MAS Payment Services Act: Crypto (DPT) Licensing Pathway
Any business that provides digital payment token (DPT) services in or from Singapore needs a licence from the Monetary Authority of Singapore under the Payment Services Act 2019. This guide covers which licence applies, what MAS assesses, the AML and user-protection rules that apply once licensed, and how the 2025 rules for offshore-only providers changed the picture.
Singapore was one of the first major financial centres to bring crypto businesses into a full licensing regime. The framework has tightened steadily since: the PS Act took effect in 2020, its scope was widened in April 2024, user-protection rules followed later that year, and the offshore-only loophole closed in June 2025.
For a firm planning to operate a DPT business from Singapore, the practical questions are which licence to apply for, what MAS will look at, and what the AML and conduct obligations look like on day one. This guide answers each in turn. For the AML notice that covers non-crypto payment firms, see our guide to MAS Notice PSN01.
What Counts as a DPT Service in Singapore
A digital payment token is, broadly, a digital representation of value that is not denominated in a fiat currency, can be transferred electronically and is intended as a medium of exchange accepted by the public — bitcoin and ether are the obvious examples. Providing a DPT service means dealing in DPTs or facilitating their exchange as a business.
From 4 April 2024, amendments to the PS Act widened the definition to cover:
- Custodial services for DPTs — holding tokens or private keys on behalf of customers.
- Facilitating the transmission of DPTs between accounts, and facilitating their exchange, even where the provider never takes possession of the money or the tokens.
- Facilitating cross-border money transfers, even where the money is not accepted or received in Singapore.
Firms already carrying on the newly covered activities had to notify MAS within 30 days and apply for a licence within six months, accompanied by an external auditor's attestation on their business and AML/CFT compliance within nine months, to keep operating while MAS reviewed the application.
Stablecoins: on 1 September 2026 MAS consulted on legislative amendments to the PS Act to implement its stablecoin regulatory framework. Issuers and intermediaries dealing in stablecoins should track that consultation; it is not yet law.
SPI or MPI: Which Licence Applies
DPT service providers apply for one of two licences under the PS Act. The deciding factor is transaction volume.
| Standard Payment Institution (SPI) | Major Payment Institution (MPI) | |
|---|---|---|
| Who it is for | Below all threshold limits | Above any threshold limit |
| Transaction thresholds | Under S$3m a month for any one payment service; under S$6m a month for two or more services; under S$5m daily outstanding e-money | No limit on volume or e-money float |
| Minimum base capital | S$100,000 | S$250,000 |
| Security with MAS | Not required | S$100,000 if monthly transactions average ≤ S$6m for any one payment service; S$200,000 otherwise — as a cash deposit or bank guarantee |
| Legal form | Singapore-incorporated company or Singapore branch of a foreign company | Same |
Both licences also require a permanent place of business or registered office in Singapore, at least one person present there to deal with customer queries, and either one executive director who is a Singapore citizen or permanent resident, or one executive director who holds an Employment Pass plus at least one other director who is a citizen or PR. A firm that starts as an SPI and grows past the thresholds must move to an MPI licence.
What MAS Assesses in an Application
MAS considers each application on its merits. Its published assessment criteria for both licence types are:
- Fitness and propriety of controllers and directors, under MAS's Guidelines on Fit and Proper Criteria (FSG-G01).
- Competency of key individuals — real experience in payments or related financial services.
- Compliance arrangements proportionate to the business, against the minimum set out in Appendix 2 of the Guidelines on Licensing for Payment Service Providers (PS-G01).
- Technology risk management — firms offering online services must complete a penetration test, fix every high-risk finding and have the fixes independently validated before the licence is granted.
- Audit arrangements, including plans to meet the annual audit requirement in section 37 of the PS Act.
- Letters of responsibility or undertaking from major shareholders or parent companies, where MAS asks for them.
MAS may also weigh the group's track record and financial condition, operational readiness, the parent's commitment to Singapore, whether the group is properly supervised elsewhere, and whether granting the licence serves the public interest.
AML/CFT Obligations: MAS Notice PSN02
Licensed DPT service providers must comply with MAS Notice PSN02, Prevention of Money Laundering and Countering the Financing of Terrorism — Digital Payment Token Service, in force since 28 January 2020. Its core obligations mirror the AML notices for banks:
- Customer due diligence — identify and verify customers and beneficial owners, understand the purpose of the relationship, and apply enhanced measures to higher-risk customers and PEPs.
- Ongoing monitoring of transactions and the relationship, including screening against sanctions lists.
- Travel rule — originator and beneficiary information must accompany DPT transfers, with the fuller data set required for transfers above S$1,500. See our travel rule guide for how VASPs implement it.
- Suspicious transaction reports to the Suspicious Transaction Reporting Office (STRO).
- Record keeping and an independent audit of the AML/CFT framework.
