Yes. According to the Advisory Guidelines published by the Personal Data Protection Commission of Singapore, an organization may still collect, use or disclose an individual’s NRIC number (or copy of NRIC) if (a) it is required under the law or an exception under the Personal Data Protection Act applies; or (b) it is necessary to accurately establish or verify the identity of the individual to a high degree of fidelity (paragraph 3.1).
As StraitsX is licensed as a Major Payment Institution (MPI) under the Payment Services Act 2019, StraitsX is required by law to comply with MAS Notice PSN01 regarding the Prevention of Money Laundering and Countering the Financing of Terrorism.
This requires us to implement “know-your-customer” measures to establish and verify the identity of users, which includes their full name, unique identification number, residential address and date of birth, and nationality, among other information (paragraph 7.6 of PSN01).