Singapore's Payment Services Act (PSA), administered by the Monetary Authority of Singapore (MAS), is the primary gateway for any business offering staking services to customers in or from Singapore. Whether a staking arrangement constitutes a Digital Payment Token (DPT) service – the regulated activity class under the PSA – turns on the substance of what the operator does, not on how the product is described. A staking aggregator that pools customer tokens, manages validator infrastructure, and distributes rewards occupies materially different regulatory ground than a pure on-chain protocol with no custodial layer. Getting that distinction right before launch is the operative question for any inbound operator.
This guide maps the regulated basis for staking services in Singapore, the MAS licensing process, the cross-border tax and banking considerations that operators routinely encounter, and the decision points that determine which licence track applies.
How does staking fit the MAS regulatory perimeter?
Staking services fall inside the MAS regulatory perimeter when the operator takes custody of customer tokens, pools them for validator delegation, or exercises discretion over the staking strategy on behalf of customers. Under the PSA regime, the relevant trigger is whether the operator is providing a DPT service – which includes buying, selling, or facilitating the exchange of DPTs, or providing a DPT exchange or transfer service. A managed staking product, where the operator holds keys and deploys customer assets, is a strong candidate for that characterisation. A non-custodial staking interface, where the protocol merely routes instructions and the customer retains key control throughout, sits in a different position – though MAS has signalled that substance, not form, drives the analysis.
The PSA creates three licence tiers: a Money-Changing Licence, a Standard Payment Institution (SPI) licence, and a Major Payment Institution (MPI) licence. For DPT services, most operating businesses will land on the SPI or MPI track depending on transaction volume and the nature of services offered. The capital and operational requirements scale accordingly – though the specific thresholds are set by MAS and should be confirmed against current published guidance, as they are subject to revision.
Token classification intersects here. If the token being staked carries rights that resemble a security – profit participation, governance rights that confer economic entitlement, or fractional ownership of an underlying asset – the staking product may engage the Securities and Futures Act (SFA) and the Capital Markets Services (CMS) licensing regime administered by the SFC's Singapore analogue. That is a materially heavier regulatory path. The AUDIENCE_PAIN is real: mis-classifying a token as a utility asset when it carries security-like rights can convert a product launch into an unregistered capital-markets offering.
What does the MAS licence application process look like?
The MAS DPT licensing process is structured and predictable, but it is not fast. Operators should plan for a process measured in months, not weeks, from the point of submitting a complete application. MAS conducts a thorough fit-and-proper assessment of shareholders, directors, and key appointment holders, alongside a detailed review of the applicant's AML/CFT controls, technology risk management, and consumer protection arrangements.
The preparation phase is typically the longest. Before a formal application is lodged, a well-advised operator will have resolved the following:
- Corporate structure – a Singapore-incorporated or registered entity is required for the MAS-licensed entity; the group holding structure above it needs to be documented.
- Ownership and control map – MAS requires full transparency on ultimate beneficial owners; opaque offshore holding chains create material delays.
- AML/CFT programme – a MAS-compliant programme including a written policies-and-procedures manual, a designated compliance officer, customer due diligence procedures, and Travel Rule arrangements for token transfers.
- Technology risk management – MAS's Technology Risk Management Guidelines apply; the operator must demonstrate system resilience, penetration testing and incident response capability.
- Business plan and financial projections – MAS reviews these as part of the viability assessment.
In our cross-border practice, we regularly advise operators who arrive with a product already in market and who then discover that the operational architecture does not map cleanly onto the MAS requirements. Retrofitting AML controls or technology risk documentation after launch is significantly more expensive than building them in from the outset.
The MAS licensing process for DPT services under the Payment Services Act follows a fit-and-proper and operational-controls assessment that runs in parallel with the formal application review. Operators should not treat the application as a paper exercise.
To scope your MAS licensing path and avoid structural problems before submission, write to OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the custody model – change the analysis. Map your options.
What is the Travel Rule obligation for staking operators?
Staking operators that transfer DPTs on behalf of customers are subject to Singapore's implementation of the Travel Rule – the obligation, drawn from the FATF Recommendation 15 framework, to pass originator and beneficiary information alongside virtual asset transfers. MAS has implemented this requirement, and it applies to DPT service providers licensed or exempt under the PSA.
For a staking service, the Travel Rule creates a practical challenge: when rewards are distributed or when a customer withdraws staked assets to an external wallet, that transfer may engage the rule. The operator must have a Travel Rule solution in place – either a purpose-built protocol (several are in commercial use) or a manual process for lower-volume operations. Transfers to unhosted wallets require additional due diligence under the MAS framework, and MAS has not adopted a de-minimis exemption that removes this obligation for small transfers. The precise de-minimis threshold applicable to any given operator should be confirmed against current MAS notices, as these have been updated since the PSA's original implementation.
