A step-by-step guide to the Singapore DPT licence under the PSA — covering who needs it, SPI vs MPI thresholds, key requirements, and ongoing obligations.

Any business providing digital payment token (DPT) services in Singapore must hold a valid licence from the Monetary Authority of Singapore (MAS). That obligation applies whether you operate a crypto exchange, an OTC desk, a custodial wallet service, or a platform that facilitates DPT transfers — and it extends to Singapore-incorporated entities serving clients overseas.

The regulatory framework has expanded materially since 2022. Amendments to the Payment Services Act (PSA) that took effect in April 2024 widened the scope of regulated DPT activities. A separate regime under the Financial Services and Markets Act (FSMA) came into force in June 2025 for entities providing digital token services exclusively to overseas customers.

This guide walks through the full application roadmap: who needs a licence, which licence type applies, what MAS expects from applicants, and what obligations persist after approval.

What Is a DPT Licence in Singapore?

A DPT licence is a legal authorisation issued by MAS under the Payment Services Act 2019 (PSA). It permits a business to provide regulated services involving digital payment tokens — a category that covers most cryptocurrencies, including Bitcoin and Ethereum.

The PSA defines “digital payment token service” as dealing in DPTs or facilitating their exchange. Following the April 2024 amendments, the definition was extended to include custodial services for DPTs, facilitation of DPT transmission between accounts, and facilitation of DPT exchange even where the provider does not take possession of the tokens or funds.

MAS treats DPT licensing as a higher-risk activity. The expectations placed on applicants are institutional-grade across governance, technology risk, AML/CFT controls, and capital adequacy — not startup-grade.

Who Needs a DPT Licence?

Licensing is activity-based, not entity-based. The relevant question is what your business does, not what it is called.

Any business offering the following services in Singapore must hold a MAS licence:

• Buying, selling, or exchanging DPTs for fiat or other DPTs
• Facilitating DPT transfers between accounts
• Providing custodial services for customer DPT holdings
• Facilitating DPT exchange without taking possession of assets

Operating these services without a licence is a criminal offence under the PSA. MAS maintains a public register of licensed DPT providers, and unlicensed activity is straightforwardly detectable.

The licensing obligation also applies to Singapore-incorporated companies serving clients abroad. From 30 June 2025, such entities must hold a Digital Token Service Provider (DTSP) licence under the FSMA — a separate and more restrictive regime discussed below.

The Regulatory Framework: PSA, FSMA, and SFA

Singapore’s crypto regulation is activity-based and spans three statutes. Understanding which applies to your business is the first practical step.

• Payment Services Act 2019 (PSA): The primary law for DPT services provided to customers in Singapore. Licensing under the PSA results in either a Standard Payment Institution (SPI) or Major Payment Institution (MPI) licence.
• Financial Services and Markets Act 2022 (FSMA): Governs Singapore entities providing digital token services solely to customers outside Singapore. The DTSP regime under FSMA Part 9 took effect on 30 June 2025. MAS has stated it will grant DTSP licences only in extremely limited circumstances, citing heightened money laundering and terrorism financing risks.
• Securities and Futures Act (SFA): Applies where a token qualifies as a capital markets product — for example, tokens representing equity, debt, or interests in a collective investment scheme.

Misclassifying your token type at the outset can redirect the entire application to the wrong regulatory framework. This is one of the most common and costly early errors.

For businesses whose activities span multiple regulated categories — such as crypto exchange combined with cross-border transfers — a single PSA licence can cover several services under the modular structure. This is worth mapping carefully before filing. Our Jurisdiction Advisory service covers this scoping exercise as part of the pre-application phase.

SPI vs MPI: Choosing the Right Licence Type

The PSA provides two licence tiers: Standard Payment Institution (SPI) and Major Payment Institution (MPI). The correct tier depends primarily on your projected monthly transaction volumes.

An SPI licence applies where monthly transactions remain below the following thresholds:

• SGD 3 million for any single payment service
• SGD 6 million across two or more payment services combined
• SGD 5 million of daily outstanding e-money

If your volumes exceed any of these thresholds — or are expected to do so — an MPI licence is required.

The two tiers carry different capital requirements and obligations:

For most DPT-active businesses — exchanges, OTC desks, and custodians — the MPI is the relevant licence. MAS treats DPT providers as higher-risk by default, and the compliance burden reflects that.

Core Eligibility Requirements

Before submitting an application, your entity must satisfy MAS’s baseline eligibility criteria. These are non-negotiable and must be met at the point of submission — not merely committed to for the future.

