E-Wallets: Asia’s New Current Account? AML Measures Across Borders

This regulatory analysis will examine anti-money laundering (AML) measures with regard to e-wallets and is the second in a series that will compare the licensing regimes of e-money operators and banks. Specifically, this analysis will compare the AML requirements for politically exposed persons (PEPs), beneficial owners and enhanced due diligence (EDD) measures for both e-money operators and banks in three distinct jurisdictions: Singapore; the Philippines; and the United Kingdom.

This comparison will aim to determine whether there are any similarities between e-money and banking regulations both locally and between these jurisdictions, at least from an AML perspective, in light of the compliance requirements that these regulations impose. It will then lay out what these similarities (if any) could potentially mean for e-money operators, both in these jurisdictions and potentially further afield.

Setting the Scene

As demonstrated in the first regulatory analysis in this series, e-money providers have very different roles within Singapore, the Philippines and the UK.

In Singapore, e-money providers have the go-to cashless payment method for small-value transactions, and have been widely adopted as an alternative to the island nation’s well-established card infrastructure. Statistics from the Monetary Authority of Singapore (MAS) show that Singaporeans made more than 1bn e-money transactions in the first half of 2022, outnumbering the volume of debit and credit card transactions (783m) over the same period.

In the Philippines, e-money has been a key driver of growth in financial inclusion and functions as a de facto current account, allowing millions of people access to a financial account for the first time. This is reflected in the 2021 Financial Inclusion Survey published by Bangko Sentral ng Pilipinas (BSP), the country’s central bank, which reported that 36 percent of Filipinos have an e-money account, exceeding the number of citizens (23 percent) who hold formal bank accounts.

In the UK, the list of licensed e-money institutions (as of March 2023) reveals that the majority of e-money firms provide a specific niche service, such as challenger banks, remittance or payment processing services. This is very different to the e-wallet service that e-money operators provide in Singapore and the Philippines where they are used for general retail purchases, much like debit and credit cards in the UK.

AML Across Borders

Singapore

Singaporean e-money operators are considered payment institutions and are required to perform EDD when a customer presents (or may present) a higher risk of money laundering or terrorism financing. This may include circumstances where a customer, or any beneficial owner of a customer, is from or in a country or jurisdiction in relation to which the Financial Action Task Force (FATF) has called for countermeasures or one which is known (either by the payment service provider, the MAS, or other foreign regulators) to have inadequate anti-money laundering/counter-terrorism financing (AML/CTF) measures, according to paragraphs 9.6 to 9.7 of MAS Notice PSN01 on “Prevention of Money Laundering and Countering the Financing of Terrorism - Holders of Payment Services Licence (Specified Payment Services)”.

E-money operators must also determine whether a customer is a PEP and, if so, must obtain approval from senior management to:

1. Establish or continue business relations with the customer.
2. Undertake any transaction without an account being opened for the customer.

The operator is also required to identify the source of wealth/funds of the customer, and any beneficial owner of the customer, and conduct ongoing monitoring to make sure transactions are not suspicious or unusual, as prescribed by paragraph 9.3 of MAS Notice PSN01.

Finally, where there is one or more beneficial owners in relation to a customer, e-money operators are required to identify the beneficial owners and take reasonable measures to verify their identities using the relevant information or data obtained from reliable, independent sources (paragraph 7.13, MAS Notice PSN01).

Singaporean banks, on the other hand, are regulated by MAS Notice 626 and are required to have in place appropriate internal risk management systems, policies, procedures and controls, to determine if business relations with or transactions for any customer present a higher risk of money laundering or terrorism financing, rather than just being subject to an EDD requirement (paragraph 8.5).

The one place that banks are explicitly required to perform EDD, however, is in regard to dealings with PEPs. In accordance with paragraph 8.3, banks must obtain approval from senior management to:

1. Establish or continue business relations with the customer or undertake any transaction without an account being opened for the customer.
2. Identify the source of wealth and source of funds of the customer and any beneficial owner of the customer.
3. Conduct ongoing monitoring to determine whether there is anything suspicious or unusual.

In terms of beneficial owners, Singaporean banks are also required to identify the beneficial owners, and take reasonable measures to verify their identities using the relevant information or data obtained from reliable, independent sources where there is one or more beneficial owners in relation to a customer (paragraph 6.14, MAS Notice 626).

