The Law of the Land — Crypto Regulations in Southeast Asia

Published in

Saison Thinking

18 min readJul 14, 2022

The TL;DR

No conversation about cryptocurrencies would be complete without an eye on Centralised Finance (CeFi). The transition from Web 2 to 3 requires any newcomer to interact with on and off ramps, exchanges, custodial wallets and more CeFi services.

As cryptocurrencies explode into mainstream awareness, the risks it presents and the role of regulation in protecting new users also grow significantly more important. To build a truly accessible and useful crypto ecosystem, we must identify, address and mitigate risks to release its potential in making financial products that truly meet the needs of people across Southeast Asia — and beyond.

Cryptocurrencies have gained in popularity but so has the number of use cases and utilities assigned to them. Decentralised Finance (DeFi) emerged from the blockchain boom as a whole ecosystem of services that offer an alternative to traditional mainstream finance. Instead of relying on a single, centralized party to hold and manage assets, code known as ‘smart contracts’ automatically execute tasks using tamper-proof blockchain technology to record the transaction.

However, with great power comes great responsibility. Early cryptocurrency projects and other DeFi products were sometimes used for nefarious or exploitative purposes. Afraid of the unknown threats DeFi could pose, some policy-makers banned it outright. As the industry has matured, so too has the regulatory response. Across Southeast Asia, and the world, most governments and financial institutions now take a cautious approach to policing, taxing and limiting the capabilities of DeFi products to protect consumers and prevent illicit activity.

Although DeFi is seen as a bigger threat to be regulated, CeFi has not been let off the hook either. Increasingly, around the world, regulators are finding ways to build new regulatory frameworks or adapt existing ones to regulate CeFi services, which can sometimes be challenging in this nascent space.

It can be difficult to track progress in such a fast-moving industry, so we’ve summarised our knowledge and findings on the evolving regulatory landscape in Southeast Asia, including current policy and regulatory attitudes, characteristics and limitations. We take a brief but deep dive into each country to assess their national approach to regulation, how they are policing it and what this has meant for adoption and evolution in CeFi products, services, and the ecosystem at large.

This report is not intended to be a legal opinion to define what is and isn’t allowable in Southeast Asia, but rather a guiding framework to allow entrepreneurs and other players in the ecosystem to better understand both the limits and the opportunities that regulation offers. We hope to spark further conversation on what progressive regulation could look like, and meet the needs of both buidlers and hodlers.

The regulation imperative

While innovations in the blockchain and crypto industry bring benefits across attractive products, increased accessibility and improved transparency, risks are aplenty too. New research from blockchain forensics firm Chainalysis revealed that money laundering in crypto grew from $6.6 billion to $8.6 billion between 2020 and 2021, while laundering in the DeFi sector grew over 20x.

DeFi has emerged to be a hotspot for illicit activity, and regulators across the world — Southeast Asia not excluded — have begun actively studying the risks. The sudden surge in cryptocurrency popularity and mass adoption has demanded a timely response, as there is growing interconnectedness between crypto and the mainstream financial system.

For financial regulators in the region, there is a growing emphasis on increasing protection for retail investors, as well as ensuring the safety, stability and efficiency of financial services in both the fiat and cryptocurrency worlds. Like fiat markets, regulators have to find a balance between protection and intervention versus the free market. Unlike fiat markets, however, regulators also need to apply a lens of what is practical and pragmatic in regulation, given the often-anonymous, distributed nature of cryptocurrencies. In the world of traditional finance where transactions are rarely anonymised and central bodies like banks and interchanges can quickly intervene, the cryptocurrency industry poses a newfound challenge for regulators.

To understand the regulatory landscape in the region, we have selected the Hong Kong Monetary Authority’s framework on policy options to understand nuances:

Figure 1: Possible policy options for regulating crypto-assets. Source: Hong Kong Monetary Authority

Southeast Asia has broadly not recognised cryptocurrencies as legal tender, but have instead considered them as commodities or digital assets. Among the countries, Singapore has been regarded as the preeminent jurisdiction for crypto, although recent regulation crackdowns in the city-state have been unwelcoming for crypto companies and entrepreneurs. The other countries, however, are not resting on their laurels, and have publicly taken steps to express their intent to regulate crypto-economic activity.

Governments in Southeast Asia have launched or are planning to launch central bank digital currencies (CBDC). Cambodia has launched its own called Bakong, while Indonesia’s central bank has announced that it has intentions of launching one of its own as well.

