Everything crypto founders need to know about obtaining a Singapore MAS crypto licence in 2026 — PSA, DTSP, SPI vs MPI, application steps, and ongoing compliance.

Singapore does not hand out crypto licences. It grants them — selectively, after months of scrutiny, to operators who can demonstrate institutional-grade governance, genuine local substance, and compliance programmes built to banking standards. That deliberate rigour is precisely why a Monetary Authority of Singapore (MAS) licence remains one of the most commercially valuable regulatory credentials a crypto business can hold anywhere in Asia.

The framework has evolved significantly. The Payment Services Act (PSA) established the foundational regime for Digital Payment Token (DPT) services in 2019. Subsequent amendments broadened the scope. Then, in a move that reshaped the market, the Financial Services and Markets Act (FSMA) Part 9 closed the loophole that had allowed Singapore-incorporated entities to serve only overseas clients without a local licence — with full effect from 30 June 2025. Founders building in 2026 are operating under the most comprehensive and enforcement-ready Singapore crypto regulatory regime to date.

This guide covers everything you need to know before filing: which law applies to your business model, how to choose between an SPI and MPI licence, what MAS is really evaluating during review, the ongoing obligations that follow approval, and the honest question of whether Singapore is the right jurisdiction for your specific strategy.

Why Singapore Still Matters for Crypto Founders

Singapore’s appeal to crypto operators is not accidental. The city-state has spent years building what most market participants now regard as the most credible regulated crypto environment in Southeast Asia. Its geographic position at the crossroads of Asian capital flows, a mature banking infrastructure with over 200 licensed financial institutions, zero capital gains tax, and a government that has publicly committed to developing a responsible digital asset ecosystem — these are structural advantages that no amount of regulatory tightening has eroded.

The practical commercial argument is equally compelling. A MAS licence is recognised by institutional counterparties, international banks, and corporate treasury programmes in a way that no comparable Asian offshore credential can match. For founders targeting institutional clients, custody partnerships, or banking relationships with prime brokers, Singapore sits at the top of the viable options. That said, the licence is hard to get, expensive to maintain, and demands genuine operational commitment. Founders who approach it as a badge rather than a business decision tend to underestimate both the timeline and the scrutiny involved.

The city also hosts over 700 Web3 companies and runs the global Token2049 conference, creating a dense ecosystem of investors, legal infrastructure, and technical talent. For businesses building serious, scalable digital asset operations that need to partner with banks like global custodians and institutional trading desks, Singapore remains a leading option in the region — not because it is easy, but because it is trusted.

The Regulatory Framework: Three Laws, One Regulator

Singapore regulates crypto on an activity basis rather than through a single crypto-specific statute. The applicable law depends on what your business does, what type of tokens it deals with, and who your customers are. The Monetary Authority of Singapore administers all three of the relevant legislative frameworks, which eliminates the multi-regulator fragmentation common in other jurisdictions.

Payment Services Act (PSA)

The PSA is the primary framework for most crypto businesses. It governs Digital Payment Token services — MAS’s term for cryptocurrency exchange, transfer, and custody activities — along with e-money issuance, cross-border remittance, and several other payment services. Amended by the Payment Services (Amendment) Act 2021 and updated further in 2024, the PSA now covers a substantially broader range of DPT activities than it did at inception. Any business providing DPT services in or from Singapore must hold a PSA licence unless a narrow exemption applies. The PSA creates two licence tiers — the Standard Payment Institution (SPI) and the Major Payment Institution (MPI) — differentiated primarily by transaction volume thresholds and the scope of their capital and safeguarding requirements.

Financial Services and Markets Act (FSMA) — The DTSP Regime

The FSMA introduced the Digital Token Service Provider (DTSP) licensing framework, which became operational on 30 June 2025. Before this date, Singapore-incorporated entities offering digital token services exclusively to overseas clients could operate in a regulatory grey zone. MAS closed that gap entirely. Under the current rules, if your entity is incorporated in Singapore, has Singapore-based directors, or uses Singapore infrastructure to manage a crypto business, you are subject to DTSP licensing regardless of where your customers are located. MAS has been explicit that it will grant DTSP licences only in very limited circumstances, citing heightened cross-border money laundering and terrorism financing risks. Founders considering this route should engage specialist counsel before making incorporation decisions — the DTSP bar is deliberately high.

Securities and Futures Act (SFA)

The SFA applies when a digital token constitutes a capital markets product — essentially a security, a unit in a collective investment scheme, or a derivative. Platforms dealing in security tokens, tokenised equity, or fractional ownership structures must meet the SFA’s licensing and prospectus requirements, and operators need a Capital Markets Services (CMS) licence for dealing, advising, or fund management activities. Token classification is the threshold question here: MAS does not rely on what an issuer calls a token, but assesses its economic substance and the rights it confers on holders.

Token Classification: DPT, E-Money, or Security Token?

Getting token classification right is the first compliance step for any Singapore crypto analysis, and errors at this stage have downstream consequences for everything from licence type to AML programme design. MAS assesses each token on its features and the rights it creates, not on its name or marketing description.

