The travel rule, AML, and why exchanges ask for papers

A licensed digital payment token platform in Singapore will, at some point, ask you for a photograph of your identity card, a bank statement, a story about where the Singapore dollars came from, and — if you are sending tokens out — information about the person or the wallet on the other end. The request feels like friction. It is supposed to. The Monetary Authority of Singapore did not license these firms so they could onboard a customer with a nickname and a QR code.

This briefing explains the two families of rules behind the friction: ordinary customer due diligence, and the FATF “travel rule” that makes information travel with a value transfer. It is not a recommendation to use any platform, to withdraw, or to move funds into a bot that does not ask. For the licence that makes a firm a payment institution in the first place, see the Payment Services Act explained. For how digital payment tokens sit inside that statute, see how MAS regulates digital payment tokens. The rest of the stack lives in the regulation hub.

AML is a duty, not a mood

Anti-money laundering and countering the financing of terrorism (AML/CFT) rules exist because a payments business is a pipe. Tokens move quickly. They cross borders without a correspondent bank in the middle. A firm that does not know its customer is a pipe with no label.

MAS Notice PSN02 is the notice that applies to holders of a payment services licence who provide a digital payment token service. It is not a vibe. It tells the firm when it must identify a customer, what it must collect, when it must look again, and when it must file a suspicious transaction report rather than pretend a pattern is a personality.

Customer due diligence, in the notice’s outline, is triggered when the firm establishes a relationship, when it undertakes a transaction for someone who is not already a customer, when it sends or receives a DPT value transfer for such a person, when it suspects money laundering or terrorism financing, or when it doubts the papers it already has. Anonymous and fictitious accounts are prohibited. If two small transfers look like one large transfer cut up to dodge a check, the firm is supposed to add them together.

For a natural person the minimum is ordinary and intrusive: full name, unique identification number, residential address, date of birth, nationality — and verification against reliable independent sources. For a company it is longer: incorporation numbers, addresses, the purpose of the vehicle, the people who own or control it. Beneficial owners are not a footnote. They are the point.

Ongoing monitoring is the part customers meet as a sudden, late request. A pattern that does not match the profile — a quiet account that starts pushing large value to new addresses, a source of funds that no longer matches the declared job — is supposed to produce questions. The questions are not an accusation. They are the firm doing the job the notice describes. Refusing to answer can mean the firm declines the transaction or the relationship. That is a permitted outcome, not a glitch.

A Telegram bot that asks for nothing is not “efficient”. It is unsupervised. The absence of papers is not a feature you have won. It is a fact about who, if anyone, will still be there when the transfer cannot be undone.

Source of funds is a sentence, not a vibe

“Source of funds” is the story of this money or these tokens. “Source of wealth” is the longer story of how the customer came to have resources at all. Firms ask for the first more often, and for the second when the risk is higher — a politically exposed person, a high-value relationship, a pattern that does not match the profile.

The evidence is boring on purpose. A salary credit. A sale of a flat. An inheritance with a document. A company dividend. What the firm is trying to avoid is the circular answer: the tokens came from another platform, which got them from another platform, which got them from a chat. Circular answers are how proceeds become “crypto”.

Customers sometimes hear the request as moral judgement. It is not. A teacher who sold an HDB and is moving a conservative amount through a licensed app, and a person who cannot explain a six-figure on-chain pile, are both being put through a process. The process is allowed to end in “no”. This newsroom will not tell either person what they should do with the tokens. We will say that a licensed firm which never asks is a licensed firm that is not reading its notice.

Enhanced due diligence — more documents, more senior approval, more frequent review — is supposed to apply where the risk is higher. It is a slower door, not a VIP lounge.

The travel rule

Information that is supposed to move with the coins

The Financial Action Task Force’s Recommendation 16, applied to virtual assets, is the “travel rule”. In plain English: when a regulated virtual-asset service provider sends tokens on behalf of a customer to another such provider, it must transmit specified originator and beneficiary information with the transfer, securely and at the same time. The receiving firm is supposed to be able to screen that information. Investigators are supposed to be able to follow it later.