In this section, we’ll look at key interest-based regulatory rules in up-and-coming hubs in Southeast Asia, with reference to the framework by the Hong Kong Monetary Authority in Figure 1.

Table 1: Crypto regulatory rules in Southeast Asia, updated as of 14 Jul 2022. For sources of details see appendix at the end of this piece.

Table 2: Digital assets businesses licensing requirements rules in Southeast Asia, updated as of 14 Jul 2022. For sources of details see appendix at the end of this piece.

Singapore

Singapore started out as a crypto-friendly region for digital assets providers, with the establishment of a clear legal framework for the industry in a pro-business environment, as it has been for many past years, and also most recently ranked 2nd in the World Bank Group’s Doing Business 2020 Report.

However, as firms started applying for licences under the Payment Services Act (PSA) with the pending expiration of exemption from it; many firms, including major players like Binance, have come to realise that the regulatory environment was not as conducive to cryptocurrency services offerings in the city-state as originally thought. Firms initially flocked to the city as the regulatory framework was seen as ‘crypto-friendly’, with growth opportunities. Firms initially operated under the exemption of the PSA license while awaiting approval.

After a little over a year since digital assets service providers have started applying for the licence, as of May 9 2022, Singapore has granted a total of 5 licences under the PSA to Digital payment Token (DPT) platforms, whereas several other firms have been granted an In-Principle-Approval (IPA), most recently Crypto.com, Hodlnaut and Digital Treasure Exchange.

In Singapore, cryptocurrencies are not recognised to be legal tender, and the central bank — the Monetary Authority of Singapore (MAS) — does not recommend cryptocurrencies or tokens for retail investors, as prices are deemed to be volatile and unstable. As such, the concern is that investors in these tokens are at risk of suffering significant losses. In January 2022, public advertising of cryptocurrencies and digital tokens were disallowed, accompanied with a reminder on the dangers of crypto — “MAS has consistently warned that trading cryptocurrencies is highly risky and not suitable for the general public, as the prices of cryptos are subject to sharp speculative swings.”

Under the PSA, DPT platforms are able to apply for 2 kinds of licences: the Standard Payment Institution (SPI) licence and the Major Payment Institution (MPI) licence. Firms with less than S$3M in payment transactions over a calendar year are eligible for the SPI licence, while firms that transact payments over that threshold will have to apply for an MPI licence.

As part of the admission criteria, SPI licence applicants must have a base capital of S$100k, while MPI licence applicants must have S$250,000. An extra security requirement of S$100k for MPI licence applicants which transact payments below S$6M per month apply, while for MPI licence applicants which transact payments above that amount the security requirement is S$200k.

All applicants must ensure that they are registered with ACRA, and have a permanent place of business. They must also ensure that proper compliance procedures are in place to ensure compliance with applicable laws and regulation, and there are robust technology risk management practices in place. Applicants must also have plans to conduct regular audit assessments of the adequacy of effectiveness of its procedures, controls, and its compliance with regulatory requirements.

Once the licence is granted, licensees are required to comply with all applicable requirements set out under the PSA on an ongoing basis, as well as other relevant legislation. Requirements include the Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) requirements, submitting periodic regulatory returns in relation to its payment service activities, cyber hygiene requirements, business conduct requirements, providing disclosure on accurate representation on the scope of its licence, and annual audit requirements.

MAS concluded the first phase of its study on possible retail CDBC solutions last year, with the announcement of the Global CBDC Challenge. The Challenge was set out to help identify and develop retail CBDC solutions that could promote digitalisation, improve financial inclusion and develop payments efficiencies. On 31 May 2022, MAS announced the commencement of Project Guardian, an initiative in collaboration with financial industry partners to explore the economic potential and beneficial use cases of asset tokenisation. With this initiative, MAS aims to develop and pilot use cases in four main areas: Open, interoperable networks, trust anchors, asset tokenisation, and institutional grade DeFi protocols. The first pilot, in collaboration with DBS Bank Ltd., JP Morgan and Marketnode, will explore potential DeFi applications in wholesale funding markets.

The path to on and off-ramping crypto to fiat in Singapore is well defined, with options such as bank wires and payments rails infrastructure such as StraitsX and Moonpay. Exchanges such as Coinhako support almost instant FAST bank transfers, where users can buy crypto by making a transfer from their bank accounts to an account number provided on-screen in the app, and the deposit will be credited in minutes. StraitsX and Moonpay both allow users in Singapore to buy crypto with Singapore Dollars (SGD), with StraitsX supporting bank transfers and Moonpay supporting credit or debit card purchases. Off-ramping is simple as well — simply apply for a withdrawal through a bank transfer from supported exchanges or sell crypto to StraitsX for a 0.4% fee. StraitsX is a licensed solutions under the company Xfers, which holds a Major Payment Institution licence for e-money issuance under the new Payment Services Act, while Moonpay is not listed in the list of institutions licensed under the Payment Services Act.

