The recent TOKEN2049 conference in Singapore gathered the brightest minds and deepest pockets in the digital asset space. High-net-worth individuals and prominent crypto traders flooded the city to network and explore new financial frontiers. Beneath the surface of this prestigious gathering lurked a dark reality. Malicious actors systematically targeted these very attendees through highly coordinated exploits.

As a journalist covering the intersection of technology and finance, I observe a troubling paradox in this industry. We build impenetrable cryptographic ledgers while leaving the front door wide open through basic human error. The recent incidents highlight a severe operational blind spot. Hackers weaponised rogue public internet connections and specialised side events to separate traders from their wealth. This vulnerability proves that advanced cryptography cannot protect users who willingly hand over their access credentials to bad actors.

Cybercriminals executed their initial wave of attacks using deceptive internet hotspots. These threat actors created malicious networks mimicking local hotels, airports, and the official event venue. Security experts call these setups ‘Evil Twin’ attacks. Simply connecting to a bad network does not instantly extract cryptographic keys from a hardware wallet. Instead, the operators intercept network traffic and launch man-in-the-middle attacks.

Once a victim joins their connection, the perpetrators redirect the user to fake login pages. They also prompt malicious application updates and push hidden certificate profiles to seize complete control over device data. This total system compromise allows the criminals to drain hot wallets effortlessly. Several prominent Key Opinion Leaders and everyday traders lost their assets after utilising these unsecured connections around the city. The sheer simplicity of this trap demonstrates how convenience consistently overrides basic digital hygiene among even the most experienced market participants.

The threat landscape extended far beyond digital traps and into physical spaces. A highly orchestrated social engineering exploit took centre stage through a side event named ‘Don’t Get Played’. Groups calling themselves Apex Accelerator and Stone Venture allegedly hosted this gathering. Victims quickly reported the fraudulent operation to the Singapore Police Force. The organisers promoted the gathering as a cybersecurity training workshop inside a luxury hotel.

They used the guise of education and protection to pressure attendees into installing remote-control malware onto their personal laptops. This specific software granted the intruders full remote command over the compromised computers. With this level of access, the criminals intercepted private keys and executed devastating wallet drains right under the noses of the victims. This physical infiltration tactic bypasses traditional defenses entirely by exploiting human trust and the inherent desire to learn from industry peers.

Also Read: The crypto independence story is fragile: Bitcoin now moves on elections, oil and missiles

Individual traders walking the conference floor faced relentless pressure from overlapping social and technical setups. The prominent crypto trader Frogman fell victim to these aggressive tactics and suffered enormous financial damage. Hackers stole over US$4 million from him during his time networking at the event. The attackers systematically drained nine different tokens from two of his primary wallets. This devastating breach occurred immediately after he interacted with new contacts on the ground.

My perspective on this specific case reveals a harsh truth about modern professional networking. The very act of shaking hands and exchanging ideas creates an attack surface that malicious actors eagerly exploit. When professionals let their guard down to build relationships, they inadvertently expose their most sensitive infrastructure to calculated predators. This staggering loss serves as a stark warning to everyone operating in the high-stakes digital asset ecosystem.

Victims of these sophisticated scams must take immediate and decisive defensive measures to salvage their remaining assets. Anyone who connected to unverified networks or suspects malicious software interactions must isolate their funds right away. Traders need to move all assets from their current hot wallets to a completely clean device or a secure cold-storage hardware wallet.

Next, they must revoke active approvals using specialised tools like Revoke.cash to cancel all smart contract ties linked to their public addresses. Following this crucial step, users must rotate every single security key. This process requires them to reset every password, passkey, and 2-factor authentication credential that they accessed or stored on the compromised machine while in the city. Finally, professionals must completely avoid public internet connections at future gatherings. I strongly advise using a dedicated roaming eSIM or a local data SIM card paired with a reputable virtual private network to maintain a secure perimeter.

Also Read: Asian investors aren’t choosing between crypto and TradFi anymore

Industry experts emphasise the need for proactive technological shields rather than reactive cleanup efforts. The most effective protection stops malicious files from ever reaching a device in the first place. Tools that block phishing sites, scam domains and malicious ads at the network level, while scanning downloads for malware, cut off an attack at its entry point before it can reach a wallet.

