Singapore is one of the most deliberate digital-asset licensing environments in the world. The Monetary Authority of Singapore (MAS), the city-state's central bank and integrated financial regulator, administers a tiered licensing regime under the Payment Services Act (the principal legislation governing Digital Payment Token, or DPT, services). Businesses that deal in DPTs – whether through exchange, transfer, custody or merchant-acquisition services – must hold an appropriate MAS licence before serving Singapore-resident clients or operating from a Singapore entity. Operating outside that perimeter means regulatory exposure, banking difficulties and, increasingly, enforcement action.
This page covers the full licensing picture: who the regulator is, which licence categories apply to which business models, what the application process involves, how AML and Travel Rule obligations intersect, and how Singapore sits relative to other leading hubs for an operator building a cross-border digital-asset business.
The Regulator and the Regime: MAS and the Payment Services Act
MAS regulates Singapore's digital-asset sector with a level of policy sophistication matched by few financial authorities globally. The Payment Services Act (PSA) is the primary instrument for DPT service providers, establishing a licensing framework that distinguishes between different payment activities and calibrates regulatory intensity accordingly. MAS has made clear, through successive policy consultations and enforcement actions against unregistered providers, that it views unlicensed DPT activity as a material compliance failure – not an administrative oversight.
The PSA operates alongside broader MAS supervisory expectations around technology risk, market conduct and consumer protection. Importantly, MAS also exercises oversight over token offerings that carry characteristics of capital markets products under the Securities and Futures Act. A token issuance that confers rights resembling equity, debt or a collective investment scheme falls within that separate regime, not the PSA DPT track. The boundary between these two regimes is one of the most consequential determinations an operator entering Singapore must make.
For businesses already licensed in another jurisdiction – say, under MiCA in the EU or a VARA licence in Dubai – MAS does not offer automatic passporting. Singapore licensing is a standalone requirement. Operators with a dual-market presence across South-east Asia and the EU frequently carry two licence stacks, and that complexity is something we address early in any structuring engagement.
What Are the DPT Licence Categories Under the PSA?
The Payment Services Act establishes three principal licence tiers, with different capital, transaction and business-scope parameters attached to each. Which tier applies depends on the nature of the DPT activity and its scale.
A Money-Changing Licence is the narrowest. It covers spot exchange between currencies and does not, in practice, extend to meaningful DPT service provision for most digital-asset businesses.
A Standard Payment Institution (SPI) licence applies to businesses whose DPT activities fall below the transaction and e-money thresholds set by MAS. For operators processing modest volumes – early-stage exchanges, crypto payment processors at launch stage – the SPI track can be appropriate. However, MAS calibrates its licensing conditions carefully, and businesses that anticipate growth should assess whether the SPI category will accommodate their operational trajectory without triggering a mandatory upgrade.
A Major Payment Institution (MPI) licence applies where a business exceeds the SPI thresholds in e-money float, daily transaction value or annual transaction value across its payment services. For most institutional exchanges, custodians and transfer services operating at scale, the MPI licence is the operative category. Capital, safeguarding, technology and conduct expectations at MPI level are materially more demanding.
In our licensing practice, we see most institutional-grade operators – exchanges, OTC desks and custodians entering Singapore – targeting the MPI track from the outset, building their compliance architecture to that standard rather than starting at SPI and restructuring later.
Who Needs a Singapore DPT Licence?
Any person carrying on a business of providing DPT services in Singapore requires a licence under the PSA. The territorial scope is anchored to the provision of services in Singapore – which MAS interprets broadly. Operating through a Singapore-incorporated entity, serving Singapore-resident clients from offshore, or establishing a regional hub in Singapore for South-east Asian operations each carries a licensing obligation. The test is not limited to physical presence.
Businesses that are frequently caught without the right authorisation include foreign exchanges onboarding Singapore-resident retail clients without a local licence, DeFi protocols with a Singapore-based team, and fund managers offering DPT exposure to Singapore investors without examining whether the vehicle itself requires PSA licensing in addition to the separate fund-authorisation regime.
The cross-border profile of digital-asset businesses makes the jurisdictional analysis non-trivial. A company incorporated in the British Virgin Islands, banking in the UAE, serving clients across South-east Asia and operated by a team in Singapore may trigger licensing obligations under Singapore law even if no formal Singapore entity exists. We regularly map these fact patterns for operators who believe their existing offshore structure is sufficient – it frequently is not.
