Operating a digital-asset business in Singapore without the correct authorisation is not a grey area. The Payment Services Act (PSA), administered by the Monetary Authority of Singapore (MAS), brings exchanges, OTC desks, custodians and payment-token service providers squarely within a licensing regime that carries criminal penalties for unlicensed activity. With MAS supervision tightening across all major service categories and the regulator publicly culling applicants that do not meet its conduct and capital standards, the cost of getting the structure wrong – before a single trade is executed – can include frozen banking rails, a public enforcement notice and the loss of the operating window entirely.
Singapore offers three licence tiers under the PSA: a Money-Changing Licence, a Standard Payment Institution (SPI) licence and a Major Payment Institution (MPI) licence. Most digital-asset businesses that handle customer funds or operate a Digital Payment Token (DPT) service – the PSA's term for cryptocurrency exchange and transfer – require either an SPI or MPI authorisation, with the MPI tier applying above defined transaction-volume and e-money float thresholds that MAS specifies in its rules. This page sets out the legal basis, the process, the cross-border realities and the decision points an inbound operator needs to resolve before committing capital.
Who Needs a DPT Licence in Singapore?
Any business that buys or sells Digital Payment Tokens, facilitates DPT exchange, or transfers DPTs on behalf of customers in or from Singapore requires authorisation under the PSA. The test is activity-based, not entity-based. A Cayman-domiciled exchange with a Singapore-facing marketing site and a Singaporean bank account is within scope. MAS's position on this is explicit: soliciting Singapore residents triggers the licensing obligation regardless of where the legal entity is incorporated.
The regulated DPT services under the PSA include dealing in DPTs (operating a buy/sell desk), facilitating the exchange of DPTs (running a trading platform), transferring DPTs on behalf of customers, and providing custody of DPTs. Custody is a separately regulated activity, a point frequently missed by inbound operators who assume a primary exchange licence covers safeguarding. It does not. In our practice, entities that launch with an SPI and later add a custody product have had to return to MAS for a variation of their licence scope, adding both time and cost to the build.
Operators providing only software infrastructure – a wallet SDK without custody, a white-label matching engine without taking possession of funds – may fall outside the licensing perimeter, but the substance-over-form analysis matters. MAS assesses whether the operator effectively controls the assets at any point, not whether the contract document says it does not.
For a scoped assessment of whether your business model triggers the PSA DPT licensing requirement, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis.
SPI or MPI: Which Licence Tier Applies to Your Business?
The distinction between the Standard Payment Institution (SPI) and the Major Payment Institution (MPI) tiers turns on transaction volume and e-money float thresholds set by MAS: businesses that exceed those thresholds in any calendar year must hold an MPI licence. Most institutional-grade exchanges, high-volume OTC desks and custody-plus-transfer businesses will reach MPI territory quickly. The SPI tier is appropriate for early-stage businesses with limited transaction flow, but the practical path for a viable crypto business is almost always the MPI.
The MPI carries heavier ongoing obligations: higher paid-up capital requirements (the specific figure is set by MAS and should be confirmed against current legislation), more prescriptive AML/CFT requirements aligned with FATF Recommendation 15, mandatory safeguarding of customer funds and a more demanding fit-and-proper assessment of directors and controllers. The SPI involves lighter capital and safeguarding obligations, though the AML/CFT regime is substantively similar. Both tiers require the business to appoint a Singaporean-resident director and to maintain a registered office in Singapore.
Where a business straddles the volume thresholds – plausible in the first operating year – MAS expects the applicant to project growth conservatively and apply for the higher tier. An operator that obtains an SPI and then crosses the MPI threshold faces mandatory notification and licence conversion. That transition process is not instantaneous; businesses have operated in technical breach during conversion delays. Structuring the application for the right tier from the outset avoids that exposure.
What Does the MAS Application Process Involve?
A DPT service licence application to MAS is a multi-stage submission that requires the business to demonstrate legal substance, financial adequacy, governance quality and AML/CFT readiness before a licence is granted. MAS has been transparent that it will reject applications that do not meet its threshold on any of these dimensions; the regulator's published refusal and withdrawal statistics confirm a meaningful attrition rate among applicants.
The core submission components are: a detailed business plan with projected volumes and revenue; corporate structure diagrams and source-of-funds documentation for all controllers; fit-and-proper declarations and supporting documentation for all directors, CEOs and shareholders above the prescribed threshold; a technology risk-management framework aligned with MAS's technology risk guidelines; an AML/CFT policies and procedures manual covering customer due diligence, transaction monitoring, suspicious-transaction reporting and record-keeping; and a safeguarding plan for customer assets. For the MPI, MAS also expects to see the capital and liquidity position evidenced.