Wallet address screening tools add another layer of defence. They recognise wallet addresses on a web page and check them against known fraud databases, displaying a warning before a user sends funds to a dangerous address. When choosing these tools, traders should look for ones that process data locally on the device and do not require access to personal data or browsing history.

The events in the city expose a fundamental flaw in the current digital asset culture. We obsess over complex consensus mechanisms while ignoring basic operational security. I firmly believe that the industry must shift its entire protection paradigm. Developers and security firms need to build environments that shield users from their own inevitable mistakes. Relying solely on user vigilance guarantees failure because human beings naturally prioritise convenience over strict protocols.

The enormous financial losses prominent figures suffered prove that current educational efforts fall drastically short. True protection requires seamless integration of advanced threat detection directly into the tools people use every single day. Until the ecosystem adopts these frictionless security layers, bad actors will continue to exploit the human element and drain millions from unsuspecting professionals at every major global gathering.

—

The post Hackers drain US$4M using fake Wi-Fi at major crypto conferences appeared first on e27.

Indonesia is a great place to expand or even build a startup. With more than 280 million people and a rapidly digitising middle class, it is easy to see the market’s growth potential. But a promising market does not always mean a straightforward expansion. For some founders, this is where things get complicated for its company taxes.

The pattern is familiar. A Singapore-headquartered startup hires a country manager in Jakarta, signs a few local customers, and plans to “sort out the structure later.” By the time it does, it may already have a taxable presence it never registered, invoices that were under-withheld, and intercompany charges no one documented.

These risks are worth paying attention to, especially as Indonesia’s tax rules continue to evolve. Over the past 18 months, the country has tightened access to its small-business tax regime, reduced the minimum capital required for foreign-owned companies, introduced a new digital tax filing platform, and revised how tax treaty benefits are claimed. So, what should founders know before expanding into Indonesia? Here are the key tax issues to get right from the start.

Your entry vehicle is a tax decision, not just a legal one

Most foreign-owned startups end up choosing between three routes, and each carries a different tax profile.

The capital requirement for a PT PMA was reduced in late 2025. Under BKPM Regulation 5/2025, the minimum paid-up capital fell from IDR 10 billion (US$552,000) to IDR 2.5 billion (US$138,000) per business line (KBLI). The overall investment plan of IDR 10 billion per business line remains. The balance can be met through qualifying assets and spending, while the IDR 2.5 billion (US$138,000) cash contribution is generally expected to remain in the company’s account for 12 months unless used for capital expenditure or working capital.

The practical takeaway: a representative office is a cheap listening post, but the moment you want to sign Indonesian customers in your own name, you need a PT PMA, or you need to be very deliberate about how the foreign entity contracts.

The “we don’t have an entity yet” trap: Permanent establishment

Not having an Indonesian company does not mean you have no Indonesian tax exposure. If your foreign entity has a fixed place of business in Indonesia, or people there who habitually negotiate and conclude contracts on its behalf, it can be treated as having a permanent establishment (PE, or BUT locally). Its Indonesia-attributable profits then become taxable in Indonesia.

Also Read: The business judgment gap: Why BUMN investment decisions need a different risk framework in Indonesia

For Singapore-headquartered startups, the Singapore–Indonesia tax treaty sets the lines:

• Service PE: furnishing services, including consultancy, in Indonesia for more than 90 days in any 12-month period.
• Dependent agent PE: no day count at all. A local “country manager” who signs deals for the parent can create one from day one.
• Fixed place PE: an office or co-working desk used for core business, again with no time threshold.

The employer-of-record model is the usual culprit. An EOR solves employment law, not tax. If the person employed through it is doing sales and closing contracts for your foreign entity, the PE risk sits with you, not the EOR provider. Keep their role to support and lead generation, or move to a PT PMA before it becomes a sales role.

The 0.5 per cent shortcut is gone for new PTs

One change that older market-entry guides may overlook is the restriction on Indonesia’s 0.5 per cent final tax regime. Previously, eligible small businesses could pay 0.5 per cent of gross turnover, up to IDR 4.8 billion (US$265,000), instead of paying corporate income tax on profits.