Singapore has to find the tricky balance between fostering innovation and introducing regulations. In a parliament sitting on 12 January 2022, The Minister for Communications and Information, Josephine Teo said that the country is keeping a close eye on the impact new technologies such as NFTs, DeFi and the metaverse pose to its citizens. The Minister also reiterated that the country will seek to strike a balance between “promoting economic vitality, preserving social stability and protecting public security in the digital domain”. In a media release announcing the commencement of Project Guardian on 31 May 2022, Mr Sopnendu Mohanty, Chief FinTech Officer at MAS was quoted saying, “The learnings from Project Guardian will serve to inform policy markets on the regulatory guardrails that are needed to harness the benefits of DeFi, while mitigating its risks.”

Over the next few years, as new kinds of products are introduced in the cryptocurrency and blockchain industry, we expect Singapore to continue to lead in the front of establishing clear and actionable regulatory guidelines, as well as adjusting current regulations to adapt to the ever-changing landscape of the industry.

Vietnam

To date, Vietnam does not yet have a legal framework for owning, trading and using crypto. However, the government recognises the increasing prevalence of crypto and its integration into mainstream day-to-day Vietnamese life. Vietnam’s Prime Minister — Pham Minh Chinh — has reportedly asked the country’s central bank to conduct a study of cryptocurrency so that the government can run its own pilot program from 2021 to 2023. Vietnam is also introducing a fintech sandbox, where the State Bank of Vietnam (SBV) will provide a sandbox environment for controlled testing.

The Vietnamese central bank, the State Bank of Vietnam (SBV) is the state agency in charge of currency and payments trade and, as such, any rules governing bitcoin usage as well as all related services would come under its purview. The SBV has ruled that cryptocurrencies, particularly Bitcoin or Litecoin, are not recognized legal payment methods in the country. They have also been prohibited from being used as money or a method of payment.

Residents in Vietnam who would like to buy crypto typically rely on debit / credit card purchases through exchanges, bank transfers to exchanges, or peer-to-peer marketplaces. Binance has supported the Vietnamese Dong (VND) in its peer-to-peer marketplace since 2021. Other exchanges such as Crypto.com and OKX support card purchases for direct VND to crypto on-ramping. While there have been no official guides published for off-ramping crypto onto VND in Vietnam, peer-to-peer trading marketplaces appear to offer the most flexibility and fastest processing times for off-ramping transactions.

Despite the prohibition of cryptocurrency as means of payment, Vietnam has been recognized as one of the countries with highest adoption of cryptocurrency. Vietnam has substantial cryptocurrency trading volume to show for this as well — one of its largest cryptocurrency exchanges, Vindax, recorded $97M of daily trading volume as of April 2022. This is not antithetical to current regulation — cryptocurrency possession and usage are allowed, except not as means of payment. As such, activities such as investment into crypto is not illegal. Similar to Singapore’s MAS, the state has warned retail investors of the risks of cryptocurrency.

Overall, we expect the introduction of further regulation in the cryptocurrency and DeFi space in Vietnam, as countries around the region look to set up regulatory frameworks in this nascent space.

Indonesia

In Indonesia, cryptocurrency transactions for the purposes of trading and investments are permitted, whereas it is still not recognised as a viable form of payment.

On the trading front, Indonesia’s Commodity Futures Trading Supervisory Authority (Bappebti), the regulatory body overseeing commodity futures and derivatives in Indonesia, has approved 229 crypto assets that can be traded. According to the Regulation №8 of 2021 regarding Guidelines of Crypto-asset Transactions in Future Markets (Regulation 8/2021) created by BAPPEBTI, cryptocurrency exchanges, or crypto asset traders as they are called in the country, are required to go through a two-stage registration/approval process: a transitional stage, where a crypto asset trader is registered as a “candidate” crypto asset physical trader, and the second and final stage, where a crypto asset trader would be approved to be a crypto asset physical trader. The licence granted in the first stage is called the Prospective Crypto Asset Trader license and will be called Crypto Asset Trader licence after the second.

