Difficulties in Singapore Large Payment Institution (MPI) License Audit：MAS security requirements for system penetration testing

introduction：Why “penetration testing” is becoming a watershed moment for MPI audits

Against the backdrop of continued tightening of regulations on Singapore’s payment industry，Major Payment Institution, MPI) It is becoming more and more difficult to pass the audit based only on "complete system documents"。The focus of supervision has shifted from "do you have a system?" to "whether your system can withstand attacks?"。This is why in MAS (Monetary Authority of Singapore)，Monetary Authority of Singapore) in the regulatory context，System Penetration TestingBecoming one of the core items that is most likely to widen the gap in auditing。

Many companies are preparing for MPI license applications or annual review，Often the focus is on the business model、Fund isolation、Anti-money laundering procedures、Management appointment and other modules，But underestimated the complexity of the technical safety evidence chain。After actually entering the audit stage，Only then did I discover that the "test report is available"，It is not uncommon for the audit to fail。The reason is usually not that there is no test，RatherTest scope is incomplete、Method is not compliant、Insufficient rectification and closed loop、Governance responsibilities are unclear。

For cross-border payments being deployed、electronic money、For remittance business companies，Understand MAS’s expectations for penetration testing in advance，It’s no longer a “plus point”，But the "entry threshold"。

one、MPI audit logic from the perspective of MAS：Technology security is no longer the province of IT departments

1.1 Why MAS attaches great importance to penetration testing

MPI institutions are often involved in high-frequency trading、Massive personal data、Cross-border capital flows and multi-party system integration，Once a security breach occurs，The impact is not just business disruption，It may also trigger customer asset risks、data breach、Amplified money laundering risks，Even a crisis of trust in the market。therefore，MAS has a very clear regulatory approach to network security.：risk oriented、Verifiable、traceable、sustainable。

From the perspective of audit practice，MAS is not satisfied with “third-party testing”，But will pay attention to：

• Whether the test covers key assets and high-risk scenarios；
• Whether the testing method has industry recognition and independence；
• Is vulnerability rating objective?，Is there "downgrade processing"?；
• Whether the discovered problems are rectified within an acceptable time limit；
• Whether retesting has been completed after rectification and a closed loop of evidence has been formed。

1.2 Auditing is not focused on “single results”，But “security governance capabilities”

Many organizations mistakenly believe that penetration testing is a "report delivery" job，But auditing pays more attention to the governance process：who defines scope、who approves the plan、Who accepts the risk、Who will supervise the rectification?、who ultimately reports to the board of directors。This means that penetration testing has to do with an enterprise’s three lines of defense (business、risk compliance、Internal audit) must be cleared，Rather than staying within the technical team。

two、Six major difficulties faced by MPI institutions in penetration testing audits

2.1 Incomplete asset inventory：It is most common for test subjects to "slip through the net"

High-frequency issues in auditing are：The company tested the official website and main trading system，But missing the API gateway、Backend operation system、Cloud object storage、Third-party SaaS interface、Mobile H5 payment page, etc.。For MAS，Anything that affects the flow of funds、User data、Certification process system，In principle, they are all assets of high concern.。

Key recommendations：Establish a unified CMDB or minimum viable asset ledger，Priority stratification according to "business criticality + exposure + data sensitivity"，Ensure test coverage is interpretable。

2.2 Only do external network testing，No internal lateral penetration

Attacks don’t always happen from an Internet portal。Internal account stolen、Supply chain account has been abused、VPN configuration with weak passwords may also cause major incidents。If the penetration test lacks lateral movement verification "from low authority to high authority"，Audits often consider risk assessments incomplete。

Key recommendations：Use "external network attack surface + internal network privilege escalation path + identity permission model" as the linkage testing framework，Reflect real attack chain thinking。

2.3 The report is biased towards “technical language”，Missing compliance mapping

Many reports are written very technically，But what auditors need to see is：What regulatory obligations does this vulnerability affect? Whether it touches the protection of customer funds、Data confidentiality、Transaction integrity? If a report lacks business risk mapping，Audit communication efficiency will drop significantly。