Under Government Regulation 20/2026, effective 22 April 2026, newly established limited companies (PTs) and partnerships (CVs) can no longer access this regime. It is now limited to individuals, single-founder Individual Companies (Perseroan Perorangan), and cooperatives. Existing PTs already using the regime may continue until their remaining eligibility expires.

A new PT PMA therefore starts on the standard regime from day one:

• Headline rate: 22 per cent corporate income tax on net profit.
• Small-company reduction: companies with annual gross turnover up to IDR 50 billion (US$2.76 million) get a 50 per cent rate cut on the share of taxable profit attributable to the first IDR 4.8 billion (US$265,000) of turnover. For an early-stage startup, that often brings the effective rate well below 22 per cent.
• Losses: a loss-making year means no corporate tax, but bookkeeping must follow Indonesian accounting standards and the records must be kept locally.

For most venture-backed startups this is less painful than it sounds. A 0.5 per cent tax on revenue is punishing when you are burning cash; tax on profit is not. It does mean proper bookkeeping from the first month, because “we’ll file on turnover” is no longer a fallback.

VAT: The 12 per cent that is usually 11 per cent, and the rules for selling from offshore

Indonesia’s statutory VAT rate is 12 per cent, but for most goods and services it is applied to a base of 11/12 of the price, so the effective rate is 11 per cent. The full 12 per cent bites on luxury goods. Make sure your billing system calculates it the Indonesian way rather than simply applying 12 per cent.

If you sell digital products into Indonesia from abroad (SaaS, apps, subscriptions, digital content) without a local entity, you fall under the PMSE regime for foreign e-commerce and digital service providers. The tax authority (DJP) can appoint you as a VAT collector once Indonesian sales exceed IDR 600 million (US$33,100) a year or IDR 50 million (US$2,760) a month, or traffic exceeds 12,000 users a year or 1,000 a month. You then charge VAT to Indonesian customers and remit it, in rupiah or US dollars.

Also Read: Indonesia urgently needs an allergy data centre to support national food security

Two things founders overlook here. B2B customers will push back on invoices that do not carry valid Indonesian VAT. And once you set up a PT PMA, the digital sales need to move cleanly from the offshore PMSE registration to the local entity, or you risk accounting for the same revenue twice.

Withholding tax will hit every payment you send home

When your Indonesian entity pays its foreign parent dividends, interest, royalties, licence fees or service fees, it must withhold tax at a domestic rate of 20 per cent unless a treaty reduces it. The Singapore–Indonesia treaty brings the rates down meaningfully:

The catch is paperwork. The reduced rate applies only if the recipient has a valid DGT Form in hand before the payment is made. Under PMK 112/2025 the form now runs through the Coretax portal, needs certification from the home tax authority (IRAS for Singapore), and must cover each income type separately. Dividend relief also requires real substance in Singapore and a 365-day holding period. If the DGT Form and Certificate of Residence aren’t in place, the full 20 per cent applies, and getting the difference back means a separate refund process.

If your plan is to charge the Indonesian subsidiary a management fee or a licence fee for your platform, prepare the DGT Form and Certificate of Residence into your invoicing flow. It is one of the most common and most avoidable leakages we see.

Transfer pricing applies earlier than founders expect

Startups assume transfer pricing is something only big groups worry about. In Indonesia the thresholds are lower than most people think. Under PMK 172/2023, an Indonesian entity with related-party transactions needs a Master File and Local File if any of the following applies:

• prior-year gross revenue above IDR 50 billion (US$2.76 million).
• related-party goods transactions above IDR 20 billion (US$1.1 million), or services, interest or royalties above IDR 5 billion (US$276,000).
• transactions with a related party in a lower-tax jurisdiction. Singapore’s 17 per cent headline rate is below Indonesia’s 22 per cent, so a Singapore parent can trigger this on its own.

The documentation must be ready when the annual return is filed and produced within 30 days of a request. For intragroup services and financing, the rules also expect the pricing analysis to exist at the time of the transaction, not reconstructed afterwards.

The risk is concrete. If the tax office decides your management fee or IP licence is overpriced, it can disallow the deduction and recharacterise the excess as a deemed dividend, which then attracts withholding tax as well. Set the intercompany model before the first invoice, not at year end.

