A practical guide to MAS fintech licensing in Singapore — mapping payments, crypto, FX, and advisory business models to the right PSA, CMS, or FA licence.

Singapore’s Monetary Authority of Singapore (MAS) operates one of the most clearly structured financial licensing frameworks in Asia. For fintech operators, that clarity is both an asset and a demand: the framework is legible, but it requires you to identify precisely what your business does before you can determine which authorisation applies.

The foundational principle is straightforward. MAS licenses activities, not business types. Two companies that both describe themselves as “crypto platforms” may need entirely different authorisations depending on whether they deal in digital payment tokens, manage client funds, or offer investment products. Getting that classification wrong at the outset delays the application, increases compliance cost, and in some cases triggers enforcement.

This guide maps the principal MAS licence types to the fintech business models they govern — payments, crypto, FX and derivatives, fund management, and digital advisory — and sets out the capital requirements, thresholds, and application expectations that apply to each. It also covers the regulatory changes since mid-2024 that materially affect how MAS assesses applications today.

MAS Licenses Activities, Not Entities

The single most important thing to understand about MAS licensing is that the regulator does not issue a “fintech licence” or a “crypto company licence.” It authorises specific regulated activities. A Singapore-incorporated entity may need one licence, multiple licences, or none at all — depending solely on what it does.

This has practical consequences. A payments company that expands into FX hedging products may need to add a Capital Markets Services (CMS) licence on top of its existing Payment Services Act (PSA) authorisation. A crypto exchange that begins offering yield products may move from a PSA-regulated activity into securities territory, requiring a separate assessment under the Securities and Futures Act (SFA).

Starting the licensing process without first completing a rigorous activity-level analysis of your business model is one of the most common causes of application delays. MAS does not issue licences to entities that have not correctly characterised what they are doing.

The Legislative Map: Which Laws Apply

Multiple pieces of legislation can apply to a single fintech business. The primary statutes are:

• Payment Services Act 2019 (PSA) — governs payment service providers, e-money issuers, digital payment token (DPT) service providers, cross-border remittance, merchant acquisition, and account issuance
• Securities and Futures Act 2001 (SFA) — governs dealing in capital markets products (securities, derivatives, collective investment scheme units, OTC derivatives, spot FX), fund management, and custodial services
• Financial Advisers Act 2001 (FAA) — governs entities that provide financial advisory services, including automated digital advisory (robo-advisory) platforms
• Banking Act 1970 — applies to entities accepting deposits or conducting banking business, including digital banks
• Financial Services and Markets Act 2022 (FSMA) — provides the framework for licensing digital token service providers (DTSPs) serving customers outside Singapore, effective from 30 June 2025
• Insurance Act 1966 — regulates insurtech businesses operating as insurers or intermediaries
• Moneylenders Act 2008 — applies to consumer lending platforms not structured as banking entities

Cross-cutting obligations — AML/CFT, data protection under the Personal Data Protection Act (PDPA), and cybersecurity under MAS’s Technology Risk Management Guidelines — apply across all regulated activities regardless of which primary statute governs the business. For a detailed review of your AML and compliance obligations, see GSS Legal’s AML & Compliance service.

Payment Services Act: SPI, MPI, and the Money-Changing Licence

The PSA consolidates payments regulation into a single activity-based framework. It regulates seven distinct activities:

• Account issuance
• Domestic money transfer
• Cross-border money transfer
• Merchant acquisition
• E-money issuance
• Digital payment token (DPT) services
• Money-changing

Any business carrying on one or more of these activities must hold a PSA licence unless a specific exemption applies. The PSA provides three licence classes:

Standard Payment Institution (SPI)

The SPI licence is appropriate for lower-volume operators. An entity qualifies to operate under an SPI licence provided its monthly transaction volume for any single regulated activity does not exceed S$3 million, aggregate monthly volume across two or more activities does not exceed S$6 million, and average daily outstanding e-money float does not exceed S$5 million. Breaching any threshold triggers an obligation to upgrade to an MPI licence. For growth-stage businesses that expect to scale rapidly, applying directly for an MPI can avoid a disruptive licence transition.

Major Payment Institution (MPI)

The MPI licence applies to high-volume operators and carries additional obligations: safeguarding of customer funds, more rigorous ongoing reporting, and — for DPT services — independent external auditor assessments. There is no upper transaction limit under an MPI licence. Base capital requirements are higher than those for the SPI, as detailed in the timelines section below.

Money-Changing Licence

This licence is limited to entities whose sole regulated activity is the manual buying and selling of foreign currency notes. It is not relevant to most fintech models.

Digital Payment Token Services: Crypto Under the PSA

DPT services — covering businesses that buy, sell, facilitate the exchange of, or transmit cryptocurrencies and other digital payment tokens — are regulated under the PSA. The key jurisdictional question is not who your customers are, but where you operate from.