Both e-money operators and banks in Singapore are subject to identical requirements relating to beneficial owners and PEPs. However, whereas e-money operators provide purely retail and P2P payments, banks provide a variety of services, which means they must comply with additional EDD requirements.

Philippines

In the Philippines, non-bank e-money issuers are regulated by the Manual of Regulations for Non-Bank Financial Institutions (from December 2020).

According to the manual, e-money issuers are required to perform EDD when customers have been assessed by the covered person as posing a high risk of money laundering/terrorism financing (Section 921-Q(a)). There are, however, extensive PEP requirements that apply to e-money issuers. Specifically, the manual states:

“Covered persons [obliged entities] shall establish and record the true and full identity of politically exposed persons (PEPs), as well as their immediate family members and entities related to them.

1. In case of domestic PEPs or persons who have been entrusted with a prominent function by an international organisation, or their immediate family members or close associates, in addition to performing the applicable due diligence measures, covered persons shall:
2. Take reasonable measures to determine whether a customer or the beneficial owner is a PEP.
3. In cases when there is a higher risk business relationship, adopt measures under paragraphs “(2)(b)” to “(2)(d)”.
4. In relation to foreign PEPs or their immediate family members or close associates, in addition to performing the applicable customer due diligence measures, covered persons shall:
5. Put in place risk management systems to determine whether a customer or the beneficial owner is a PEP.
6. Obtain senior management approval before establishing (or continuing, for existing customers) such a business relationship.
7. Take reasonable measures to establish the source of wealth and the source of funds of customers and beneficial owners identified as PEPs.
8. Conduct enhanced ongoing monitoring on that relationship.”

The provisions of this section shall not be construed or implemented in a manner that will discriminate against certain customer types, such as PEPs, as well as their relatives.

(Section 921-Q (Non-discrimination against certain types of customers), Section 923-Q(a,b) - Customer acceptance and identification policy)

In terms of beneficial owners, e-money issuers (which are considered covered persons) should identify the beneficial owner and take reasonable measures to verify the identity of the beneficial owner based on official documents, or using relevant information or data obtained from reliable sources, such that the covered person is satisfied that it is aware of the identity of the beneficial owner. The covered person should have a system to understand the nature of the customer’s business and its ownership and control structure, in case of juridical persons or legal arrangements (Section 921Q(a)).

Banks in the Philippines are regulated by the Manual of Regulations of Banks, which has provisions that are identical to that of the Manual of Regulations for Non-Bank Financial Institutions. For example, banks are also required to conduct EDD when customers have been assessed by the covered person as high-risk for money laundering/terrorism financing (Section 921). The requirements for PEPs are also identical in the manuals, stating:

“Covered persons (obliged entities) shall establish and record the true and full identity of politically exposed persons (PEPs), as well as their immediate family members and entities related to them.

1. In case of domestic PEPs or persons who have been entrusted with a prominent function by an international organisation, or their immediate family members or close associates, in addition to performing the applicable due diligence measures, covered persons shall:
2. Take reasonable measures to determine whether a customer or the beneficial owner is a PEP.
3. In cases when there is a higher risk business relationship, adopt measures under paragraphs ‘(2)(b)’ to ‘(2)(d)’.
4. b. In relation to foreign PEPs or their immediate family members or close associates, in addition to performing the applicable customer due diligence measures, covered persons shall:
5. Put in place risk management systems to determine whether a customer or the beneficial owner is a PEP.
6. Obtain senior management approval before establishing (or continuing, for existing customers) such [a] business relationship.
7. Take reasonable measures to establish the source of wealth and the source of funds of customers and beneficial owners identified as PEPs.
8. Conduct enhanced ongoing monitoring on that relationship.”

The provisions of this section shall not be construed or implemented in a manner that will discriminate against certain customer types, such as PEPs, as well as their relatives.

(Section 921 (Non-discrimination against certain types of customers); Section 923(a)-(b) - Customer acceptance and identification policy of the Manual of Regulations for Banks)

The provision for identifying beneficial owners for both banks and e-money operators are identical, with the Manual of Regulations for Banks requiring banks to identify the beneficial owner and take reasonable measures to verify the identity of the beneficial owner based on official documents, or by using relevant information or data obtained from reliable sources, such that the covered person is satisfied that it knows who the beneficial owner is. The bank should have a system to understand the nature of the customer’s business, its ownership and its control structure, in case of juridical persons or legal arrangements (Section 921(a)(2), Manual of Regulations for Banks).