Also Read: Youth brain drain: A hidden threat in Indonesia’s agriculture sector

Payroll, perks and ESOPs

Employee income tax (PPh 21) is withheld monthly using the average effective rate (TER) tables introduced by PP 58/2023, then trued up in December against the progressive scale, which runs from five per cent to 35 per cent above IDR 5 billion (US$276,000). Withholding is due by the 15th of the following month and the monthly return by the 20th. Social security (BPJS) contributions sit on top.

Two areas deserve attention from a startup:

• Benefits in kind. Since PMK 66/2023, perks such as company cars, housing, insurance and team trips may be taxable to the employee and must be valued correctly. Generous startup perks can quietly create under-withholding.
• Options and shares granted by a foreign parent to Indonesian staff are generally treated as employment income, and the local employer may have a withholding obligation even though the plan sits offshore. Agree the taxing point and valuation method before you grant, and recharge the cost to the Indonesian entity only with proper documentation.

Compliance runs monthly, and now runs through Coretax

Indonesia is a high-frequency compliance market. A typical PT PMA files monthly withholding returns, monthly VAT returns, monthly corporate tax instalments, and an annual corporate return due four months after year end. Since January 2025, all of this runs through Coretax, the tax authority’s new integrated system, which also handles e-invoicing (e-Faktur) and DGT Form applications.

Coretax gives the authority a joined-up view of your filings, so mismatches between VAT, withholding and corporate returns are easier for it to spot. Two practical points follow. Appoint someone who owns the Coretax account and its digital certificates from day one. And treat refund claims with care: a startup in heavy build mode often sits in an overpaid VAT position, and a refund request typically invites a tax audit.

Before you land: A short checklist

• Decide who will sign Indonesian contracts, and make sure that matches the entity you have (or don’t have) on the ground.
• If you are hiring before you incorporate, keep local roles out of contract negotiation and count service days against the 90-day treaty threshold.
• Budget for a PT PMA on the standard 22 per cent regime with the small-company reduction; do not model the 0.5 per cent final tax.
• Check whether your offshore digital sales already cross the PMSE thresholds.
• Design intercompany fees, licences and loans up front, with pricing support and a DGT Form process in place.
• Map equity grants and perks for Indonesian staff before the first grant letter goes out.
• Set up Coretax access, bookkeeping to Indonesian standards and a monthly filing calendar from month one.

Indonesia rewards companies that commit to it properly. Most of the tax problems we see are not exotic; they come from deferring basic structuring decisions until revenue forces them. A few weeks of planning before entry is far cheaper than unwinding a permanent establishment or a year of under-withheld payments later.

This article is general information as of October 2026 and is not tax advice. Rules and thresholds change; take advice on your specific structure.

—

The post Entering Indonesia? The tax issues startups underestimate appeared first on e27.

In 24 hours, Bitcoin dropped 1.5 per cent to US$74,577.82, while the broader crypto market fell 1.52 per cent to US$2.5 trillion. Bitcoin underperformed a broader market that fell 1.98 per cent and showed a 91 per cent correlation with the S&P 500 over the past week. The decline reflects a technical deleveraging shock on top of a macro risk-off move. Liquidation data explains the speed, and macro data explains the direction.

The primary cause was a cascade of leveraged long liquidations. More than US$1 billion in crypto leveraged positions closed in the 24 hours leading up to November 6, and Bitcoin accounted for US$224.65 million of that total. Long positions made up the vast majority, with a report putting longs above 88 per cent and another at 96 per cent.

Bitcoin long liquidations spiked over 3,339 per cent in 24 hours to US$224.65 million. That spike matters because forced selling creates a feedback loop. Traders who expected higher prices had to exit, and their exits pushed prices lower, which triggered more exits. The market had grown over-leveraged on the long side. This is why the move looked violent rather than orderly. The rapid unwind suggests a flush of speculative excess, and such a flush can sometimes clear the way for a more stable base.

The immediate signal to watch is stabilisation in Bitcoin’s 24-hour liquidation totals, which spiked by over 3,300 per cent. A return to normal levels would point to reduced selling pressure. The average funding rate also plunged 75 per cent, which may signal that leveraged selling pressure is subsiding.