From 30 June 2025, the FSMA-based DTSP regime closed the regulatory gap for offshore-serving operators. Any entity providing DPT services from Singapore, whether its customers are Singapore residents or not, must now hold a PSA licence. MAS has stated it will generally not issue a licence to firms whose substantive regulated activity is entirely outside Singapore and whose business model creates elevated money laundering risk.

DPT service providers should also note that MAS now treats DPT licensing as a higher-risk activity category. Enhanced consumer protection rules introduced in October 2024 require DPT service providers to hold customer assets in trust or segregated accounts, complete daily reconciliations, and maintain specific custody disclosures. From June 2025, additional requirements around risk-awareness assessments, leverage restrictions, and marketing controls took effect.

For a detailed review of the crypto licensing process under MAS, see GSS Legal’s Crypto & VASP Licensing service. Operators considering other jurisdictions alongside Singapore may also wish to review the firm’s VASP licence advisory.

Capital Markets Services Licence: FX, Securities, and Fund Management

The CMS licence is issued under the SFA and is required for entities conducting regulated capital markets activities. The activities covered include:

• Dealing in capital markets products (securities, OTC derivatives, exchange-traded derivatives, collective investment scheme units)
• Spot foreign exchange trading on behalf of clients
• Fund management
• Advising on corporate finance
• Providing custodial services for securities
• Operating an organised trading facility (OTF)
• Securities-based crowdfunding

The CMS licence is the primary authorisation for FX brokers, CFD platforms, fund managers, and securities dealers operating in or from Singapore. Base capital requirements range from S$50,000 to S$1 million depending on the activity, client type (retail or accredited/institutional), and whether the firm handles client assets. MAS requires a minimum of two directors (at least one Singapore-resident), a CEO with at least ten years of relevant experience resident in Singapore, and a minimum of two full-time Singapore-based individuals for each regulated activity.

Token classification is a critical pre-application step for crypto-adjacent businesses. A token that functions primarily as a means of payment falls under the DPT definition and is regulated under the PSA. A token that represents ownership of an underlying asset or provides investment returns may constitute a capital markets product under the SFA, triggering CMS licence requirements instead. The two regimes carry different capital and conduct obligations and the classification must be resolved before the application is filed.

For FX and CFD operators, see GSS Legal’s Forex & FX Licensing service and the dedicated CFD Trading Licence guide. For operators comparing Singapore against other CMS-equivalent jurisdictions, the firm’s Jurisdiction Advisory covers the full range of options.

Financial Adviser Licence: Robo-Advisory and Investment Recommendations

Any entity providing financial advisory services — including automated digital advisory (robo-advisory) platforms — must hold an FA licence under the FAA unless exempted. MAS guidelines (CMG-G02) confirm that the regulatory framework for digital advisers follows the same structure as for conventional financial advisers. The specific licence required depends on the model:

• A platform providing only advisory services (recommendations on investment products) needs an FA licence
• A platform that also executes trades or manages client portfolios will likely need a CMS licence in addition to, or instead of, an FA licence
• Where robo-advisory incorporates digital asset or tokenised products, additional obligations arise under the PSA or SFA depending on the asset classification

MAS assesses FA licence applications against the fitness and propriety of directors and shareholders, management expertise and track record, and the applicant’s ability to meet minimum financial requirements and professional indemnity insurance obligations. The annual corporate licence fee is S$2,000 regardless of the number of advisory services provided.

Business Model Mapping: Which Licence Do You Need?

The table below maps common fintech business models to their primary MAS authorisation requirements. In practice, many businesses require more than one authorisation if they combine activities across categories.

This mapping is a starting point. Businesses that combine activities — for example, a crypto platform that also offers FX hedging or tokenised fund products — will need to assess each activity stream independently and may require multiple authorisations. GSS Legal’s full-service licensing team conducts activity-level analysis before any application is initiated, to ensure the correct licences are identified from the outset.

What MAS Expects Before You Apply

MAS does not issue licences to applicants who arrive at the application stage under-prepared. The most common reason applications stall — or are rejected — is not a flawed business model, but an AML/CFT framework that does not meet MAS expectations or key personnel who have not been properly assessed.