Timeline is a consistent source of anxiety for operators. MAS processes PSA applications in a sequence that includes a completeness check, a substantive review and, in most cases, a clarification round. The overall review period varies by complexity and the regulator's current case load. We advise clients to treat the period from submission to licence grant as a matter of several months rather than weeks, and to build that buffer into their commercial timeline before they commit to exchange infrastructure, banking relationships or token-listing agreements.
During the application period, applicants may in some circumstances rely on the PSA's statutory exemption for businesses that filed a complete application before MAS's published deadline for existing operators. For new entrants, no such exemption applies; the business must not provide the DPT service until a licence or specific approval from MAS is in hand.
What Are Singapore's AML and Travel Rule Obligations for DPT Providers?
Singapore implements the Travel Rule – the FATF obligation to pass originator and beneficiary data with each virtual-asset transfer – through MAS's Notice PSN02, which applies to all licensed DPT service providers. The Travel Rule is not a future obligation in Singapore: it is live, supervised and enforced. Licensed operators must collect, verify and transmit counterparty information on transfers above the applicable de-minimis threshold set by MAS.
The practical compliance challenge is interoperability. When a Singapore-licensed operator sends funds to a counterparty on a platform that does not support the same Travel Rule messaging protocol, the obligated institution faces a choice between delaying the transfer and documenting the gap, or proceeding without full compliance. MAS expects policies that address this, including enhanced due diligence for transfers to and from non-compliant jurisdictions and institutions.
Beyond the Travel Rule, the MAS AML/CFT Notice for DPT providers requires full customer due diligence on account opening, ongoing monitoring calibrated to transaction risk, enhanced scrutiny of politically exposed persons, screening against relevant sanctions lists and robust suspicious transaction reporting. For an exchange serving institutional clients across multiple time zones, building the operations and technology to meet these obligations in real time is a material cost item. We regularly advise operators on mapping their compliance stack to the MAS Notice requirements before the licensing assessment to avoid remediation costs after the licence is granted.
Cross-Border Banking and Tax: The Interaction with Singapore Licensing
A Singapore PSA licence is a powerful credential, but it does not resolve every cross-border legal question a digital-asset business faces. The most acute post-licence challenge for most operators is banking. Singapore's local banks apply their own risk appetite to DPT licensees; some have historically been reluctant to open accounts for crypto businesses regardless of regulatory status, though the position has evolved as MAS has clarified expectations. Operators we advise routinely hold primary banking relationships in more than one jurisdiction and maintain contingency rails in a second hub.
From a tax perspective, Singapore offers a relatively clean corporate regime: there is no capital gains tax, and the Inland Revenue Authority of Singapore (IRAS) has published guidance on the income-tax treatment of digital-token transactions and the GST treatment of DPT services (DPT services are treated as exempt from GST under current rules, though the analysis turns on the nature of the specific service). The absence of withholding tax on most outbound payments and Singapore's extensive treaty network make it a structurally efficient hub for regional operations. However, the tax analysis must account for where the economic activity actually occurs: substance requirements matter, and a shell Singapore holdco above an offshore operating entity will not reliably capture the treaty and GST benefits.
For funds and custodians with US-person investors or institutional counterparties, the US federal framework – SEC, CFTC and FinCEN classification of the assets and services – runs in parallel with the Singapore licence and is not displaced by it. The common assumption that a single offshore licence is sufficient to serve clients globally is one of the most consequential myths in digital-asset structuring. A Singapore MPI authorises operation from Singapore; it says nothing about the regulatory status of the operator in the jurisdictions where its customers are located. Operators with EU users must consider MiCA and ESMA's expectations. Operators with UK users face FCA financial promotion rules and the MLR registration regime. Each layer requires separate analysis.
If your Singapore licence application has stalled, or your banking structure needs a second read, contact OBOLUS at info@oboluslaw.com. If a prior application stalled or an account was closed, a second read can surface the structural reason and the route back.
Illustration: Licence Variation for an Expanding DPT Exchange
In a recent licensing matter, a payments-focused fintech had obtained a Standard Payment Institution authorisation for a DPT transfer service. Rapid growth in its trading volumes brought it close to the MPI thresholds within the first operating year. The operator had not built the capital, safeguarding and governance infrastructure required at the MPI tier. We worked with the client to prepare a phased compliance plan – including recapitalisation, a safeguarding account arrangement with a Singapore bank, and an updated AML/CFT manual – and managed the variation application with MAS. The transition was completed before the business breached the threshold, avoiding a mandatory notification event and preserving the operator's clean regulatory record.