Secondary causes split into two connected channels. The first came from traditional risk assets. The Nasdaq fell 5.5 per cent on November 5 amid concerns about AI-sector growth, and Bitcoin’s high correlation with tech stocks dragged crypto lower. The other came from institutional flows. Spot Bitcoin ETFs, including BlackRock’s, saw multi-day net outflows, with a reported US$104.97 million sale adding direct sell-side pressure.

Also Read: Bitcoin pump and dump? The US$75,000 support zone will decide

A separate report also pointed to regulatory uncertainty after US authorities moved to block transactions involving MEXC Global and alleged US$16 billion in illicit activity. That headline added to the risk-off tone. My view is that the regulatory item matters less for its direct size than for its timing. It arrived while the market was already fragile, and it likely reduced liquidity and confidence. The move wasn’t driven by blockchain-specific news. It came from sensitivity to traditional risk assets, institutional flow trends, and a sudden regulatory headline.

Near-term outlook hinges on a price floor and macro data. Bitcoin traded below its key seven-day and 30-day Simple Moving Averages. Its 200-day Simple Moving Average stood at US$73,187.78, serving as a major floor. The immediate catalyst is the US October Consumer Price Index report on November 10.

A hotter-than-expected print could renew rate fears and pressure risk assets. A cooler reading might offer relief. On the market-cap side, the crypto sector tested a critical floor between US$2.49 trillion and US$2.5 trillion, which aligned with the 78.6 per cent Fibonacci retracement level. A hold above that floor and a reduction in liquidation volume could pave the way for a short-term rebound. Failure to hold could lead to a test of the 200-day moving average near US$2.48 trillion.

Bitcoin’s ability to reclaim US$2.56 trillion, the 78.6 per cent Fibonacci level, and subsequent ETF flow data would help gauge institutional conviction. The asset needs to reclaim the seven-day Simple Moving Average near US$77,159 to signal a potential recovery. The key zone is US$73,188 to US$74,795. A decisive break below could trigger another leg down. This zone matters because it sits close to both the Bitcoin 200-day level and the market-cap floor. That overlap gives traders a clean line to watch.

Also Read: Can Bitcoin hold US$80,000 after a US$386M short squeeze and US$1.16B in ETF outflows?

My view is that bearish pressure is real but narrower than the headlines suggest. The sell-off looks primarily like a technical deleveraging event, magnified by thin weekend liquidity and regulatory headlines. The long liquidation flush may be nearing exhaustion, but the overall trend remains weak until key resistance levels return.

I would not treat a brief bounce as a trend change. I would want to see liquidation totals normalise, funding rates stabilise, and Bitcoin defend the 200-day Simple Moving Average near US$73,188. I would also want ETF flows to stop subtracting from demand. The macro side is equally important. The 91 per cent correlation with the S&P 500 over the past week tells me Bitcoin is trading as a risk asset right now.

That means the CPI release on November 10 can matter more than any crypto-specific headline. If inflation data comes in hot, rate fears could renew pressure on risk assets and make the US$73,188 floor test more likely. If inflation data comes in cool, relief could help Bitcoin stabilise and attempt a reclaim of the seven-day Simple Moving Average near US$77,159. I see the regulatory headline as a timing issue, not the root cause. It made an already crowded trade more vulnerable. A relief bounce can happen without a full trend reversal, and I would treat it as a chance to see whether leverage has truly reset.

Bitcoin’s decline combines a macro risk-off event and an internal deleveraging shock. The liquidation flush may be nearing exhaustion, but the trend remains weak until key resistance levels return. The central question is whether Bitcoin can defend its 200-day Simple Moving Average following the US CPI release, or whether breaking it opens the door to deeper losses.

The market needs time and calmer leverage conditions more than it needs a dramatic catalyst. A quiet stabilisation in liquidation totals and funding rates would do more for the outlook than a sharp relief rally that rests on thin liquidity. The next few sessions should reveal whether this was a flush or the start of a deeper repricing.

—

Editor’s note: e27 aims to foster thought leadership by publishing views from the community. You can also share your perspective by submitting an article, video, podcast, or infographic.

The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of e27.

Join us on WhatsApp, Instagram, Facebook, X, and LinkedIn to stay connected.