Cross-border staking aggregators that pool assets from multiple jurisdictions face a compounding Travel Rule burden: they may simultaneously be subject to MAS requirements for their Singapore-nexus activity and to equivalent rules in the user's home jurisdiction. We have seen operators underestimate this compliance stack, particularly where the user base spans the EU (where MiCA's Travel Rule provisions apply), the UAE (where VARA has issued its own AML rulebook), and Singapore. A single Travel Rule solution that satisfies all three regimes simultaneously requires careful vendor selection and legal mapping.
How does token classification affect a staking product in Singapore?
Token classification is the foundational legal question for any Singapore staking service. MAS applies a substance-over-form analysis: the rights conferred by a token determine its regulatory treatment, not the label on the whitepaper. A common assumption – that placing the word "utility" in a whitepaper settles the classification – is the most consequential myth in this space. It does not.
The classification matrix for Singapore operates across three broad outcomes. First, a token may be a DPT – a digital representation of value that is not denominated in any currency, not pegged to any currency, and functions as a medium of exchange. Staking services for DPTs are regulated under the PSA. Second, a token may be a capital markets product – specifically a security, a unit in a collective investment scheme, or a derivative – in which case the SFA and the CMS licensing regime apply. Third, a token may constitute an e-money product under the PSA, engaging different licence conditions.
For a staking service, the economic structure of the reward matters as much as the underlying token. If a customer deposits tokens and receives a yield that is funded by a protocol's revenue, that may be characterised as a collective investment arrangement. If the yield derives from actual consensus-layer validation rewards passed through without discretion or pooling, the analysis differs. MAS has not published exhaustive bright-line guidance on every permutation, which means that pre-product legal analysis is not optional – it is the first step.
In our practice, we assess classification against the substance of rights, not the marketing label. That analysis informs both the licence track and the product architecture, because some structures can be modified at the design stage to avoid a heavier regulatory classification – and some cannot.
What are the cross-border tax and banking considerations for a Singapore staking operation?
Singapore does not impose capital gains tax on digital assets, which makes it structurally attractive for staking businesses that generate value through token appreciation. However, staking rewards – income earned through the provision of validation services or through a yield product – are treated as income for tax purposes in Singapore, subject to the ordinary corporate tax rate. The precise characterisation of any specific staking product requires analysis against the Inland Revenue Authority of Singapore (IRAS) guidance, which has evolved as staking models have diversified.
The cross-border layer adds complexity. A Singapore-licensed operator serving users in the EU will be subject to MiCA's consumer-facing rules for any EU-resident customer. An operator with a holding company in the BVI or Cayman Islands needs to document the economic substance of the Singapore operating entity to satisfy both MAS and international transfer-pricing requirements. We regularly advise on structuring the Singapore entity so that it satisfies the MAS's operational requirements while fitting cleanly within a group tax structure.
Banking access is a live issue. Singapore banks have adopted differentiated policies toward DPT service providers. Some major local and international banks provide accounts to MAS-licensed or exempt DPT operators; others apply elevated due diligence that results in prolonged onboarding timelines or account restrictions. In our cross-border practice, we have seen operators obtain a Singapore DPT licence only to find that their preferred banking partner has changed its DPT policy in the interim. The banking strategy should be developed in parallel with the licensing application, not after it.
If your banking or structuring strategy has hit a wall, contact OBOLUS at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back. Map your options.
How does a DeFi staking protocol fit in Singapore's regulatory regime?
A fully decentralised staking protocol – one with no custodial layer, no operator taking control of keys, and no identifiable intermediary providing a service to identifiable customers – sits at the edge of the MAS perimeter, not squarely within it. MAS has acknowledged that truly decentralised protocols present classification challenges. But the critical qualifier is "truly decentralised": in our experience, most products described as DeFi protocols retain meaningful centralisation at the governance, key management, or fee-extraction layer.
MAS has been clear that it will look through labels. A protocol operated by a Singapore-incorporated DAO (decentralised autonomous organisation) entity, funded by a Singapore-based development team, and marketed to Singapore-resident users is not insulated from the PSA merely by describing itself as decentralised. The relevant question is who controls the protocol, who benefits from it, and whether the protocol is providing a service to identifiable customers.
For operators building DeFi staking products, the Singapore regime creates a decision point: genuinely non-custodial, permissionless architecture may fall outside the PSA's scope, but it forecloses certain commercial models (institutional onboarding, fiat on/off ramps, custodied yield products). A custodial or semi-custodial model enables those commercial activities but requires a PSA licence. The architecture decision is therefore a legal decision as much as a product decision, and it should be made with legal input before development resources are committed.
One micro-matter illustrates the point. In a recent pre-launch matter, a protocol development company had built a staking aggregator with a pooling mechanism that it described as non-custodial in its documentation. We reviewed the smart-contract architecture and identified that the operator's administrative key could pause withdrawals and redirect rewards – a custody-equivalent control. Resolving this required a redesign of the administrative key structure before launch. The operator avoided a product launch that would have engaged the PSA without a licence.
What is the decision matrix for staking operators entering Singapore?
The correct licensing path for a Singapore staking operation depends on a cluster of variables that operators should map before engaging MAS.