To date only the first stage is open for registration, hence this section will only delve into details on obtaining a Prospective Crypto Asset Trader licence. Admission criteria is relatively straightforward; other than documents pertaining to the governance structure and financial projection and data of the business entity, an applicant must also have a paid-up capital of at least Rp. 50,000,000,000 (approximately US$3.5 million), and maintain equity of at least 80% of the paid-up capital. Registration of this licence will only be valid until BAPPEBTI has approved a futures exchange and a futures clearing house, which will be responsible for dealing with crypto assets. Currently, about 18 cryptocurrency exchanges hold the Prospective Crypto Asset Trader licence.

In an Instagram post, Indonesia’s Financial Services Authority (OJK) prohibits financial service institutions from using, marketing, and/or facilitating crypto asset trading. In that same post, they also reminded the nation that prior to buying into cryptocurrencies, they should fully understand the risks.

The growth of adoption of cryptocurrencies in Indonesia has been growing at breakneck speed. According to BAPPEBTI, the volume of crypto transactions in the country has grown to Rp 859.4T in the year 2021, up over 1,222% from the year 2021. The number of crypto investors have also surged, amounting to a record 12.4M crypto investors as of February 2022. There are currently more investors in the crypto markets than the public equities market, although cryptocurrency transaction volumes still lag behind.

Crypto investors in Indonesia have a few ways of converting their fiat money into cryptocurrency and vice versa, most commonly using bank transfers. Other ways include e-wallet transfers and card purchases. Tokocrypto, for example, offers the option of on-ramping and off-ramping through bank transfers, which take about an hour to process. Other exchanges like Pintu offer e-wallet transfers.

Indonesia is taking a step towards becoming a crypto-friendly country by putting in effort to establish a regulatory framework in phases. By regulating incrementally, this will encourage more digital asset players to comply with regulations and give the country a push towards innovation in the space within a protected environment.

Philippines

On January 26 2021, the central bank of the Philippines, Bankgo Sentral ng Pilipinas (BSP), published Circular 1108, Guidelines for Virtual Asset Service Providers (VASP). In this circular, guidelines for VASPs were clearly outlined, with admission criteria for the Certificate of Authority (COA) that all VASPs that wish to operate in the country must adhere to.

All VASPs that wish to apply for a COA must have a minimum required capital of ₱50M for VASPs with safekeeping and/or administration services; and ₱10M if none. All VASPs must ensure wallet security by putting in place an adequate cybersecurity framework and adopt sound cybersecurity practices. VASPs must also ensure that a risk management system is in place to mitigate any risks that may arise from outsourcing of services.

Know-your-customer (KYC) checks must be in place, and VASPs must also clearly communicate all risks, fees, and proper safeguarding and storage of virtual assets to its customers.

VASPs with custodial services shall adopt measures to ensure adequate reserves for the virtual assets held in custody, and also adopt effective mechanisms to properly record and segregate virtual assets in different wallets.

In every virtual transaction, these are the required information that must accompany the transfer:

originator’s name;
originator’s account number used to process the transaction (e.g the virtual asset wallet used);
originator’s physical address, or national identity number, or customer identification number that uniquely identifies the originator to the ordering institution, or date and place of birth;
beneficiary’s name;
beneficiary account number where such an account is used to process the transaction.

VASPs are responsible for upholding the confidentiality, integrity and availability of the required information. The information required here closely models the crypto travel rule included in the AML/CFT requirements for PSA licensees in Singapore.

VASPs shall also comply with the notification and reporting requirements, and sanctions shall be imposed on a VASP, their directors and / or officers for noted violations. To date, there are 18 registered VASPs in the country.

Currently, cryptocurrencies are not legal tender in the Philippines.

The Philippines has taken a page out of the Financial Action Task Force’s (FATF) playbook by adopting the Travel Rule that was proposed by the FATF in October 2021. This shows that the Philippines is closely monitoring regulatory actions taken by other countries not just in the SEA region, but also globally. The BSP has also published clear guidelines on application for VASPs to obtain the necessary licence to operate legally in the country, which is an encouraging front for digital assets businesses looking to set up business in the country.

Other than the usual methods of on-ramping fiat to crypto, Coins.ph in the Philippines offer cash on-ramp, where it works with local storefronts to allow customers to top-up their in-app Pesos account via cash. Users can then use the Pesos in the account and convert it to any supported Bitcoin in the app. PDAX on the other hand, partners with local banks to offer over-the-counter on-ramp services to their users. Most exchanges in the Philippines support off-ramping through bank or e-wallet transfers.

By establishing a clear regulatory framework for VASPs to follow, the country is signalling that they are ready to adapt the current regulations to embrace the current and future waves of innovation that will come from the cryptocurrency and blockchain industry, as well as the challenges that come with it.