The post Bitcoin tests US$73,188: Can the 200-day line stop the slide? appeared first on e27.

Nvidia’s board has opened an independent investigation into whether founder and CEO Jensen Huang was the target of a foreign intelligence effort. The move pulls a Singapore-based chip buyer, and the region’s booming data-centre industry, into the middle of the US-China AI rivalry.

The probe will be overseen by a committee of independent directors working with outside counsel. It follows reports in The New York Times that US intelligence had concluded Alice Huang (no relation), a reportedly former executive at Singapore’s Megaspeed, was recruited by China’s Ministry of State Security. In an email to staff on Sunday, Huang admitted to an affair and apologised to his family. Beijing has called the spy allegation unsubstantiated, and Megaspeed has not responded to media requests for comment.

Also Read: The Nvidia clampdown is a warning for Southeast Asia’s AI boom

None of the allegations has been tested in court. For Southeast Asia, though, the personal drama matters less than the question underneath it: how did a Singapore company end up between the world’s most valuable company and Washington’s most sensitive export controls?

A US$4.8B customer with a Malaysian footprint

Megaspeed is no small reseller. According to the Times, it bought more than US$4.8 billion worth of Nvidia chips over two years. By several accounts, that makes it Nvidia’s largest buyer in Southeast Asia.

US Commerce Department officials have been examining whether the company helped Chinese firms get around restrictions on advanced AI chips. The Times reported that Megaspeed’s chips powered data centres in Malaysia and Indonesia that appeared to serve customers in China remotely. Singapore police confirmed last year that they were investigating Megaspeed for suspected breaches of domestic law.

Nvidia has said its staff repeatedly visited Megaspeed’s facilities, saw a cloud service permitted under the rules and found no evidence of diversion.

That defence points to the gap regulators are struggling to close. Export controls were designed to stop physical shipments, and the region’s chip-smuggling problem has mostly been framed in those terms. Remote access is harder to police. A model can be trained in a Johor data hall and the results carried back to China, or a customer can simply rent the compute through a login. Last year, The Wall Street Journal reported that Chinese engineers had flown into Malaysia carrying hard drives of training data.

The billing-address gap Singapore can’t shake

Singapore has lived with an awkward statistic for some time. In early 2025, roughly 18 per cent of Nvidia’s revenue came from customers using Singapore as a billing location, while only about 1 to 2 per cent was physically shipped to the country.

The gap is legal, because it reflects where multinationals keep their regional subsidiaries. It is also an obvious draw for anyone looking for a respectable address. Singapore’s trade ministry told Parliament last year that the government does “not condone businesses deliberately using their association with Singapore” to break other countries’ export controls. In 2025, three men, including a Chinese national, were charged with fraud over servers that may have contained Nvidia chips.

Also Read: The imported risk: How geopolitics moved from ASEAN’s macro problem to ASEAN’s balance sheet

Enforcement, however, has largely been reactive. Malaysia offers a preview of what may come next. After pressure from Washington, it introduced permits for exports and transfers of Nvidia chips, even as its chip exporters sell more without winning more of the market.

Huang’s export-control argument loses its messenger

The scandal also complicates the policy debate. In May 2025, Huang called US export controls on AI chips “a failure”, arguing that they only pushed China to develop its own alternatives.

When reports about his relationship with Alice Huang surfaced last month, he told Bloomberg the interactions were related to Megaspeed and were “completely normal and not unusual”. Days later, he admitted the affair. The Times also reported that Trump administration policymakers received an intelligence memo about the relationship last spring. Lawmakers from both parties are now asking who knew what, and when.

There is no public evidence that Huang leaked information or knowingly helped anyone evade controls. But Silicon Valley’s most prominent critic of chip restrictions now speaks from under an independent investigation, just as US-China trade settles into an era of managed rivalry. Hawks in Washington are likely to cite the episode for years.

Markets, for now, look unshaken. Asia Pacific shares rebounded on Monday after last week’s sell-off in AI-linked stocks. Taiwan’s TAIEX rose almost 5 per cent and Japan’s Nikkei gained 2.2 per cent, while South Korea’s Kospi slipped 0.6 per cent.