Corporate structure:

• Singapore-incorporated company or a Singapore branch of a registered foreign corporation
• Permanent place of business in Singapore where books and records are maintained
• At least one person present at the place of business to handle consumer queries and complaints

Governance and fit-and-proper:

• At least one executive director who is a Singapore citizen or permanent resident (or an Employment Pass holder supported by a non-executive director who is a citizen or PR)
• All directors, substantial shareholders, and key management personnel must satisfy MAS’s fit-and-proper criteria — covering financial soundness, integrity, and relevant competence
• Controllers are subject to MAS assessment before and after any change in ownership

Capital:

• Minimum base capital of SGD 100,000 (SPI) or SGD 250,000 (MPI)
• Capital buffer above the base requirement, calibrated to the scale and risk of operations
• MAS may additionally require a banker’s guarantee, professional indemnity insurance, or a security deposit

If you are structuring your entity from scratch for this application, GSS Legal’s Corporate Formation service covers Singapore entity incorporation with these regulatory requirements built in from the start.

The Application Roadmap: Step by Step

MAS evaluates applicants on operational readiness, not intent. The process tests whether your business can safely operate as a regulated financial institution — not whether it plans to. Below is the practical sequence.

1. Confirm your regulatory scope — Map your business model precisely to the PSA activity definitions. Determine whether you are in-scope for PSA, FSMA, or SFA regulation (or a combination). Identify token types, customer geography, and transaction flows.
2. Choose your licence tier — Based on current or projected transaction volumes, determine whether SPI or MPI applies. Over-engineering an SPI application that will breach thresholds after launch is a common and costly mistake.
3. Incorporate your Singapore entity — The applicant must be a Singapore-incorporated company. Appoint your executive director(s), establish your registered address, and confirm the physical place of business before filing.
4. Design your compliance framework — Build your AML/CFT programme, including a compliance manual, transaction monitoring rules, suspicious transaction reporting workflows, and a FATF Travel Rule mechanism. For DPT transfers of SGD 1,500 or more, originator details must be passed to the beneficiary institution before or at the time of transfer.
5. Build technology risk management controls — MAS expects documented Technology Risk Management (TRM) frameworks, penetration test results, an incident response plan, vendor due diligence records, and a business continuity plan (BCP).
6. Prepare financial projections and capital documentation — Provide audited or forecasted balance sheets, 12-month cashflow models, and capital buffer calculations. If a security deposit is required for MPI, include evidence of banking facilities.
7. Compile and submit the application — Download and complete MAS specimen forms. Attach all required documents. Submit via MAS’s GoBusiness portal. Pay the application fee (SGD 1,000 per service for SPI; SGD 1,500 per service for MPI).
8. Respond to MAS queries — MAS will issue requests for information during the review. Response quality and speed at this stage directly affects the timeline. Incomplete or inconsistent answers are the most common cause of delays.
9. Receive In-Principle Approval (IPA) — If MAS is satisfied, it issues an IPA subject to conditions. These conditions typically include completing an external AML/CFT audit and demonstrating full operational readiness.
10. Satisfy IPA conditions and receive the final licence — Once all conditions are met, MAS issues the formal PSA licence. Operations may then commence under ongoing supervisory oversight.

Our Crypto & VASP Licensing practice covers each of these stages, from initial scope mapping through submission to post-IPA condition fulfilment.

Documents and Compliance Checklist

MAS expects a complete, internally consistent application package. The following items are required for DPT applications under the current Guidelines on Licensing for Payment Service Providers (PS-G01):

Corporate documents:

• Certificate of incorporation and constitutional documents
• Organisational chart and group structure
• CVs and personal declarations for all directors, substantial shareholders, and key management
• Fit-and-proper declarations and background check results

Business model documents:

• Detailed business plan, including product description, fund flow diagrams, and customer journey maps
• Independent legal opinion on business model compliance with the PSA (mandatory for all new applicants since 2024)
• Technology architecture overview

AML/CFT and compliance documents:

• Bespoke AML/CFT policies and procedures manual
• Transaction monitoring rule logic and escalation workflows
• Sample suspicious transaction reporting (STR) workflows
• FATF Travel Rule compliance procedures
• For DPT services: independent external audit report on AML/CFT systems and consumer protection controls

Technology risk documents:

• TRM risk register
• Penetration test summaries
• Incident response plan
• Vendor due diligence records
• Business continuity plan

Financial documents:

• Audited or forecast balance sheets
• 12-month cashflow model
• Capital buffer calculation
• Evidence of banking facilities if a security deposit is required

GSS Legal’s AML & Compliance team develops the AML/CFT programme and policy documentation as a standalone service or as part of the broader licensing engagement. Separately, our Banking & EMI / PSP service assists with the banking setup required to satisfy MAS’s customer asset segregation requirements.