• Digital Payment Token (DPT): A digital representation of value not pegged to any fiat currency, used or intended for use as a medium of exchange. Bitcoin and Ether are the canonical examples. DPT services are supervised by MAS under the PSA, and any business buying, selling, exchanging, or providing custody of DPTs for customers requires a PSA licence.
• E-Money: A digital token pegged to a fiat currency — this covers most stablecoins, including USDT and USDC. Tokens pegged to the Singapore Dollar or a G10 currency may qualify as MAS-regulated stablecoins under the 2023 Single-Currency Stablecoin (SCS) framework if the issuer meets strict reserve, capital, and redemption requirements. Stablecoin issuers must be incorporated in Singapore and hold reserve assets meeting specific composition standards.
• Security Token: A token representing equity, debt, profit entitlement, or ownership of a real-world asset falls under the SFA. Tokenised real estate, tokenised bonds, and digital representations of fund units all typically land here. Security token platforms need a Capital Markets Services licence rather than a PSA licence.
• Utility Tokens: Tokens issued purely for access to a defined product or service, with no investment characteristics, may fall outside all three regimes. However, MAS scrutinises utility token claims carefully, and the boundaries have shifted with successive amendments. Formal legal analysis is essential before relying on an unregulated classification.

If your product involves multiple token types — for example, an exchange handling both DPTs and stablecoin settlements — you may need to address multiple regulatory frameworks simultaneously. Our team at GSS Legal routinely advises on multi-token structure analysis as part of our Jurisdiction Advisory and Crypto & VASP Licensing work.

SPI vs. MPI: Choosing the Right Licence Class

For most DPT-focused businesses, the central licence decision is whether to apply for a Standard Payment Institution (SPI) or a Major Payment Institution (MPI). The distinction is primarily a function of transaction volume and the nature of your customer funds obligations, not the type of crypto services you offer.

The SPI is commonly used as a launchpad: lower capital, lighter ongoing obligations, and a faster review timeline make it accessible for early-stage businesses. Most crypto exchanges, custodians, and OTC desks operating at any meaningful volume will require an MPI, since the SGD 3M monthly threshold is easily breached once trading volume picks up. A practical caution worth noting: under-scoping volumes to qualify for an SPI, then breaching thresholds within a few months of launch, forces a mid-operation upgrade to MPI. Building your projections conservatively from the outset and stress-testing against your six-month growth scenarios avoids that disruption.

Capital requirements must be maintained on an ongoing basis, not just at the point of application. MAS retains the discretion to require higher capital where a business has a larger balance sheet or a higher-risk operating profile. For DPT custodians specifically, the safeguarding obligation for customer assets creates additional capital considerations that go beyond the base capital floor.

Core Eligibility Requirements

MAS expects genuine operational substance, not a letterbox structure. The eligibility requirements are demanding by design, and they reflect the regulator’s intent to admit well-capitalised, properly governed operators rather than paper entities. Key requirements across both SPI and MPI include the following:

• Singapore incorporation: The applicant must be a Singapore-incorporated private limited company registered with ACRA. Foreign entities can establish a wholly-owned Singapore subsidiary — 100% foreign ownership is permitted — but the entity filing the application must be locally incorporated.
• Local presence and substance: A registered office address with staff who actually work there is required. MAS conducts site visits during the application process. A serviced address without genuine operations will not satisfy this requirement.
• Resident executive director: At least one executive director must be ordinarily resident in Singapore. MPI applications additionally require at least one director who is a Singapore Citizen or Permanent Resident.
• Fit and proper criteria: All directors, the CEO, and major shareholders must pass MAS background checks covering integrity, competence, financial soundness, and track record. This is applied rigorously, and undisclosed adverse history — including from overseas jurisdictions — typically results in rejection or significant delay.
• Compliance officer: A Singapore-based, suitably qualified compliance officer at management level must be appointed before lodgement. MAS expects this role to be filled with a named individual who holds documented authority, not a placeholder.
• AML/CFT programme: A full AML/CFT programme compliant with MAS Notice PSN02 is required, covering Customer Due Diligence (CDD), Enhanced Due Diligence (EDD) for high-risk customers, transaction monitoring, Travel Rule compliance for transfers above SGD 1,500, and Suspicious Transaction Reporting to the Suspicious Transaction Reporting Office (STRO).
• Technology risk management: Robust IT security, penetration testing with remediation of high-risk findings, incident response planning, and board-level oversight of technology risk aligned to MAS’s Technology Risk Management Guidelines are all mandatory.

The standard MAS applies is comparable to that for a licensed financial institution, not a startup. Founders who treat the compliance programme as documentation to be produced after approval — rather than genuinely operational infrastructure to be built before lodgement — consistently encounter the longest review timelines and the highest rejection rates. Our AML & Compliance team builds programmes designed to withstand MAS scrutiny from the first day of review.