A Common Assumption: "An Offshore Licence Covers Our Singapore Operations"
A common assumption among operators building a multi-jurisdictional structure is that holding a BVI, Cayman or even an EU-passported MiCA CASP authorisation dispenses with the need for Singapore-specific authorisation when serving Singapore residents. It does not. MAS takes a clear territorial approach: providing a DPT service to Singapore-based customers, or marketing to them from any location, triggers the PSA obligation if the operator lacks MAS authorisation.
The same logic runs in reverse. A Singapore MPI licence does not authorise the operator to provide DPT services to customers in jurisdictions where a separate local licence is required. EU residents require a MiCA-authorised operator. UK residents require FCA registration or a specific exemption. Hong Kong residents interacting with a trading platform for securities-type tokens require SFC VATP authorisation. Operators that ignore these parallel obligations risk enforcement from multiple regulators simultaneously – a scenario that is substantially harder and more expensive to manage than building the right multi-jurisdiction stack at the outset.
In our cross-border practice, we advise clients to map every jurisdiction where customers are located, where employees give investment instructions, and where banking assets are held – before the first licence application is submitted. That mapping exercise routinely surfaces obligations that were not visible from the founding jurisdiction alone.
Decision Matrix: Which Singapore Licence Profile Fits Your Business?
Profile A – an early-stage DPT exchange with sub-threshold transaction volumes, a small institutional client base and no custody offering – should apply for an SPI with a clear internal governance policy that triggers a review if volumes approach the MPI threshold. The timeline to authorisation is shorter and the capital requirement lower, but the operator should build MPI-grade AML/CFT infrastructure from day one to avoid a costly rebuild on conversion.
Profile B – a full-service exchange offering spot trading, custody, staking and OTC services to institutional clients – needs an MPI covering DPT dealing, exchange facilitation, transfer and, separately, custody. The application is substantively more complex and the capital requirement is materially higher; the timeline to licence grant is longer. The business should not launch the full product suite until MAS grants the relevant authorisations, even if the entity is incorporated and banking is in place.
Profile C – a global custodian or prime broker seeking a Singapore presence as an APAC hub – faces the most demanding MAS assessment, with particular focus on technology risk management, safeguarding and the fitness of senior management. Allied counsel in the relevant jurisdiction (for local corporate and tax matters) will be required alongside the MAS regulatory submission. The overall build timeline from entity incorporation to licence grant is typically measured in quarters, not weeks.
Every profile must separately address the cross-border obligations that arise from the customer base, the banking structure and the asset types being serviced. Singapore is the licence; the full legal stack is the combination of that licence plus whatever authorisations the operator's specific activity map requires in other jurisdictions.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – end-to-end authorisation strategy across 70+ jurisdictions, from regime selection to submission.
- Cayman Islands vs Hong Kong: Where to License a Crypto Business – a comparative analysis of two leading offshore and onshore licensing hubs.
- Staking and Rewards Taxation: The Structuring Angle – how token reward flows interact with Singapore and multi-jurisdiction tax positions.
FAQ
How long does a crypto licence take to obtain?
Timeline varies by jurisdiction and licence category. In Singapore, a PSA DPT service licence review by MAS typically spans several months from the point of a complete submission, with the duration influenced by application complexity, the quality of documentation and MAS's current case load. New entrants should not plan to launch before the licence is in hand, as the PSA exemption for pending applications applies only to businesses that filed within MAS's prescribed window for existing operators.
Which jurisdiction is best for licensing my crypto business?
There is no single correct answer. Singapore suits operators that need APAC credibility, institutional banking access and a well-developed AML/CFT regime. EU-facing businesses may prefer a MiCA CASP authorisation in a member state for passporting purposes. VARA in Dubai and ADGM in Abu Dhabi serve businesses focused on the Gulf and emerging-market corridors. The right answer turns on customer geography, asset types, banking needs and the operator's existing corporate structure. We map the full stack before recommending a primary hub.
Do I need a separate custody licence?
In Singapore, custody of DPTs is a regulated activity under the PSA and requires separate authorisation; it is not automatically covered by a DPT exchange or transfer licence. Operators that plan to hold customer assets – even as a secondary function of a trading platform – must ensure their licence scope expressly covers custody. The same principle applies in most other flagship regimes: VARA in Dubai, the SFC regime in Hong Kong and MiCA in the EU all treat custody as a distinct regulated activity requiring its own authorisation or express licence scope.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the entirety of our practice, and we act only for businesses. We map the licence, custody and payment stack before you commit capital – not after an enforcement notice arrives. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in PSA authorisation strategy, MAS engagement and multi-hub licence architecture for inbound digital-asset operators in Singapore and the APAC region.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.