Thailand

In Thailand, all digital asset businesses are required to obtain a licence from the Ministry of Finance upon recommendation of the SEC. A cryptocurrency exchange would be classified as a digital asset business, along with digital asset brokers, dealers, and other businesses relating to digital assets as prescribed by the Minister under the recommendation of the SEC.

Applicants for the licence under the Emergency Decree on Digital Asset Businesses B.E.2561 (2018) will be assessed on their sufficiency of financial resources, security of its clients’ assets, cybersecurity measures, accounting systems, and KYC measures and procedures. Digital asset businesses with custodial services shall also ensure that their clients’ assets are segregated and stored separately. There are currently 7 cryptocurrency exchanges in Thailand regulated under this licence.

Thailand, like its neighbouring countries, has banned use of cryptocurrencies as a form of payment. The ban was imposed by the SEC of Thailand, after a study of the cryptocurrency industry in the country with the Bank of Thailand (BOT). Both the BOT and SEC believe that crypto payments affect the stability of the overall economy, thus the ban has been imposed to maintain financial stability in the country.

Even with these restrictions in place, adoption of cryptocurrencies in the country is not slowing down. In a report published by the Thailand SEC in November 2021, cryptocurrencies trading volumes have surged by 1100% since November 2020, with $6.6B in trading volume as of date of publication.

Cryptocurrency traders in Thailand typically on-ramp and off-ramp through bank transfers. Two of the biggest exchanges in Thailand, Zipmex and Bitkub, currently only support bank transfer options for both on and off-ramping of the Thailand Baht (THB). Compared to Indonesia and Philippines, Thailand is more conservative in the payment methods that exchanges support.

From February to June 2019, the BOT had conducted Project Inthanon Phase II together with 8 leading financial institutions and R3 as its technology partner. The aim of this project was to solve current business pain points and improve efficiency in the settlement system. Findings from this project reported that distributed ledger technology can help enhance the efficiency of the bond trading and repurchasing activities through the bonds’ life cycles. This phase involved collaborative designing, developing and testing a proof-of-concept (POC) of the decentralised Real-Time Gross Settlement system by using a wholesale CBDC.

Although no new regulatory guidelines for crypto have been published since 2018, Thailand has shown that it is serious in defining its strategy for navigating the crypto space, and we expect to see new developments in their CDBC development projects as well as an updated guideline for digital assets businesses in the country.

Although the crypto regulatory landscape in countries around the world is currently still in a flux, most countries in Southeast Asia have proved their commitment to keeping up with innovation in the space, and publishing regulatory guidelines to reflect their stance on the state of the crypto space. Founders looking to build digital assets businesses in the region must not only take into account the rate of cryptocurrency adoption in each country, but more importantly the clarity of guidelines proposed by the country’s governing body to regulate the industry. Main considerations to take note of should be the kind of licences the businesses would be eligible for, licensing requirements, legitimacy of cryptocurrencies as legal tender, and ease of on and off-ramping of fiat currencies to cryptocurrencies.

With recent crypto events happening around the world, founders are forced to think of regulations more seriously than ever before, and concerns that linger on many founders’ minds are these: how will market conditions affect regulations, and how will that, in turn, affect the kind of products I build and where I build them?

Founders should first observe the number of times regulations have changed, by checking on online statutes on government portals and the number of times it has been revised. Singapore, for example, has not had overly major changes to its Payment Services Act since 2019, which provides a stable base for founders looking to build a digital assets base in the country, as it gives assurance that they will not have to constantly adapt to changing regulations and licensing requirements.

A second thing to observe is the number of entities actually holding the licence, instead of only in-principle approvals or clearly laid-out licensing requirements with no actual licence holders. This information should be easily found on the governing body’s online portal, where a list of licence holders could be shown.

When choosing a country to build a digital asset business in, it is also important to get a sense of the local market sentiments — while there is no formal methodology for this finding, founders can use data to back up their observations — for example, to assess how popular cryptocurrencies are in a country, they may refer to trading volume and number of on-off ramp services in the country. An implicit sign may also be the quality of crypto exchanges available in the country, and whether or not these exchanges are trustworthy. Other more relative data points to look at are the rate of innovation happening in the industry in that particular country, and the amount of support or rejection the country’s government has for these new projects.

Huge shoutout to Fang Hong for laying out the foundations of this piece, as well as contributing to research. Special thanks to the Saison Capital team as well for reading drafts and providing insightful suggestions!