As above mentioned, e-money accounts in the Philippines have a significant position in the country as quasi-current accounts. That being said, the similarity between AML regulation that the Bangko Sentral ng Pilipinas has implemented for e-money and banks emphasises the importance of e-money to Filipinos.

United Kingdom

Both e-money institutions and banks are considered “relevant persons” under the the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs), and are therefore largely subjected to the same regulations.

In accordance with Regulations 27-32 and 33-36, both e-money institutions and banks must apply EDD measures and enhanced ongoing monitoring, in addition to the general customer due diligence (CDD) measures required under Regulations 28 and 29. In particular, Regulation 33 states that the EDD measures and enhanced open monitoring are intended to manage and mitigate certain risks, such as:

• High risk of money laundering or terrorist financing.
• In any business relationship with a person established in a high-risk third country, or where either of the parties to the transaction is established in a high-risk third country.
• In relation to correspondent relationships with a credit institution or a financial institution.
• If a relevant person has determined that a customer or potential customer is a PEP, or a family member or known close associate of a PEP.
• In any case where the relevant person discovers that a customer has provided false or stolen identification documentation or information, and the relevant person proposes to continue to deal with that customer.
• In any case where:
• A transaction is complex or unusually large.
• There is an unusual pattern of transactions.
• The transaction or transactions have no apparent economic or legal purpose.
• In any other case which by its nature can present a higher risk of money laundering or terrorist financing.

In terms of PEPs, Regulation 35(1) of the MLRs requires both types of institutions to have in place appropriate risk management systems and procedures, to determine whether a customer or the beneficial owner of a customer is a PEP, or a family member or a known close associate of a PEP, and to manage the enhanced risks arising from the relevant person’s business relationship or transactions with such customer.

With respect to beneficial ownership-related requirements, both types of institution must identify the beneficial owners, take reasonable measures to verify their identity to a satisfiable extent; and, if the beneficial owner is a legal person, trust, company, foundation or similar legal arrangement, the institution in question should take reasonable measures to understand the ownership and control structure of that legal person, trust, company, foundation or similar legal arrangement as per Regulation 42-45(2),(9).

At first glance, there does not seem to be any differences here, both e-money institutions and banks are subject to the same requirements. However, e-money institutions are exempted from conducting CDD checks under Regulation 38(1) if, among other requirements:

• The maximum amount which can be stored electronically is €250, or (if the amount stored can only be used in the United Kingdom), €500.
• The payment instrument used in connection with the electronic money is not reloadable, or is subject to a maximum limit on monthly payment transactions of €250, which can only be used in the United Kingdom.

Essentially, this means that e-money institutions would not be required to conduct EDD, PEP, and beneficial checks for transactions that fall below this threshold.

Once again, a clear pattern emerges, with AML regulations being applied uniformly across e-money institutions and banks. Although there is an exception for e-money institutions, the niche market that these operators serve and the relatively low value of these exempted thresholds can be said to be commensurate with the risk they pose.

Bringing It All Together

Although AML requirements appear to be similar across all three jurisdictions, it is clear that the way in which they are applied to e-money institutions is directly affected by the role that these institutions have in the market.

In the UK, where e-money is still considered a niche product, the exception for small value payments is reflective of the regulators’ opinion that these operators still pose little risk. This, however, begins to change as e-money gains traction as a payment method. In Singapore, where e-money is immensely popular, the only difference between AML measures for banks and e-money institutions are specific provisions that deal with the much broader nature of the banking business.

Once e-money becomes a financial lifeline, as it is in the Philippines, even these exemptions seem to melt away, reflecting the importance regulators’ have placed on a payment method that has revolutionised the way people make payments.

For banks, the rise of e-money means little to no change in their AML regulation. However, e-money institutions in countries where it is gaining popularity may well find that the best indicator of future AML regulation is existing bank regulation.

By leveraging the existing compliance resources available to banks, not just for CDD but AML regulation as a whole, e-money institutions in countries where their role is still evolving may be able to anticipate and ensure compliance with these regulations.