Ongoing Obligations After Licensing

Receiving the licence is not the end of the compliance cycle. MAS’s post-licensing expectations for DPT service providers are substantial and have been tightened further since October 2024.

Customer asset safeguarding:

• All customer assets must be held under a statutory trust and segregated from the firm’s own assets
• Customer assets must be placed in a trust account at a Singapore-licensed bank
• At least 90% of customer crypto assets must be held in cold storage at all times
• Separate blockchain addresses must be maintained for customer and firm assets
• All transactions on customer assets require authorisation from at least two parties
• Daily reconciliation of customer balances is mandatory

Regulatory reporting (MPI):

• Monthly returns via Form 6A (transaction data including DPT buying/selling volumes and transfer values)
• Semi-annual returns via Form 6B
• Annual external audit covering AML/CFT systems and consumer protection controls

Conduct obligations:

• Retail customers may not use their DPT holdings for lending or staking arranged by the provider
• For non-retail customers, lending and staking are permissible with explicit written consent and clear risk disclosures
• Risk disclosure requirements under PS-G03 (Guidelines on Consumer Protection Measures by DPT Service Providers) apply to all customer communications
• FATF Travel Rule compliance for all DPT transfers of SGD 1,500 or more
• CDD records, transaction records, and STR documentation must be retained for a minimum of five years

MAS may also impose additional conditions specific to individual licensees — covering areas such as geographic scope, product restrictions, or enhanced capital requirements — depending on the assessed risk profile of the business.

Timeline and Application Fees

MAS typically takes 6 to 12 months to process a DPT licence application. Applications that include DPT services commonly sit towards the longer end of that range.

The processing timeline is not fixed. MAS reviews applications on a rolling basis and will pause the clock while awaiting responses to its information requests. A well-prepared application with a clean AML/CFT framework and a clearly articulated business model moves faster than an incomplete one.

Application fees are modest relative to the total compliance investment:

• SPI: SGD 1,000
• MPI: SGD 1,500

The larger cost drivers are entity establishment, legal and compliance advisory fees, capital funding, technology infrastructure, and the external audit required before a licence is granted.

Common Reasons for Delays and Rejections

MAS has set a high bar for DPT licensing and does not lower it for applicants who appear credible but underprepared. The most frequent causes of extended timelines or refusals are:

• Incomplete or inconsistent AML/CFT documentation. Generic AML policies copied from templates do not meet MAS’s expectation for bespoke, business-specific controls. MAS expects demonstrable transaction monitoring logic, tested workflows, and a properly appointed compliance officer at management level.
• Unclear business model or fund flows. MAS requires a precise map of how funds and tokens move through the platform, who controls assets at each point, and how the firm’s own funds are separated from customer assets.
• Weak governance structure. Absent or insufficiently qualified directors, missing Singapore residency requirements, or controllers who cannot satisfy fit-and-proper criteria are grounds for refusal.
• Insufficient capital or unclear capital sourcing. MAS assesses not only whether base capital is met but whether the capital buffer is credible given the business’s projected scale.
• Technology risk gaps. DPT providers are expected to submit TRM documentation, penetration test results, and incident response plans — not just confirm that systems exist.
• Token misclassification. Applying under the PSA for a token that falls under the SFA, or failing to distinguish DPT activities from e-money activities, can redirect the entire application or result in a requirement to apply for additional licences.

Engaging regulatory counsel before application — rather than at the query-response stage — is the most reliable way to avoid these issues. GSS Legal has guided clients through the MAS licensing process across both PSA and FSMA frameworks, with a focus on first-pass approvals. You can review relevant experience on our Success Cases page.

Final Observations

The DPT licensing regime in Singapore is rigorous by design. MAS does not treat crypto businesses as technology startups operating under lighter rules — it applies institutional-grade standards from day one, across governance, AML/CFT, technology risk, and customer asset protection.

The framework has also expanded materially. The April 2024 PSA amendments broadened the scope of regulated DPT activities. The June 2025 FSMA regime extended licensing obligations to Singapore entities serving overseas clients. Businesses that were previously outside the perimeter may now be inside it.

For founders, compliance officers, and legal counsel assessing this path, the practical priority is accurate scope mapping before any structural or compliance work begins. The licence tier, entity structure, capital positioning, and AML/CFT framework all follow from that initial determination. Getting it wrong early compounds at every subsequent stage.

If you are evaluating the DPT licence as part of a broader jurisdictional strategy, our Jurisdiction Advisory service compares Singapore against other regulated markets — including the EU’s CASP regime, UAE VARA, and Labuan FSA — based on your specific business model, target markets, and operational requirements. See our full range of Services or browse related Insights for further reading.