The process above describes the standard licensing path. Your facts – where the entity sits, where clients are, where the banking is held – change the analysis materially. For a scoped assessment of your Singapore licensing position, contact OBOLUS at info@oboluslaw.com.
How Does the Singapore Licensing Application Process Work?
The MAS application process for a DPT licence is structured, sequential and document-intensive. MAS expects applicants to demonstrate a fully operational compliance programme before it will progress an application to substantive review. Submitting an incomplete or prematurely filed application extends the timeline and may signal to MAS a lack of operational readiness.
The pre-submission phase involves assembling the core corporate documentation – the group structure chart, the entity's constitutional documents, the business model memorandum, the AML/CFT policies and the technology risk documentation. MAS expects to see a qualified AML officer appointed, board-level governance in place and a material-risk assessment completed before the application is lodged.
Following submission, MAS conducts a completeness check before moving to substantive review. The substantive review encompasses fit-and-proper assessments of directors, controllers and key officers; a review of the compliance policies; and, for MPI applicants, a deeper assessment of the safeguarding and capital arrangements. MAS may issue clarification requests at any stage. Each response to an MAS query is an opportunity to demonstrate the calibre of the compliance team and legal counsel.
Timelines are not fixed by statute. In our experience advising on Singapore-track applications, operators with well-prepared documentation and clean corporate structures tend to see faster progress. MAS has publicly indicated its intention to process applications in a timely manner, but the pace is ultimately determined by the quality of what is submitted. A poorly prepared application can remain in review for considerably longer than a well-prepared one.
One practical point that applicants underestimate: the fit-and-proper review extends to all substantial shareholders and controllers, not just the executive team. For businesses with complex ownership structures or shareholders with prior regulatory history in other jurisdictions, this phase requires careful management.
AML, the Travel Rule, and Singapore's FATF Obligations
Singapore holds FATF membership and has implemented FATF Recommendation 15 for virtual asset service providers, including the Travel Rule – the obligation to transmit originator and beneficiary information alongside DPT transfers exceeding the applicable threshold. MAS has embedded Travel Rule compliance into PSA licence conditions, and compliance is an active expectation during both the application and the ongoing supervisory relationship.
In practice, MAS expects DPT licensees to have a Travel Rule solution that works across both VASP-to-VASP transfers and transfers involving unhosted wallets. The unhosted wallet question – how to handle transfers to addresses that are not associated with a licensed VASP – is one of the more technically and legally complex compliance challenges Singapore operators face. MAS has issued guidance on the approach it expects, and applicants are well advised to demonstrate a credible solution at the application stage rather than treating it as a post-licensing task.
Customer due diligence requirements for DPT service providers follow the standard AML/CFT framework under MAS Notice PSN02. Enhanced due diligence applies to higher-risk customers, politically exposed persons and transactions above defined thresholds. MAS has demonstrated a willingness to enforce: businesses that received in-principle approvals but failed to maintain their compliance standards have had those approvals revoked.
What Are the Substance and Capital Expectations?
MAS applies a substance-over-structure philosophy. A Singapore-licensed entity must maintain genuine operational substance in Singapore – a local management team with decision-making authority, a board with appropriate independent oversight, and a compliance function that is more than a letterbox. "Brass plate" structures that nominally locate a licence in Singapore while all real operations are conducted elsewhere do not satisfy MAS.
Capital requirements vary by licence tier and by the DPT activities being conducted. The specific minima are set out in MAS regulations and are subject to change; operators should verify current figures directly from MAS or through qualified Singapore counsel rather than relying on secondary sources. What is stable, and registered in our practice observations, is that MPI capital expectations are materially higher than SPI ones, and that MAS expects capital to be maintained on an ongoing basis – not just met at the point of licensing.
For custody-specific services, MAS imposes safeguarding obligations that require client assets to be segregated from the licensee's own assets and held in a manner that protects clients in the event of insolvency. Custody is a regulated DPT service in its own right, and an entity that provides both exchange and custody services within Singapore must ensure its licence covers both activities.
In a recent instructive matter, a fintech group expanding from South-east Asia into Singapore held an exchange licence but had not structured its custody offering as a separately authorised activity. We identified the gap during a pre-application review in the second half of the year, restructured the operating model, and the group entered the MAS application process with a compliant architecture rather than discovering the deficiency after launch.
Tax and Banking Considerations for Singapore-Licensed Operators
Singapore does not impose capital gains tax. Income derived from DPT trading by businesses is taxable under general corporate income tax principles – the treatment of whether DPT activity generates trading income or capital receipts is a fact-specific question that depends on the nature and frequency of the activity, the intention at the time of acquisition and the holding period. Operators should not assume that the no-capital-gains headline translates automatically into a nil tax outcome.