Profile A – Custodial staking aggregator (institutional clients, pooled validator delegation, managed rewards distribution). This profile most directly engages the PSA DPT service provisions. The likely track is an MPI licence given the volume and service scope. The key risks are (a) token classification if the staked asset carries security-like rights and (b) Travel Rule compliance at scale. Timeline to licence: measured in months from a well-prepared submission.
Profile B – Retail staking interface (non-custodial, customer retains keys, operator earns a protocol fee). This profile may fall outside the PSA's custodial DPT service definition. However, if the operator's fee is charged in DPTs that it then converts or if the interface provides a transfer service, a DPT service nexus may still arise. An SPI licence may be required. Legal analysis of the specific architecture is necessary before concluding no licence is needed.
Profile C – Yield product on a staked base asset (fixed or variable yield, fund-like structure). This profile carries the highest classification risk. The yield mechanism may characterise the product as a collective investment scheme or a securities offering under the SFA. Capital markets licensing is more demanding than the PSA track in terms of capital, disclosure and ongoing obligations. This profile should be analysed against both the PSA and the SFA before any public-facing activity commences.
Profile D – DeFi protocol with Singapore operational nexus. As described in the preceding section, the DeFi label does not automatically exclude PSA application. The architecture review is the first step. If the protocol is genuinely non-custodial and permissionless, a legal opinion to that effect – documented and updated as the protocol evolves – is the appropriate risk-management tool.
Across all profiles, the cross-border element matters. If users are onboarded from jurisdictions with their own DPT licensing requirements – the EU under MiCA, the UAE under VARA, Hong Kong under the SFC VATP regime – Singapore licensing alone does not address the full regulatory exposure. Allied counsel in each relevant jurisdiction should be engaged in parallel.
Self-assessment checklist for Singapore staking operators
Before committing to a launch or a licence application in Singapore, an operator should be able to answer the following questions with documented analysis:
- Does the operator take custody of customer tokens at any point in the staking lifecycle? If yes, a DPT service licence is very likely required.
- Does the staked token carry rights – profit participation, governance rights with economic effect, or fractional asset ownership – that could characterise it as a capital markets product under the SFA?
- Does the staking yield mechanism operate as a pooled investment arrangement, or does it pass through consensus-layer rewards without discretion?
- Is a Singapore-incorporated entity the MAS-licensed operating entity? If a foreign entity is operating from Singapore, does it have an office or branch that requires registration?
- Is the AML/CFT programme MAS-compliant, including Travel Rule arrangements for all DPT transfers?
- Is the banking strategy confirmed for the licensed entity, in parallel with the licence application?
- Has the operator mapped user jurisdiction exposure and engaged allied counsel for each jurisdiction with material user numbers?
Operators who can answer each of these affirmatively, with documented analysis rather than assumptions, are in a structurally sound position to begin the MAS engagement.
Related at OBOLUS
- DeFi, Tokenization & Smart-Contract Law – our full practice coverage for digital-asset businesses building on-chain products
- DeFi Protocol Legal Structuring for Regulated Entities – structuring DeFi protocols to operate within regulated perimeters
- VARA Licence Application in El Salvador – the licensing pathway in an emerging VASP-friendly jurisdiction
FAQ
Can a DeFi protocol be regulated?
Yes. MAS and most leading regulators apply a substance-over-form test. A protocol described as decentralised is still subject to regulation if an identifiable entity controls key functions – such as pausing withdrawals, collecting fees, or upgrading contract logic. Genuine permissionlessness and the absence of a custodial or service layer may place a protocol outside the PSA scope, but that conclusion requires documented legal analysis of the specific architecture, not a label in a whitepaper.
What legal wrapper suits a DAO?
No universal answer applies. DAOs operating in Singapore with a commercial purpose typically require a legal entity to contract, hold assets, and employ staff. Options include a Singapore private limited company, a limited liability partnership, or – for DAOs with a broader membership structure – structures in the BVI or Cayman Islands that are more adapted to token-holder governance. The choice turns on the DAO's governance model, the jurisdiction of its primary activities, and the regulatory classification of its token.
Who is liable when a smart contract fails?
Liability for a smart-contract failure depends on the deployment structure, the operator's relationship with users, and whether any party made representations about the contract's behaviour. A non-custodial protocol with no operator-user service relationship occupies a different position than a licensed service provider that deployed the contract as part of a regulated product. Under Singapore law, contractual, tortious and consumer-protection analyses all potentially apply. Legal structuring before deployment – including terms of service, limitation of liability provisions, and oracle-risk disclosures – significantly affects the exposure.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions, on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We assess classification against the substance of rights, not the marketing label – and we advise operators building staking and DeFi products who need that analysis before launch, not after. To discuss your situation, contact info@oboluslaw.com.
By Roman Levitt, Technology & DeFi Counsel – specialising in smart-contract legal architecture, DeFi protocol structuring, and token classification under the MAS and MiCA regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.