Johor’s data-centre boom faces a compliance bill

The bigger exposure lies in the region’s data-centre corridor. Johor’s build-out rests on the assumption that Southeast Asia can host compute for everyone. If Washington concludes that the region’s facilities are a back door, its response is unlikely to be surgical. Tighter allocation caps, mandatory customer vetting and possibly on-site monitoring would follow, with honest operators sharing the cost. The effects would ripple across Southeast Asia’s chip supply chain.

The practical fix is a “know your compute customer” discipline, modelled on fintech know-your-customer rules: auditable, continuous checks on who ultimately uses the GPUs. Investors backing GPU clouds and AI infrastructure startups may begin asking about end users in due diligence. Regulators in Singapore, Malaysia and Indonesia also have reason to coordinate, rather than answer Washington one letter at a time.

Trust is Singapore’s real export

There is a governance lesson as well. The world’s most valuable company is only now investigating its founder, months after an intelligence memo reportedly reached Washington. Founder-led tech companies in the region, and their boards, may want to ask how quickly they would act in the same position.

Also Read: Southeast Asia in the 2026-2030 world order: Trade, chips, AI, and capital

For Singapore, which has courted Nvidia through initiatives such as Singtel’s partnership with the SIT-NVIDIA centre, the stakes go beyond one company. Its pitch to global capital rests on trust: that a contract signed there means what it says and that an address there is not a front. The region’s ambitions for sovereign AI depend on the same credibility.

The investigation in Santa Clara will decide Jensen Huang’s future at Nvidia. How Singapore and its neighbours respond will decide whether being a “neutral hub” remains an asset or becomes a liability.

The post The Megaspeed question: How a Singapore firm ended up in Nvidia’s biggest crisis appeared first on e27.

On 7 October the Monetary Authority of Singapore issued its Guidelines on Artificial Intelligence Risk Management, phased in over 2027 and 2028. On 3 November it announced that the Future of Finance Institute has started work, with a pillar called SafeFin.ai that will extend the MindForge toolkit to AI use-case risk assessments, testing and assurance, and third-party AI. Two announcements in four weeks, and both name the same thing: the AI an institution buys, not only the AI it builds.

That phrase decides how many fintechs will meet Singapore’s regulator for the first time. Not across a licensing desk, but through the compliance team of their first customer.

The first regulator you meet may be a bank

Foreign founders arrive in Singapore with a question prepared: which licence do we need. The answer depends on what the company does and what it plans to do. A firm that holds customer money, moves payments, advises on investments, lends, or deals in digital tokens will usually need a licence or an exemption from the Monetary Authority of Singapore, and should plan for it from the first day.

A firm that sells software, data, identity checks or AI models to banks, insurers, payment firms and fund managers usually does not, at least until its product starts touching customer money or customer decisions directly, at which point the question returns. Many companies cross that line as they grow, so the plan matters as much as today’s product.

For the second group, and for the first group in the months before its licence is granted, the earliest regulatory test is not run by the regulator. It is run by the customer. The institution holds the licence, and it has to prove to the Monetary Authority of Singapore that it controls the risk a new partner brings into its business.

That proof is assembled before the contract is signed. I spent several years assembling it, leading third-party risk for a global bank across Singapore, Australia and New Zealand, and I now run a company, SAMR Technologies, that helps vendors prepare for it. The regulator never saw the vendor. It saw my file on the vendor. If the file was thin, the answer was no, however good the product was.

Four rulebooks behind every questionnaire

The questions a Singapore institution sends a new partner look arbitrary from the outside. They are not. Almost all of them trace back to four sets of rules from the Monetary Authority of Singapore that bind the institution, rewritten in the second person.

Outsourcing and third-party risk. The guidelines on outsourcing make the institution assess whether a service is material, where the data sits, who the sub-contractors are, whether it can audit the provider, and how it would exit. Every one of those becomes a question to you, and your answer informs the institution’s assessment and, where the service counts as outsourcing, its outsourcing register. A consultation on third-party risk ran this year, and it reaches services whether or not they count as outsourcing; expect the questions to get more specific, not fewer.

Also Read: Why Indonesian fintech’s ASEAN expansion cost more than anyone priced in

Technology risk. The Technology Risk Management guidelines and the notice that sits under them cover secure development, access control, penetration testing, change management, incident reporting on a defined clock, and recovery objectives for anything the institution depends on. If your product sits in a customer-facing flow, you are inside that scope.