Goods and Services Tax (GST) treatment for DPT services has been subject to specific MAS and IRAS guidance. The application of GST to DPT transactions is jurisdiction-specific and has evolved; operators need current advice on their particular activity profile before structuring pricing or invoicing.
Banking access is a real and recurring challenge for Singapore DPT businesses. The major Singapore-headquartered banks apply their own risk appetite to DPT service providers, and not all licensed operators will find their MAS authorisation sufficient to secure a full banking relationship. Operators who assume that obtaining the licence automatically resolves the banking question are frequently surprised. In our cross-border practice, we advise on the banking strategy in parallel with the licensing strategy – the two are interdependent.
If a prior Singapore banking application stalled or your licence application hit compliance questions you did not anticipate, a structural review can surface the reason and the route forward. Write to our team at info@oboluslaw.com or message us via t.me/oboluslaw.
How Does Singapore Compare to Other Leading Digital-Asset Hubs?
Singapore occupies a distinct position in the global hub map. For South-east Asian market access, it is unmatched in regulatory credibility. MAS is regarded by institutional counterparties – prime brokers, custodian banks, institutional investors – as a benchmark regulator, and a Singapore licence carries reputational weight in the region and in dialogue with major financial institutions globally.
The trade-off is that MAS maintains a high bar for entry. VARA in Dubai operates across a different activity classification structure and has attracted operators who found MAS's substance expectations demanding. ADGM's FSRA in Abu Dhabi offers a separate common-law environment with strong institutional credibility, but serves a different regional market. For EU-facing operations, MiCA CASP authorisation through a member state is necessary regardless of a Singapore licence – there is no cross-recognition.
Operators choosing Singapore over alternatives typically present one of two profiles. The first is the business that genuinely operates in South-east Asia – exchange, OTC or fund – for which MAS regulatory credibility with local institutional partners is decisive. The second is the business that needs a common-law jurisdiction with strong court infrastructure for dispute resolution and asset recovery – Singapore's courts are among the most respected in Asia for commercial litigation, as evidenced by the Supreme Court's treatment of crypto assets as property.
A business sitting between Singapore and the EU faces a two-licence reality. We advise that group regularly: the Singapore entity holds the MAS licence; the EU entity holds the MiCA CASP authorisation from an appropriate member state. The intercompany arrangements, the transfer pricing and the group-wide AML posture must all be consistent across both regimes simultaneously. That is exactly the cross-border complexity our practice exists to manage.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – our full practice area overview for exchange, custody and payment licensing globally
- Crypto Exchange Licensing for Institutional Clients – exchange-specific authorisation strategy across leading jurisdictions
- Worldwide Freezing Orders in Lithuania – cross-border asset preservation in an EU common-law forum
FAQ
How long does a crypto licence take to obtain?
In Singapore, MAS does not publish a fixed statutory processing period. The realistic timeline depends heavily on the quality and completeness of the application submitted, the complexity of the group structure, and MAS's volume of concurrent applications. Well-prepared applications with clean ownership structures and fully developed compliance programmes progress materially faster than those requiring repeated clarification rounds. Operators should budget for a multi-month process rather than a matter of weeks.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. Singapore suits businesses with genuine South-east Asian operations or institutional counterparties who value MAS credibility. Dubai's VARA regime attracts operators who need activity-based licensing with strong regional banking. EU-facing businesses need MiCA CASP authorisation regardless. The right choice turns on where clients are, where banking sits, which institutional relationships are critical, and the operator's substance capacity. We map the full stack before any jurisdiction recommendation is made.
Do I need a separate custody licence?
Under the Singapore PSA, custody of DPTs is a regulated DPT service. A business that provides both exchange and custody services must ensure its licence scope covers custody specifically. An exchange-only licence does not authorise standalone custody activity. This is a common structural gap we identify in pre-application reviews: operators assume that holding client assets is incidental to the exchange service, when MAS treats it as a distinct regulated activity requiring explicit authorisation.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, disputes and on-chain asset recovery across 25+ forums, and the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and our disputes team coordinates freezing relief and on-chain tracing across leading common-law forums when preservation is urgent. To discuss your Singapore licensing position, contact us at info@oboluslaw.com.
By Aisha Tan, Licensing and Jurisdictions Analyst – specialising in MAS payment services licensing, cross-border VASP registration strategy and multi-hub licence stack design for institutional digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.