For PSA applications (SPI and MPI), the following must be in place before submission:

• Corporate structure — a Singapore-incorporated company with a permanent place of business; at least one executive director who is a Singapore Citizen or Permanent Resident, or an Employment Pass holder paired with a separate Citizen/PR director
• AML/CFT framework — a fully documented AML/CFT manual, customer due diligence procedures, transaction monitoring framework, and a designated money-laundering reporting officer
• Capital structure — adequate base capital in place at the point of application, not projected to be raised post-approval
• Independent legal opinion — since 26 August 2024, all new SPI and MPI applicants must include an independent legal opinion assessing how the PSA applies to each proposed product or service
• Independent external auditor assessment — required for DPT service applicants, covering AML/CFT compliance and consumer protection obligations
• Technology risk management framework — documented controls for cybersecurity, access management, vendor oversight, and incident response

For CMS licence applications under the SFA, MAS additionally requires a CEO with at least ten years of relevant experience resident in Singapore, a minimum of two Singapore-resident directors, and at least two full-time Singapore-based individuals per regulated activity. Adequate professional indemnity insurance and compliance with the fit-and-proper criteria for all key appointment holders are also required.

These requirements are not bureaucratic formalities. They reflect MAS’s assessment of whether the applicant will be able to operate safely and in compliance with ongoing regulatory obligations once licensed. Gaps in the AML/CFT framework or gaps in key personnel fitness are the two issues most likely to result in an application being placed on hold.

Timelines, Fees, and Capital Requirements

The following figures reflect MAS requirements and typical processing experience as of mid-2026:

These timelines assume a well-prepared application. An incomplete AML/CFT framework, missing key personnel, or insufficient capital documentation at the point of submission is the single biggest driver of extended processing times. Applications placed on hold by MAS can sit for considerably longer.

For businesses requiring bank account setup alongside their licence, GSS Legal also covers Banking, EMI, and PSP setup — a critical operational step that must be planned in parallel with, not after, the licensing process.

Recent Regulatory Changes You Cannot Ignore

MAS has made several material changes to the fintech licensing and compliance landscape since mid-2024. Operators entering the Singapore market now face a more demanding baseline than those who applied two or three years ago.

DTSP Regime (June 2025)

The FSMA-based DTSP regime, in force from 30 June 2025, requires licensing for any entity providing DPT or capital markets token services from Singapore, including to customers located entirely outside Singapore. The previous exemption for offshore-only service models no longer applies. MAS has set a high licensing bar for these models and has indicated it will generally decline applications where the business model poses elevated AML risk or lacks meaningful Singapore substance.

Enhanced DPT Consumer Protections (October 2024 onwards)

Since October 2024, all licensed DPT service providers must hold customer token holdings in trust or segregated accounts, complete daily reconciliation, and maintain transparent custody disclosures. From June 2025, additional requirements apply: risk-awareness assessments for retail clients, restrictions on leverage for retail DPT products, controlled marketing practices, and formal complaint-handling frameworks. These are ongoing compliance obligations, not one-time application requirements.

Independent Application Documents (August 2024)

Since 26 August 2024, all new SPI and MPI applicants must submit an independent legal opinion assessing how the PSA applies to their specific products. DPT service applicants must also include an independent external auditor assessment of their AML/CFT and consumer protection controls. These documents are formal submission requirements and must be commissioned before the application is filed.

Anti-Scam Measures for MPI Holders (October 2024)

MAS issued an Anti-Scams Circular in October 2024 requiring MPI licence holders to implement 12-hour cool-off periods on new-device logins, default transaction limits of S$1,000 (with higher limits requiring additional controls), real-time scam detection, kill-switch functionality, and 24/7 victim-reporting channels. These are not optional enhancements but minimum standards for MPI operations.

Single-Currency Stablecoin Framework

MAS has proposed a dedicated framework for single-currency stablecoins (SCS), covering reserve backing requirements, minimum capital of at least S$1 million or 50% of annual operating costs, par value redemption within five business days, and mandatory white paper disclosure obligations. Operators considering stablecoin issuance should factor this framework into their business model design and licensing strategy before approaching MAS.

For operators assessing Singapore against other licensing jurisdictions, GSS Legal’s Jurisdiction Advisory covers the full range of crypto, FX, and fintech licensing options across Asia, the EU, the Gulf, and offshore markets. A summary of completed licensing engagements is available in the firm’s Success Cases.

Getting the Licence Right from the Start

MAS’s licensing framework for fintech is structured, well-documented, and consistently applied. The challenge for most applicants is not the complexity of the rules, but the precision required in characterising their business model before they begin. The wrong licence classification, an underdeveloped AML/CFT framework, or missing key personnel documentation will delay or derail an otherwise viable application.

The correct sequence is: first, identify every regulated activity your business model involves; second, map those activities to the applicable licence types; third, build the compliance infrastructure and appoint key personnel before the application is submitted. MAS does not reward applications that treat compliance as a post-approval project.

For operators who want to move through the process efficiently — from business model analysis and jurisdiction selection through application, banking, and go-live — GSS Legal’s services cover the full path. The firm operates Singapore and Ho Chi Minh City Asia desks and has delivered MAS-regulated and equivalent licences across 50+ jurisdictions. More information on specific licence types is available via the Insights section and Jurisdictions pages.