MAS PS-G04: what your annual audit will now test, and how to evidence it

Executive takeaway

• For financial years ending 31 December 2026 onwards, every payment service licensee's annual audit follows MAS Guidelines PS-G04: one auditor covering the audited accounts, the Independent Assurance Report and the management letter, all filed with Form 4 within six months of year-end.
• The audit now has a defined floor: three baseline risks, five areas tested every year, and annual coverage of whatever the auditor assesses as higher risk.
• Auditors must report serious breaches to MAS immediately, and the firm's own duty to notify MAS stands separately.
• The practical question for boards: can management evidence that controls operated through the year, before fieldwork starts?

What is MAS PS-G04 and when does it apply?

The Monetary Authority of Singapore (MAS) issued the Guidelines on Audit of Payment Service Providers (PS-G04) on 16 July 2026, under section 37 of the Payment Services Act 2019 (PS Act) read with Regulation 20 of the Payment Services Regulations 2019.

The guidelines apply to every holder of a payment service licence: standard payment institutions, major payment institutions and money-changing licensees, including sole proprietors who hold a money-changing licence. PS-G04 provides general guidance; it does not replace or override the legislative provisions.

The annual audit requirement sits in section 37 of the PS Act, and Regulation 20 of the PS Regulations sets out how the audit report is submitted: in Form 4, within six months of financial year-end for a company, stating the auditor's name and contact details and signed by the auditor. MAS expects each firm to apply the guidelines in proportion to the risk and complexity of its business and the products and services it offers.

PS-G04 takes effect for annual audits of financial years ending 31 December 2026 onwards. For a December year-end, the first Form 4 submission under the guidelines is due by 30 June 2027; a firm with a later year-end is caught from its first financial year ending on or after 31 December 2026. Audits of earlier financial years continue to use the existing Form 4. MAS has stated that the revised Form 4 will be available on MAS-Tx in the second quarter of 2027, and a specimen is already published.

What does the single-auditor requirement mean for boards and management?

One auditor, one integrated view. The same auditor covers the accounts, the regulatory data and the controls in a single cycle. In our view, inconsistencies between what a firm reports to MAS, what it records and what its controls actually do are more likely to surface together, in the one management letter that MAS says it will consider in assessing the firm's control framework.

Expect DPT and other higher-risk services to be tested every year. Areas the auditor assesses as higher inherent risk should sit within the audit scope every year; PS-G04 gives cross-border money transfers, DPT services and significant outsourcing arrangements as examples. New products, services, markets and systems should also be audited on a timely basis, while lower-risk areas may be sampled on rotation, for example once every two to three years. In setting coverage, the auditor takes into account the firm's business model, emerging risks such as new money laundering typologies, and the MAS instruments that apply. Our view: for DPT service providers, rotation is unlikely to be the default position.

No surprises for MAS. Under section 37(9) of the PS Act, an auditor who is satisfied in the course of its duties that any of five matters has occurred must report it to MAS immediately: a serious breach or non-observance of the PS Act, or of requirements under other written law administered by MAS; a criminal offence involving fraud or dishonesty; losses that reduce the firm's capital by at least 50%; an irregularity that has or may have a material effect on the accounts, including one that caused major disruption to a payment service; or an inability to confirm that creditors' claims are still covered by the firm's assets. PS-G04 gives examples of serious breaches: customer monies not properly segregated or safeguarded, base capital below the minimum, regulated activity conducted without a licence, and changes in controllers, board or CEO without MAS's prior approval. Systemic and severe gaps in risk management and controls should also be reported immediately. The firm's own duty to notify MAS on discovering such a matter is separate, and MAS has stated it will take supervisory action where a firm fails to notify immediately. The practical test: management should know about a breach, and have told MAS, before the auditor finds it.

Remediation is judged, not just tracked. MAS will take into account whether the firm self-identified control gaps, how receptive management was to the issues raised, and how proactively it remediated them. Remediation of findings from prior external audits and MAS inspections is itself a mandatory annual audit area. The revised Form 4 asks the auditor to report, by scope area, the number of findings raised, the number repeated from the prior year and the number still outstanding, with root causes.

