. Technology risk, outsourcing, AML/CFT under MAS notices, and data protection under the PDPA complete the picture.
Which tasks can an agent take on?
| Use | What the agent does | Depth |
|---|---|---|
| Safeguarding checks | Compares customer balances with safeguarded funds daily and flags shortfalls or late transfers | 1 |
| Threshold monitoring | Tracks transaction volumes and float against licence class thresholds and alerts compliance well before a limit is reached | 1 |
| Token marketing review | Reviews campaigns, social posts and partner placements for public promotion of digital payment token services that MAS restricts | 1 |
| Unauthorised transaction claims | Drafts the investigation summary and the customer response under the e-payments protection rules, for a person to decide liability | 2 |
| AML alert triage | Drafts dispositions from transaction, device and customer data for an analyst | 2 |
Threshold monitoring is easy to overlook and costly to miss. A fintech that crosses into a higher licence class without the right authorisation has a serious problem. An agent watching volumes daily gives management time to apply for the right licence.
Token marketing review is narrower but sharp. MAS expects digital payment token service providers not to promote their services to the general public, including through public spaces and social media influencers, so a single partner placement can be a problem. The agent reviews every placement and post; compliance decides what to withdraw.
Unauthorised transaction claims test fairness as much as process. The agent's draft sets out the timeline, the device and authentication evidence, and when and how the customer reported the loss, so the person deciding liability starts from a complete file.
What stays with people?
Deciding liability on an unauthorised transaction claim stays with a person. The rules allocate losses between the provider and the customer depending on the facts, and customers deserve a reasoned decision they can challenge.
Licence applications, communications with MAS, reports of suspicious transactions and decisions to block customers stay with named staff. MAS expects senior management to be clearly accountable.
The FEAT principles add a reason: decisions that affect customers should be fair, explainable and accountable, which means a human answerable for them. This is our view in AI compliance agents: second line, never the last word.
Which rules apply in Singapore?
MAS licenses and supervises payment service providers under payments law, including money-changing, cross-border and domestic transfers, e-money and digital payment token services. It sets safeguarding requirements, AML/CFT notices, conduct expectations including restrictions on promoting digital payment token services to the public, and guidelines on e-payments user protection.
For technology and AI, MAS's Technology Risk Management Guidelines cover governance, testing, change management and third-party risk, including the agent and its supplier. MAS's FEAT principles (fairness, ethics, accountability, transparency) guide AI and data analytics. IMDA's Model AI Governance Framework offers practical guidance.
The Personal Data Protection Act 2012, administered by the PDPC, governs customers' personal data, including breach notification and limits on purpose. Our piece on the Singapore PDPA and AI agents covers it, and our overview of how AI agents are regulated in Singapore covers the rest.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How do you start in the first 90 days?
Month one: run safeguarding checks and threshold monitoring at depth 1. Both rest on data the fintech holds and both protect the licence directly.
Month two: run token marketing review on the last quarter's campaigns and partner placements, if you offer digital payment token services. Withdraw anything that breaches MAS's restrictions.
Month three: pilot unauthorised transaction claim drafting at depth 2, with every liability decision made by a person, and complete the technology risk review of the agent's supplier.
Where Pryme fits
Pryme holds every liability decision on an unauthorised transaction claim as a held verdict for a named person, with the agent's investigation attached. Each agent is certified by Attest on the fintech's own claims and campaigns. Certificates lapse after 90 days, and the verdict record supports MAS's expectations on accountability.
Questions people ask
Can an AI agent decide who bears the loss on an unauthorised transaction?
It can investigate and draft, but the liability decision should be made by a person applying MAS's rules to the facts.
Do MAS's Technology Risk Management Guidelines cover AI agents?
The guidelines apply to technology the institution relies on, so an agent and its supplier fall within governance, testing and third-party risk expectations.
How does Singapore compare with Canada for fintech compliance?
Canada splits fintech oversight between federal payments and AML law and provincial regulators. See our brief on compliance agents in Canadian fintech.