How to draft an Enterprise-Wide Risk Assessment for Singapore Payment Institution License

• For payment institutions in Singapore, understanding and managing business risks is an important part of building a strong compliance framework.  

• A well-prepared Enterprise-Wide Risk Assessment Singapore EWRA helps you identify financial crime, technology, operational and business risks before you apply for a payment institution license. 

• Money Authority of Singapore expects applicants to understand their business model, customer base, products, jurisdictions, transaction flows and control systems. Under the Payment Services Act 2019, businesses providing regulated payment services in Singapore generally need a license unless an exemption applies.  

• If you are planning to set up a company in Singapore, preparing your EWRA early can also help you build your compliance framework alongside your business structure, especially once you move from incorporation to licensing after following all steps to set up a new company in Singapore.  

What is an EWRA? 

Quick Answer:  

• An Enterprise-Wide Risk Assessment, or EWRA, is a written document that identifies the risks faced by your entire payment business. It explains how you will measure these risks, what controls you will use, and how senior management will monitor the remaining risk. 

• For a payment institution applicant, the document should cover money laundering and terrorism financing risks, customer risks, product risks, geographical risks, delivery-channel risks, transaction risks, technology risks and operational risks. It should also explain how your business will assess proliferation financing and tax-evasion risks where relevant. 

• You should prepare the EWRA before submitting your license application because it supports your business plan, AML/CFT framework, and compliance arrangements. 

What should your EWRA include? 

• When preparing an EWRA Singapore document, you need to create a clear and repeatable process. Avoid preparing a general document that only says your business has “low risk.”  

• MAS expects practical explanations supported by business information and evidence. 

• Here are few things that you must include in your EWRA:  

Explain your business model 

• Begin by describing what your company will do. You should explain: 

• The payment services you intend to provide. 

• The customers you will serve. 

• The countries from which customers may come. 

• The currencies and payment methods you will accept. 

• The technology and platforms you will use. 

• The banks, payment processors, agents, and other third parties involved. 

• MAS expects applicants to provide a detailed fund-flow plan. Your diagram should show how money enters the system, how it moves between parties, and how the transaction ends.  

• For example, if you provide cross-border money transfer services, show the sender, your Singapore entity, the banking partner, the overseas payment partner and the final recipient. 

Identify inherent risks 

• Inherent risk means the risk that exists before you apply any controls. You should assess each major risk category separately. 

• These are the risks that can arise and few questions that you need to ask yourself:  

Risk area	Questions you should ask
Customer risk	Who are your customers? Will you serve companies, individuals, high-net-worth customers or politically exposed persons?
Product risk	Does the service involve remittance, e-money, digital payment tokens, or merchant payments?
Geographic risk	Do customers or counterparties come from countries with high financial-crime risks?
Transaction risk	Will transactions be frequent, large, fast, or difficult to trace?
Delivery-channel risk	Will you onboard customers remotely or through agents?
Technology risk	Could system failure, cyberattacks, or weak access controls affect customers?
Third-party risk	Do external providers process payments, conduct screening, or store customer data?

• Practical Takeaway: You can use a scoring system, such as one to five. However, you must explain why you selected each score. Your assessment should use available data about customers, products, transactions, countries, and delivery channels. If reliable data is not yet available because your company is new, clearly state this limitation and explain how you will improve the data after launch. 

Review your control environment 

• After identifying the inherent risks, assess the controls that will reduce them. Your controls may include: 

• Customer identification and verification. 

• Beneficial owner checks. 

• Sanctions, PEP, and adverse media screening. 

• Customer risk classification. 

• Transaction monitoring. 

• Suspicious transaction reporting. 

• Staff training. 

• Independent compliance testing. 

• Cybersecurity controls. 

• Incident-response procedures. 

• Customer-money safeguarding arrangements. 

• Vendor due diligence. 

• Complaint handling procedures. 

• Practical Takeaway: Do not only describe whether a policy exists. You should assess whether the control is properly designed and whether it will work in practice.  

• The MAS licensing guidelines require applicants to have compliance arrangements and resources that match the nature, size and complexity of their business.  

Calculate residual risk 

• Residual risk is the risk that remains after applying your controls. You should prepare a table showing: 

• Inherent risk score. 

• Main controls. 

• Control effectiveness. 