Key recommendations：Add a "regulatory impact column" to the report，Align vulnerabilities with compliance lines such as data protection、Transaction monitoring、access control) directly corresponds to。

2.4 There is no time limit, classification and responsible person for vulnerability rectification

“We will fix it as soon as possible” does not hold true in an audit context。MAS pays more attention to whether high-risk vulnerabilities are handled within a clear SLA，Is there any exception approval?，Is there a risk acceptance mechanism and management signature?。

Key recommendations：Establish a grading time limit mechanism (for example, Critical/High/Medium/Low correspond to different rectification cycles)，and keep the work order、Change history、Retest report。

2.5 Third-party dependency risks are ignored

Payment institutions commonly use cloud services、KYC service provider、Risk control engine、SMS gateway and clearing channel。Even if the core system is secure，If there are weaknesses in the third-party interface，It may also become a springboard for invasion。Audits will focus on the adequacy of supplier security controls and contract terms。

Key recommendations：Incorporate third-party risks into annual testing plans，Conduct security assessment and abnormal traffic monitoring on at least key interfaces。

2.6 One-time “audit payable”，Lack of continuous testing mechanism

If testing is only done unannounced before the audit，often expose a large number of historical loopholes。MAS prefers to see continuity mechanisms：Regular testing、Retest after major changes、Instant assessment of critical vulnerabilities。

Key recommendations：Embed penetration testing into SDLC and change management processes，Do "pre-launch evaluation"、Verify after going online、"On-the-fly monitoring"。

three、MAS's core security requirements for system penetration testing (practical dismantling)

3.1 Test scope：Cover key business links instead of “spot testing”

Qualified MPI penetration testing typically requires coverage：

• User registration、Log in、Retrieve password、MFA process；
• top up、transfer、Withdraw cash、Refund、Funding processes such as reconciliation；
• Merchant backend、Operation background、Risk control background permission system；
• Open API、Webhook、Third-party docking interface；
• Mobile applications (iOS/Android) and H5 scenarios；
• Cloud environment configuration and identity access policy。

3.2 Test methods：Taking into account both automation and manual in-depth testing

Vulnerability scanning tools alone often fail to meet audit expectations。High-quality penetration testing should combine automated scanning with manual verification，Especially business logic vulnerabilities (such as unauthorized transactions、Risk control bypass、Repeat payment、Quota circumvention) requires manual scenario-based attacks to discover。

3.3 Test independence：Avoid "testing yourself"

Audits often question the objectivity of testing performed by the same development team。Enterprises can conduct testing through independent security teams or external professional organizations，and retain qualifications、Methodology and Conflict Disclosure Materials，to enhance credibility。

3.4 Completeness of evidence：traceable、Can be reviewed、Can be closed loop

MAS under audit，What really determines the outcome is often whether the chain of evidence is complete。It is recommended to prepare at least：

• Test plan and scope approval records；
• Test execution log、PoC screenshot、Impact statement；
• Vulnerability classification standards and risk review minutes；
• Rectification work order、Online change record、Signature of responsible person；
• Retest passing report and legacy risk acceptance document。

3.5 Management involvement：The board of directors and senior management must “get it”

Penetration testing is not a purely technical matter。The audit will focus on whether management receives regular risk reports、Whether to approve the major risk treatment plan、Whether to provide support for security budget and manpower。If governance is absent，No amount of technical work may be considered a "weak control environment"。

Four、How to build an “auditable” MPI penetration testing system

4.1 Establish an annual security testing roadmap

Divide the annual plan into baseline testing、Major version online retest、Supply chain special testing、Disaster recovery drill verification four layers，clear frequency、Responsible person、Budget and deliverables，Avoid pre-trial surprises。