New licences and newly licensed services get an end-to-end review. One year after a new licensee starts operating, or after a licensee launches a newly licensed payment service, the auditor is expected to perform an end-to-end review of the adequacy and operating effectiveness of its ML/TF and technology risk controls, with the findings submitted in Form 4. The AML/CFT review covers nine areas, from the enterprise-wide risk assessment, compliance arrangements and customer due diligence through screening, monitoring, value transfers and record keeping to suspicious transaction reporting and governance oversight. The technology review covers up to twelve areas where relevant, from cyber hygiene practices and technology risk governance through IT resilience and access control to cryptography, online financial services, and data and infrastructure security. MAS's own worked example: a firm with a 31 December year-end that commenced operations on 1 September 2026 has the review performed in its audit for the year ending 31 December 2027, with Form 4 due by 30 June 2028. After the first-year end-to-end review, AML/CFT controls should be reviewed every year; for both AML/CFT and technology risk, areas of higher inherent risk or past inadequacies or breaches should be tested annually, lower-risk areas may rotate, and auditors should consider risk-targeted rather than random sampling.

What will the auditor test, and what evidence should firms prepare?

Beyond the baseline and mandatory areas, PS-G04 expects firms to give the auditor, on a timely basis, information that includes its business model and customers; regulated and exempted products, with the controls that keep exemptions valid; licence conditions and directions; breaches, fines and regulatory actions; outstanding internal audit, external audit and inspection findings; and the latest enterprise-wide risk assessment (EWRA), committee minutes and gap analysis.

The evidence column below is our view of what an auditor is likely to ask for; it is not part of the guidelines.

What eight questions should management answer before fieldwork starts?

1. Have we appointed one suitably qualified auditor for the accounts, the Independent Assurance Report and the findings, early enough for a Form 4 deadline six months after year-end?
2. Can we give our auditor, on a timely basis, the information PS-G04 lists: breaches, outstanding findings, the latest EWRA, committee minutes and gap analysis?
3. For each of the five mandatory areas, can we show that controls operated throughout the year, not only at year-end?
4. Does our EWRA reflect the business we run today, including new products, corridors and service providers?
5. Are prior audit and MAS inspection findings closed with evidence, or only marked as closed?
6. Would we identify a serious breach, and notify MAS, before our auditor did?
7. Where controls sit with outsourced or group service providers, can we obtain the evidence our auditor will need?
8. If we are newly licensed, or launched a newly licensed payment service this year, is the end-to-end review scheduled into the right annual audit, per MAS's worked example?

Illustrative timeline for a 31 December 2026 year-end

The sequence below is illustrative; actual timing depends on each firm's audit plan.

• Now to 31 December 2026: confirm the auditor and scope, assemble the information PS-G04 says the auditor should receive, and close open findings with evidence.
• January to March 2027: support fieldwork, answering evidence requests from records that already exist rather than ones created for the audit.
• April to June 2027: agree findings and management responses, then submit Form 4 on MAS-Tx with the audited accounts, Independent Assurance Report and management letter by 30 June 2027.

How RSM can help

RSM Singapore's Digital Assets practice supports payment service providers, including DPT service providers, through the PS-G04 cycle: readiness assessments against the baseline and mandatory areas, AML/CFT and technology risk control reviews, and preparation for the first-year end-to-end review.

All engagements are subject to professional independence requirements. Where RSM is a firm's auditor, we provide other support only where those requirements allow.

This article is general information, not legal, regulatory, tax or investment advice; seek tailored professional advice for your circumstances. It reflects PS-G04 as issued on 16 July 2026.

For more information, get in touch with our specialists

Kendrick Choo

Associate Director, Technology Consulting

E: KendrickChooXH@rsmsingapore.sg 

Christopher Neo

Manager, Digital Assets Advisory

E: ChristopherNeo@rsmsingapore.sg