Cyber hygiene. The cyber hygiene notices set a short list of baseline controls: administrative accounts, patching, security standards, network perimeter, malware protection, multi-factor authentication. They bind the institution; they reach you through the contract.

AI risk management. New this year. Institutions will keep an inventory of the AI they use, including AI bought from vendors, with accountability that stays with the institution. Once the institution uses your model, it is in that inventory, and the Future of Finance Institute’s work on third-party AI will add detail, not remove it.

Why the first due diligence takes months

From the bank’s chair the picture is consistent. A first-time vendor arrives with a demo and no evidence. The questionnaire goes out in the bank’s own format. Weeks pass while the founder finds policies that exist in someone’s head, discovers which cloud region actually holds the data, and asks the model provider for test results it never requested. Each answer opens two clarifications. The risk rating waits on the answers, the contract waits on the rating, and the institution’s committee that approves material outsourcing waits on the contract.

The delay is made on both sides. Vendors arrive without knowing what will be asked and without one person who owns the answers. Institutions ask for the same things in different ways: each has its own template, built from the same four rulebooks, similar on the merits, different in format and in the detail it demands, and nobody on the receiving side coordinates with the institution next door. The second bank starts again from the first question, and the vendor rewrites the same evidence into a new shape. The delay is rarely the individual reviewer. It is duplication without a shared source of truth.

Readiness before the questionnaire

The remedy is unglamorous. Assess yourself against the four rulebooks before anyone asks, and bring the result to the first meeting as a short readiness report: how far your third-party risk and procurement evidence already meets what a Singapore institution will require, and where the gaps are. The report rests on a small set of facts. A data map: which customer data you touch, where it is stored and processed, by country and provider.

A sub-contractor list with the country and contract date for each. Security evidence: the date and scope of the last penetration test, the access-control policy, an incident process with a named contact. If you have a model: which ones, whose, what they decide, how a human overrides them, and what testing you can show. Continuity and exit: recovery objectives in hours and how the customer gets its data back. One accountable name and a date at the top.

Also Read: Fintech, DeFi and applied AI define Southeast Asia’s new venture discipline

Prepared once and mapped to the rules rather than to one institution’s template, that report answers the reviewer’s first questions before they are asked and survives the move to the next institution with its different format. It is readiness before certification, and it shortens vendor onboarding from the vendor’s side, which is the only side the vendor controls. Whether a firm produces it with a spreadsheet or a platform matters less than producing it before the first meeting.

Why Singapore works like this

My doctoral research on how regulation and the fintech sector shape each other in Singapore, published with Springer Nature this year, describes a corridor. Above it sits a ceiling of scale: the size at which a firm would reshape the market itself rather than operate inside it, a size very few firms of any kind reach. Below it sits a regulatory floor: the minimum level of control and evidence at which a firm can be taken on by a licensed customer at all.

Between them the state actively coordinates innovation, through licences, sandboxes, grants that pay the buyer to adopt, and the Singapore Fintech Festival that fills this city every November. The founders I interviewed assumed the floor was the regulator. For most vendors it is not. It is the set of controls a licensed customer must evidence before it can sign. Clear that floor and the rest of the system starts working for you.

This month

On 16 November I open the Polish Fintech Mission’s programme with a workshop on exactly this for 11 founders, and on 19 November the Demo Day brings them in front of Singapore’s investors and institutions.

If you are one of the many foreign fintechs meeting a Singapore bank for the first time during the Singapore Fintech Festival, arrive with a professional third-party risk assessment already done. Bring a readiness report that answers what sits inside the bank’s procurement and third-party risk process, instead of questions about it. That is what shortens procurement.

—

Editor’s note: e27 aims to foster thought leadership by publishing views from the community. You can also share your perspective by submitting an article, video, podcast, or infographic.

The views expressed in this article are those of the author and do not necessarily reflect the official policy or position of e27.

Join us on WhatsApp, Instagram, Facebook, X, and LinkedIn to stay connected.

The post Before the licence: What Singapore’s regulated institutions ask a fintech partner first appeared first on e27.