4.2 Unified risk language：Technology vulnerabilities turn into compliance risks

Put CVE、Technical scores such as CVSS translate into business impact (probability of capital loss、Customer influence、Regulatory trigger level)，Make it compliant、internal audit、Boards understand priorities quickly。

4.3 Linkage between anti-money laundering and security control

in payment institution，Account takeover、Transaction tampering、Identity impersonation may amplify the risk of money laundering and fraud。Link security monitoring with AML transaction monitoring，Can significantly improve abnormal behavior identification capabilities，It is also more in line with the "comprehensive risk management" orientation of supervision.。

4.4 Use "rectify SLA + retest KPI" to drive execution

Merely identifying problems does not mean reducing risks。It is recommended to close high-risk vulnerabilities、Overdue rectification rate、Retest pass rate included in management KPI，and form a monthly review mechanism。

five、Real challenges for cross-jurisdictional payment institutions：How Singapore’s requirements synergize with Hong Kong’s compliance

Many payment companies are developing markets in Hong Kong and Singapore at the same time，A common pain point is the regulatory requirements of the two places、Audit language and material format are inconsistent，lead to duplication of investment。in practice，A more efficient way is to establish a "unified control framework + localized mapping" mechanism：Unified underlying security and internal control standards，Then add differentiated evidence based on local supervision.。

This is why more and more companies choose to rely on professional compliance consultants。Take 88MSO (88MSO), a team that has been deeply involved in Hong Kong financial licenses and cross-border compliance for a long time, as an example.，In the process of service companies going overseas，We usually help customers build transferable basic compliance capabilities first.，Then customize the implementation according to the requirements of Singapore or other jurisdictions，This reduces the cost of “doing it again every time you enter a market”。

six、Pre-audit self-check checklist (practical version)

• scope：Whether to cover the capital link、identity link、interface link、Operation and maintenance link?
• frequency：Is there a mechanism for regular testing and retesting of major changes?
• independence：Does the testing team have demonstrated objectivity and qualifications?
• Grading：Are vulnerability rating criteria consistent and interpretable?
• Rectify：Is there an SLA?、work order、Responsible person、expiration date?
• Retest：Have high-severity vulnerabilities been retested and there is evidence of closure?
• governance：Has management reviewed and approved major risk dispositions?
• third party：Are critical vendor interfaces included in the security assessment?

Conclusion：The nature of MPI auditing，It is to turn "security capabilities" into "supervisory verifiable capabilities"

Competition for MPI license in Singapore，We are shifting from “business growth speed” to “compliance resilience depth”。Why penetration testing is difficult，It doesn’t matter how complex the technology itself is，Rather, it requires companies to use technology、Safety、Compliance、Governance truly connects。Only if the test scope is complete、Method expertise、Evidence closed loop、management involvement，The audit will treat you as a "sustainably regulated institution"。

For teams planning to operate cross-border payment business in the long term，The sooner we establish systematic security governance，The more you can apply for a license、annual review、Take the initiative in external reviews and partner due diligence。It's not just about passing an audit，It is also for stable expansion in the era of high regulation.、Steady growth。

Technical controls should be explained together with payment business processes

Preparing for SingaporeLarge Payment Institution (MPI)When license audit is difficult，An account should be opened、Payment instructions、Authentication、capital flow、Refund、Reconciliation and abnormal transactions are drawn step by step，Then indicate the system used at each step、Personnel authority and outsourcing services。Regulatory review looks beyond penetration testing reports，It will also check whether the discovered problems have been graded、Fix and retest。

Application and ongoing compliance information should cover governance、suitability of person in charge、Customer fund protection、Anti-money laundering、technology risk、incident response、business continuity、Third Party Risk and Regulatory Reporting。System scope must be consistent with the real production environment；Important version、Cloud service or key vendor changes should also go into change approval and risk assessment。

Read more：European EMI license application comparison：Lithuania、Estonia、Cyprus、Which Poland is more suitable for you?、Singapore bank account opening：DBS、Comparison of audit requirements between OCBC and UOB。