• Residual risk score. 

• Risk owner. 

• Action required. 

• Target completion date. 

• For example, your company may identify remote onboarding as a high inherent risk. Strong identity verification, liveness checks, sanctions screening and manual review may reduce the residual risk to medium. The EWRA should then explain why the risk is acceptable and what additional monitoring is required. 

How does EWRA differ from traditional risk assessment? 

• A useful enterprise risk assessment for payment institutions should cover the whole company instead of focusing on one department. It should connect compliance risks with technology, operations, finance, and governance. 

• Here is a table showing the major points of difference between traditional and enterprise-wide risk assessment so that you can make informed decisions.  

Traditional risk assessment	Enterprise-wide risk assessment
Usually focuses on one process or department.	Covers the entire company, including group entities and outsourced functions.
May rely mainly on written policies.	Tests policies, procedures, data, and actual control performance.
Often reviews risks separately.	Links to customer, product, geography, transaction and technology risks.
May be prepared as a one-time document.	Must be reviewed and updated when the business or risk profile changes.
May not assign clear accountability.	Gives each risk an owner, deadline and reporting path.

• For a Singapore payment institution applicant, the EWRA should match the proposed business plan. 

How should a company conduct the assessment? 

• Consider an imaginary company called SwiftPay Pte. Ltd. It wants to provide cross-border money transfer and merchant acquisition services in Singapore. 

• Here is how to draft an EWRA in Singapore for SwiftPay: 

• SwiftPay first confirms that its proposed activities are regulated payment services under the Payment Services Act. It then checks whether it needs an SPI or MPI license based on its expected transaction volume and services. 

• The company documents its business model. It lists its customer types, target countries, currencies, payment channels, banking partners, merchants, and technology providers. 

• SwiftPay prepares separate transaction-flow diagrams. One diagram shows a customer sending money from Singapore to another country. The second shows a merchant receiving payment through SwiftPay’s platform. 

• The compliance team identifies risks connected with customers, products, countries, transactions, remote onboarding, merchants, and outsourced service providers. 

• The company collects available data. This includes expected customer numbers, projected transaction values, average transaction size, customer locations, merchant categories, and expected transaction frequency. 

• SwiftPay assigns a risk score to each category. It rates cross-border transfers and remote onboarding as high risk because they may involve overseas customers and rapid movement of funds. 

• The company documents its controls. These include identity verification, beneficial-owner checks, sanctions screening, merchant due diligence, transaction monitoring, and escalation procedures. 

• SwiftPay tests whether the controls are practical. It checks sample alerts, reviews onboarding records, and confirms that its screening system can identify sanctions and PEP matches. 

• The company calculates residual risks. Any high residual risk is assigned to a senior manager, who must approve additional controls or decide whether the risk is acceptable. 

• The board or senior management reviews and approves the EWRA. The final document includes an action plan, responsible persons, and deadlines. 

• SwiftPay connects the EWRA to its compliance manual, business plan, AML/CFT policy, and technology-risk framework. 

• After launching, SwiftPay reviews the assessment when it introduces a new product, enters a new country, changes a major vendor or experiences a material incident. 

How Tetra Consultants can help you 

• Tetra Consultants assists international clients with company formation and licensing support in Singapore. Its Singapore business expansion service includes incorporation with ACRA, registered-office support, nominee director services, corporate bank-account assistance and employment-pass support. 

• Tetra Consultants can help you in company incorporation in Singapore and complete the incorporation process with ACRA. 

• The team can help prepare your business plan, funds-flow documents, AML/CFT policies, and EWRA for a payment institution license. 

• It can also assist with communication with MAS and coordinate related compliance, banking, and corporate services. 

• You can also explore Tetra Consultants Financial License Application services for support with licensing requirements and applications. 

Conclusion 

• A strong EWRA is important for fintech businesses, remittance companies, e-money issuers, merchant-acquiring businesses and digital-payment-token providers seeking a Singapore payment institution license. 

• You should prepare it around your actual business model, support it with data, and connect it to your policies, controls, and governance structure. 

• If you need help with incorporation, compliance documents or a Singapore Payment Institution License risk assessment or application, professional support can make the process more organized and reduce avoidable gaps.  

• Contact us and our team will revert back in 24 hours.  

FAQs