MAS implements that idea for DPT service providers in PSN02. When a value transfer goes between regulated DPT platforms, the originating firm must send originator and beneficiary information to the beneficiary firm, concurrently or simultaneously, in a secure manner. The point is not theatre. It is (a) something to screen and (b) a trail.

That is why a withdrawal that used to be “paste address, press send” now comes with extra fields: who is the beneficiary, are they you, what is the other platform? It is also why a transfer between two licensed firms can take longer than a transfer to an address you control. The delay is often messaging and screening, not a miner.

Transfers to or from an unhosted wallet — a hardware device, a mobile self-custody app, an address that is not hosted by a regulated firm — sit outside the tidy platform-to-platform case. MAS supervisory expectations have been explicit that these transfers need extra risk mitigation. Firms have responded with first-party-only rules, and with tests that the customer actually controls the address: a small “satoshi test” payment, a signed message, a video session that shows the wallet. Those tests are annoying. They exist because an unhosted address does not come with a counterparty firm that can be asked for the beneficiary’s papers.

A firm that refuses a withdrawal to an address you cannot prove is yours is not “anti-self-custody” as a philosophy. It is applying a higher-risk treatment to a transfer that does not carry a travel-rule packet. Whether you accept that treatment is a personal operational decision. This article will not complete it.

Why a Telegram bot does not ask — and why that is the story

An unlicensed bot, a peer-to-peer chat, a cloned app, or an offshore venue that has never accepted Singapore supervision can onboard you with a username. It can take your tokens and send them on with no originator packet. It can disappear. It can also be the last hop in a romance scam or a fake recovery room.

The contrast is the education.

A licensed Singapore platform asks for papers because Notice PSN02, the travel rule, and ordinary CDD require a recorded customer, a risk assessment, ongoing monitoring and, for value transfers, information that travels. It must keep records. It must be able to file a suspicious transaction report. It must not tip the customer off that a report has been filed. It must train staff. It must have someone who owns compliance.

A bot asks for nothing because nobody who can revoke a licence is looking at the bot. That is attractive if you dislike paperwork. It is also how proceeds move. This desk will not tell you that every quiet venue is criminal. We will tell you that the absence of a document request is not evidence of a better product. It is evidence of a different perimeter.

Licensed platforms are also the venues that must refuse retail credit-card purchases, refuse leverage, and refuse incentives to trade. The same licence that slows your withdrawal is supposed to slow the gamified half of the industry.

What a reasonable request looks like — and what it does not

A reasonable request, from a firm you already chose:

• Identity documents that match the account name.
• A proof of address that is not a decade old.
• A source-of-funds document that matches the size and the story.
• Beneficiary details on a withdrawal, or a control test for an unhosted address.
• A pause while screening runs.

An unreasonable request, which is to say a request that should make you stop and change channels:

• Your seed phrase, “for travel-rule compliance”. Travel-rule compliance does not require the words. Phishing does.
• A transfer to a personal address “so we can whitelist you for FATF”.
• A document upload to a domain that is not the firm’s published domain.
• A caller who already knows your ticket number and wants a screen share.

If you did not choose the firm — if the request arrived in a chat from someone who found you — you are not in a CDD process. You are in a script.

Papers are not a quality stamp

Handing a licensed firm your NRIC does not make the token conservative, the platform solvent, or the withdrawal instant. It makes the relationship legible. Legibility is what a supervisor, a liquidator and, later, an investigator can use. It is also personal data, and it should be treated as such: send it only to the entity you meant to onboard with, through the channel that entity published.

A firm that asks, explains, and records is doing the job Singapore assigned to payment institutions that deal in digital payment tokens. A venue that never asks is doing a different job, or no job. For the statute that creates the institution, stay with the Payment Services Act explainer. For the token perimeter, stay with how MAS regulates digital payment tokens. For the rest of the map, stay at the regulation hub.

Nothing here is an invitation to open an account or to send documents to a stranger. A description of why papers exist is not advice to provide them.