Why Singapore crypto withdrawals get held — the travel rule, explained

If a MAS-licensed exchange has parked your Bitcoin or USDT withdrawal for “compliance review”, it is usually not a glitch and it is rarely a scam ticket. Singapore implements the Financial Action Task Force travel rule — FATF Recommendation 16 — through MAS Notice PSN02. Licensed digital payment token (DPT) providers must attach originator and beneficiary information to value transfers, and they must not execute a transfer they cannot document. That is why a send to your own hardware wallet can sit in pending while a PayNow deposit of the same size cleared in minutes.

This piece is an explainer for people who bank in Singapore dollars. It is not legal advice, not a way to bypass screening, and not a recommendation to move coins. Confirm the operating company on the MAS Financial Institutions Directory before you treat any platform as a Singapore licensee.

What is the FATF travel rule for DPT providers in Singapore?

Wire transfers have carried sender and recipient data for decades. Crypto did not, which is why FATF told virtual asset service providers to make tokens “travel” with the same class of information that a SWIFT payment carries. MAS translated that into Notice PSN02, last revised on 30 June 2025 and in force in its current form from 1 July 2025. The notice applies to holders of a payment services licence that provide a DPT service under the Payment Services Act 2019.

Paragraph 13 covers “value transfers”: sending tokens on an originator’s account, receiving them for a beneficiary, or arranging the transfer. House-to-house settlement between two financial institutions acting for themselves is out. Your withdrawal to another exchange, a hosted wallet, or an address the platform does not control is in.

The threshold is S$1,500, not US$1,000. Amounts at or below S$1,500 still travel; they simply carry a shorter data set. Amounts above S$1,500 carry extra originator identifiers that the ordering institution must have verified. If the provider cannot meet those requirements, paragraph 13.11 says it shall not execute or arrange the transfer. A hold is, in that sense, the lawful alternative to a send.

What originator and beneficiary information actually travels?

For transfers at or below S$1,500 the ordering institution must include four fields in the message that accompanies the transfer: the originator’s name, the originator’s account number (or a unique transaction reference if there is no account), the beneficiary’s name, and the beneficiary’s account number or reference. In crypto, “account number” is usually the wallet address plus the platform account that sits behind it.

Above S$1,500 the same four fields travel, plus one of three originator extras: residential or registered address; a unique identification number such as NRIC, FIN, passport or UEN; or date and place of birth, incorporation or registration. The ordering institution must identify the originator and take reasonable measures to verify that identity before it sends.

The data does not get written onto Bitcoin. It moves on a parallel channel between providers — often a travel-rule protocol such as TRP, or a bilateral API. The beneficiary institution has its own job: take reasonable measures to spot transfers that arrive without the required originator or beneficiary information, and apply risk-based policies to those that fail the test. That is why an incoming deposit from an overseas book can be delayed even when the blockchain transaction has already confirmed.

The practical point is simpler. Your licensed platform is not allowed to be a silent pipe. If the other side cannot accept the message, or will not identify itself as a VASP, the pipe stops.

Why is my withdrawal on hold?

The holds that reach this desk fall into a short list.

Name mismatch is the most common. You typed “Ben Wei” in the beneficiary field and your KYC file says “Wei, Benedict Jiahao”. Fix the beneficiary name to match the legal name on the destination account, then resubmit.

Missing beneficiary information is next. A send to another licensed book usually works because both sides already know how to exchange PSN02 fields. A send to a small overseas platform that has never stood up a travel-rule endpoint often sits until someone on a first-line team decides the destination is an unhosted wallet, a VASP, or neither.

Sanctions and adverse-media screening run on both names and addresses. A reused address that once received funds from a mixer, a darknet market or a sanctioned jurisdiction can freeze a withdrawal that is otherwise yours. The platform is not accusing you of that history. It is deciding whether it can complete the transfer without breaching its own AML programme.

Unhosted-wallet enhanced due diligence is the hold that surprises people who thought self-custody was the “clean” option. See the next section.

Source-of-wealth refresh can sit on top of a travel-rule check. A first withdrawal after a quiet year, or a size that is large relative to your declared income, often triggers the same questions a FAST payout will trigger later. Have how to sell crypto and withdraw SGD in mind before you treat the hold as a technical fault.

None of these is a reason to hand a seed phrase to someone on Telegram who claims they can “release” the transfer. That pattern is documented in our guide to crypto scams targeting Singaporeans.

Unhosted wallets and withdrawals to your own Ledger

PSN02 is written around ordering institutions, beneficiary institutions and intermediary institutions — in other words, financial institutions. A hardware wallet is not a financial institution. Platforms therefore invent an operational category: the unhosted, or self-hosted, wallet. They still have to identify you as originator. They still have to record enough of the transfer to reconstruct it. They often also ask you to prove that you control the destination address, because sending to an address you do not control is a different risk from sending to yourself.

Proof of control is usually a satoshi test, a signed message, or a photo of the device showing the receive address. It is tedious. It is also how a desk avoids facilitating an unattributed transfer to a third party. If you refuse, they are entitled to refuse the send.

This is the privacy bargain in concrete form. Self-custody removes the platform’s insolvency risk, which is the point of hardware wallets versus exchange custody. It does not remove the platform’s obligation to know who is sending what to whom at the moment the coins leave their hot wallet. Storing crypto safely in Singapore is a separate problem from getting the coins off the book in the first place.

Whitelist the address on a quiet weekday, in an amount you can afford to have stuck for 48 hours. Do not whitelist for the first time on a Friday evening before you need the coins in Kuala Lumpur on Saturday.

Privacy versus compliance for a Singapore customer

Readers sometimes ask whether the travel rule “doxxes” them on-chain. It does not. The blockchain still shows an address-to-address movement. The names, NRIC numbers and residential addresses travel off-chain, between regulated entities, under the same confidentiality duties that apply to other MAS-regulated activity. MAS and law-enforcement authorities can request the file. A stranger watching a block explorer cannot.

That is not anonymity, and it is not meant to be. If you need no licensed entity ever to hold your legal name next to a withdrawal, a MAS-licensed book is the wrong tool. Using an unlicensed overseas app to dodge PSN02 also dodges asset segregation, FAST in your own name, and the licensee complaints path. It does not dodge the criminal law if the tokens are proceeds of crime.

There is a narrower privacy interest that the desk thinks is legitimate: you should not be pressured to screenshot a seed phrase, paste a recovery phrase into a “verification” form, or grant remote desktop access so that compliance can “see the wallet”. Those requests are not PSN02. They are how accounts get emptied. A signed message from the address is sufficient proof of control. Anything that asks for the keys is a different conversation, and you should walk away from it.

What you can do before you hit withdraw

Treat the first withdrawal to a new destination as a compliance event, not a button. Confirm the destination’s legal name. If it is another platform, use the beneficiary name exactly as that platform’s KYC file has it. If it is your hardware wallet, complete proof of control before you need the funds. Keep the amount modest until the address is trusted on their side.

Keep your own record: date, asset, amount in token and in S$ at a stated rate, destination address, transaction hash, and the ticket number of any hold. IRAS does not tax a travel-rule delay, but the same file is what you will want if a later FAST payout raises source-of-wealth questions, or if you ever have to reconstruct a year of disposal records.

If a hold lasts longer than the published review window, use in-app support — not a number from an SMS — and ask which PSN02 field is missing. A competent team can say whether they are waiting on the beneficiary VASP, on proof of control, or on a sanctions hit.

Nothing in this article is a recommendation to buy, sell or hold any digital payment token. Licence status changes; check the Financial Institutions Directory on the day you transact.