Our MAS compliance page covers how these obligations map to day-to-day controls across Notices 626, PSN01 and PSN02.
User Protection and Retail Restrictions
The April 2024 amendments also gave MAS powers to impose user-protection and financial-stability requirements on DPT providers. Two sets of rules now apply:
Safeguarding customer assets (Payment Services Regulations, in force six months after 4 April 2024): customers' assets must be segregated and held in a trust account for the customers' benefit, with proper books and records and effective systems and controls to protect their integrity and security.
Consumer protection guidelines (PS-G03, issued 2 April 2024 and revised 19 September 2024) set expectations on custody and on dealings with retail customers, including:
- a risk awareness assessment before a retail customer can access DPT services;
- restrictions on offering incentives to retail customers; and
- restrictions on providing credit or leverage to retail customers for DPT transactions.
These are conduct requirements, but they change onboarding design: the risk awareness assessment sits in the same flow as KYC, and the retail/non-retail classification has to be captured and kept current.
Offshore-Only Providers: The DTSP Regime
Until mid-2025, a Singapore company could serve crypto customers only outside Singapore without a PS Act licence. That ended on 30 June 2025, when the digital token service provider (DTSP) provisions of the Financial Services and Markets Act 2022 (FSMA) came into force.
The DTSP regime requires a licence for Singapore-incorporated companies, and for individuals and partnerships operating from a place of business in Singapore, that provide digital token services outside Singapore — covering both DPTs and tokenised capital markets products.
On 6 June 2025 MAS stated that it would generally not issue DTSP licences, that the bar is set high, and that firms without one must cease the activity. There was no transitional period. In practice, a firm that wants to run a crypto business from Singapore must hold a PS Act licence and serve the Singapore market under it, or move the activity elsewhere.
The Licensing Pathway, Step by Step
Map your activities to the PS Act
List every service you provide — dealing, exchange, custody, transfers, cross-border money transfer — against the PS Act definitions. MAS publishes licensing self-check tools on its website for this purpose. Mis-mapping a service is the quickest way to apply for the wrong licence.
Choose SPI or MPI
Project transaction volumes for at least the first two years. If you expect to cross S$3 million a month in any one service, plan for an MPI from the outset rather than migrating mid-growth.
Set up the Singapore entity
Incorporate (or register a branch), secure a permanent place of business, appoint directors who meet the residency requirement, and fund base capital — plus the MAS security for an MPI.
Build the compliance framework
Appoint a compliance officer, write AML/CFT policies to PSN02, and put CDD, sanctions and wallet screening, transaction monitoring, travel rule and STR filing into production. Add the PS-G03 retail measures and asset-segregation arrangements.
Complete the technology risk work
Run the penetration test on your online services, remediate every high-risk finding, and obtain independent validation before MAS grants the licence.
Apply and respond to MAS
Submit the application with the supporting documents and expect detailed follow-up questions. MAS considers each application on its own merits; there is no fixed approval timeline.
Operate to the ongoing requirements
Once licensed: annual audits under section 37, regulatory returns, notification of changes, continuing PSN02 compliance and periodic review of the AML/CFT framework.
Frequently Asked Questions
Do I need a licence to run a crypto exchange in Singapore?
Yes. Operating a crypto exchange is a digital payment token service under the Payment Services Act 2019, which requires a Standard Payment Institution or Major Payment Institution licence from MAS.
What is the minimum capital for a DPT licence in Singapore?
S$100,000 base capital for a Standard Payment Institution and S$250,000 for a Major Payment Institution. An MPI must also lodge security of S$100,000 or S$200,000 with MAS, depending on transaction volumes.
What is the difference between an SPI and an MPI licence?
Volume. An SPI licence covers firms below S$3 million a month for any one payment service, S$6 million for two or more, and S$5 million daily outstanding e-money. Above any of those limits, a firm needs an MPI licence.
Can a Singapore company serve only overseas crypto customers?
Not without a licence. Since 30 June 2025, Singapore companies providing digital token services only outside Singapore need a DTSP licence under the Financial Services and Markets Act 2022, and MAS has said it will generally not issue them.
Which AML notice applies to crypto firms in Singapore?
MAS Notice PSN02, which covers customer due diligence, ongoing monitoring, the travel rule for DPT transfers, suspicious transaction reporting and record keeping for licensed DPT service providers.
Sources
- MAS — Licensing for Payment Service Providers
- MAS — Expands Scope of Regulated Payment Services; User Protection Requirements for DPT Service Providers (2 April 2024)
- MAS — Clarifies Regulatory Regime for Digital Token Service Providers (2025)
- MAS — Guidelines on Consumer Protection Measures by DPT Service Providers (PS-G03)
This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.
AML Controls Built for MAS-Licensed DPT Firms
One Constellation brings KYC, sanctions and PEP screening, transaction monitoring and STR workflows into one platform aligned to MAS requirements — so your AML framework is operational from day one of your licence.
