Preparing for MAS PS-G04 Annual Audit: How PSPs Can Get Audit-Ready
The Monetary Authority of Singapore (MAS) has raised the bar for annual audits of payment service providers (PSPs) through the new PS-G04 Guidelines on Audit of Payment Service Providers, effective 16 July 2026. The guidelines provide greater clarity on MAS audit expectations, mandatory audit coverage areas and the responsibilities of both PSPs and external auditors. [PS-G04]
For many PSPs, the annual audit is no longer simply a regulatory filing exercise. It has become a comprehensive assessment of governance, compliance, risk management, internal controls, safeguarding arrangements, AML/CFT frameworks and technology risk management. [PS-G04]
As an internal audit service provider, Waystone can help PSPs prepare proactively for MAS PS-G04 annual audit requirements, identify gaps before the external audit begins, and strengthen their control environment throughout the year.
What PS-G04 Changes Mean for Payment Service Providers
Under the Payment Services Act and Payment Services Regulations, every licensed PSP must:
- Appoint an external auditor annually
- Submit Form 4 within six months after financial year-end
- Provide audited financial statements
- Submit an Independent Assurance Report
- Submit the auditor’s findings, observations and management letter.
The guidelines make clear that MAS expects audits to go beyond financial statements and assess:
- Compliance with regulatory requirements
- Adequacy of risk management frameworks
- Effectiveness of internal controls
- Implementation of remediation plans for previously identified issues.
MAS PS-G04 Audit Scope: Key Areas Auditors are Expected to Review
MAS expects annual audits to be risk-based and proportionate to the nature, size and complexity of the PSP’s business. However, all PSPs are expected to maintain robust frameworks to manage key risks, particularly:
1. AML/CFT Controls and Financial Crime Risk Management
Auditors are expected to assess controls that address money laundering and terrorism financing risks, including:
- Enterprise-wide risk assessments
- Customer due diligence (CDD)
- Name screening
- Transaction monitoring
- Suspicious transaction reporting
- Record keeping
- Governance and oversight.
2. Safeguarding of Customer Monies and Customer Assets
A mandatory audit area for all PSPs is the safeguarding of relevant monies and customer assets. Auditors will review whether safeguarding arrangements comply with applicable Payment Services Act requirements.
3. Base Capital Compliance
PSPs must demonstrate ongoing compliance with minimum capital requirements and maintain adequate financial resources.
4. Technology Risk Management and Cyber Resilience
Technology and cyber risk remain key regulatory priorities. Areas expected to be reviewed include:
- Cyber hygiene
- Access management
- IT resilience
- Security operations
- Data and infrastructure security
- Technology governance
- Software development lifecycle controls.
5. Accuracy and Completeness of MAS Regulatory Reporting
Auditors are expected to verify the accuracy and completeness of information reported to MAS, including applicable PSN04 submissions.
6. Remediation of Prior Findings
MAS specifically expects auditors to assess whether issues identified in previous audits or inspections have been appropriately remediated.
Additional PS-G04 Expectations for Newly Licensed PSPs
PS-G04 introduces additional requirements for:
- Newly licensed PSPs
- Existing PSPs launching newly licensed payment services.
One year after commencement of operations (or commencement of the new payment service), an auditor is expected to conduct an end-to-end review of:
- AML/CFT controls
- Technology risk management controls.
These reviews are expected to evaluate both design adequacy and operating effectiveness through testing and sample reviews.
Why PSPs Should Start Preparing for the MAS PS-G04 Audit Early
Preparing early is important because PS-G04 requires PSPs to be able to evidence not only that relevant controls exist, but that they are properly documented, consistently performed and supported by clear audit trails. In practice, this means PSPs should review the information auditors are likely to request well before the annual audit process begins.
The guidelines require PSPs to provide auditors with extensive information, including:
- Business model and customer profile.
- Products and services offered.
- Licensing conditions.
- Regulatory breaches and supervisory actions.
- Outstanding audit findings.
- Enterprise-wide risk assessments.
- Governance committee materials.
- Previous gap assessments.
In practice, many audit observations arise not because controls are absent, but because:
- Documentation is incomplete.
- Evidence is not readily available.
- Controls are inconsistently performed.
- Regulatory changes have not been fully implemented.
- Previous findings have not been adequately tracked or closed.
An independent internal audit review can help address these issues before the annual external audit begins.
How Waystone can Support MAS PS-G04 Audit Readiness
Waystone’s Internal Audit team supports PSPs in assessing audit readiness, strengthening governance and control frameworks, and addressing key PS-G04 focus areas including AML/CFT controls, safeguarding arrangements, technology risk management, cyber resilience, operational resilience and remediation planning.
Our core services include:
| Support Area | What Waystone Can Review | Outcome for PSPs |
|---|---|---|
| Audit readiness assessments | MAS PS-G04 expectations, control gaps, documentation gaps and evidence gaps before external auditors arrive. | Better preparation for the annual external audit and clearer visibility over priority issues. |
| Gap analysis against PS-G04 requirements | Policies, procedures and control frameworks against PS-G04 Guidelines, Payment Services Act requirements, MAS Notices and Guidelines, and industry leading practices. | A practical remediation roadmap, prioritised by risk, regulatory impact and audit readiness. |
| AML/CFT internal audits | Enterprise-wide ML/TF risk assessments, customer onboarding, sanctions screening, transaction monitoring, suspicious transaction reporting, governance and oversight. | Stronger alignment with PS-G04 focus areas and improved evidence of AML/CFT control effectiveness. |
| Technology risk reviews | Technology governance, cybersecurity controls, access management, IT resilience, business continuity, outsourcing oversight and MAS Technology Risk requirements. | Better visibility over technology and cyber risks, particularly for digital payment, remittance and online financial service providers. |
| Remediation validation | Corrective actions, operating effectiveness, remediation evidence and progress against previous audit or MAS review findings. | Clearer demonstration of remediation progress to regulators and external auditors. |
| Ongoing internal audit programmes | Risk-based internal audit planning and continuous assurance throughout the year. | Stronger Board and management oversight, with compliance treated as an ongoing discipline rather than an annual exercise. |
The new PS-G04 Guidelines signal MAS’ expectation that PSPs maintain mature, well-documented and demonstrably effective risk management and control frameworks. Annual audits are increasingly focused not only on compliance, but also on the effectiveness of governance, AML/CFT controls, safeguarding arrangements and technology risk management.
By conducting independent internal audit reviews before the annual external audit, PSPs can identify weaknesses early, strengthen remediation efforts, improve audit outcomes and demonstrate a proactive compliance culture to MAS.
Questions?
If you would like to discuss how the MAS PS-G04 Guidelines may affect your organisation, or how Waystone can assist with audit readiness planning and implementation support, please contact your usual Waystone representative or get in touch with our APAC Compliance Solutions team below.