The Application Process, Step by Step

Phase 1 — Pre-Application Preparation (Approx. 2–4 Months)

Most of the work happens before a single form is submitted. Incorporate your Singapore entity, capitalise it to the required base capital level, and secure a physical office with genuine staff. Appoint your resident executive director and your compliance officer — MAS expects these roles to be substantively filled, with CVs, authority documents, and evidence of relevant experience ready for review. Commission your AML/CFT programme, board-approved policy manuals, and technology risk management framework. Prepare your three-year financial projections and a detailed business plan that maps your revenue model, target markets, fund flows, and fee structures. A legal opinion from a Singapore-based law firm confirming the scope of your intended services under the PSA is also part of the document package. The quality of pre-lodgement preparation is the single biggest determinant of timeline. Incomplete applications trigger extended question rounds from MAS that can add months to the process.

Phase 2 — Application Lodgement

Submit Form 1 via the MAS e-licensing portal, accompanied by your full document package. This includes your business plan, AML/CFT documentation, transaction flow diagrams (including fee splits), governance structure, capital evidence, security deposit confirmation (for MPI), and an independent review of your AML/CFT and consumer protection controls issued within three months of submission. Pay the government application fee (SGD 1,000 for SPI; SGD 1,500 for MPI). Completeness at this stage matters enormously — MAS will issue a case officer who reviews the file and sends question rounds. Each unanswered question or delayed response extends the timeline.

Phase 3 — MAS Review and Executive Interviews (Approx. 4–12 Months)

MAS will interview key executives, typically the CEO and Chief Compliance Officer, as part of its fit-and-proper assessment. External advisers cannot attend these sessions — the executives themselves must demonstrate substantive knowledge of the business and its compliance framework. Any major business or leadership changes that occur after lodgement but are not proactively communicated to MAS can result in a six-month hold or outright rejection. Proactive communication during the review period is not optional; it is a regulatory expectation. Approval is followed by payment of the annual licence fee and formal issuance of the licence.

Total all-in costs — base capital, security deposit, legal and compliance build-out, advisory fees, and government fees — typically range from SGD 400,000 to SGD 700,000+ for an MPI application, depending on the complexity of the business model and the state of readiness at the start of the process. Our Corporate Formation and Crypto & VASP Licensing services cover the full journey from entity setup through application submission.

Post-Licensing Obligations

Approval is the beginning of the regulatory relationship, not the end of it. MAS maintains active oversight of all licensed DPT service providers, and the ongoing compliance burden is substantial. Operators who treat the licence as a static credential rather than an ongoing operational commitment tend to find themselves the subject of supervisory attention within 12 to 18 months.

• Customer asset protection: Segregate all client assets in trust accounts. Keep at least 90% of customer assets in cold storage and reconcile all balances daily. MPIs must maintain safeguarding arrangements through a trust account, bank guarantee, or undertaking by a safeguarding institution.
• Annual audits: Independent financial audits and compliance audits are required annually. Audit findings that surface material control gaps must be reported to MAS and remediated promptly.
• Ongoing AML/CFT monitoring: Continuous transaction monitoring, Suspicious Transaction Report (STR) filing under MAS Notice PSN03, and Travel Rule compliance for all DPT transfers above SGD 1,500 — including full originator and beneficiary data transmission to receiving institutions.
• Technology risk management: Regular penetration testing, cyber incident reporting, and board-level technology risk reviews aligned to MAS Notice FSM-N13.
• Consumer protection: Retail DPT customers must pass a risk awareness assessment before accessing trading services. Credit facilities for retail DPT purchases are prohibited. All advertising of DPT services is restricted to official website and official social channels.
• Regulatory reporting: Submit regular statistical and compliance reports to MAS on the schedule prescribed for your licence class.
• Annual licence fee: SGD 10,000 for MPI (SGD 5,000 for SPI), payable annually.

One practical post-licensing challenge worth planning for: banking access. The compliance bar for a corporate banking relationship is often higher in practice than for the MAS licence itself. Banks regularly request detailed CDD programme documentation, transaction monitoring evidence, and governance records before onboarding licensed crypto businesses. Building your banking relationship in parallel with your licence application — rather than after approval — avoids a potentially significant operational delay. Our Banking & EMI / PSP team supports clients through corporate account opening alongside the licensing process.

What’s Changing in 2026

Singapore’s regulatory framework is not static. Several significant developments are in motion that will affect licensed operators and founders currently in the application pipeline.

Stablecoin legislation: MAS confirmed at the Singapore FinTech Festival in late 2025 that draft stablecoin legislation will be published in 2026. The framework prioritises full reserve backing with high-quality liquid assets and robust redemption mechanisms. If regulated stablecoins become systemically significant, MAS has signalled it may tighten the rules further to address systemic risk. Businesses already operating under the existing 2023 Single-Currency Stablecoin framework should monitor this closely — the draft legislation may alter reserve composition requirements and audit obligations.

Tokenised real-world assets (RWA): Singapore is positioning itself as a global testbed for tokenised real-world assets, with Project Guardian — MAS’s industry pilot programme — expanding to cover digital structured products, tokenised investment vehicles, and tokenised asset-backed securities. Founders building in the RWA space should assess carefully whether their token structures fall under the SFA rather than the PSA, since security token characterisation triggers a different and more demanding licensing pathway.

Tokenised government bills and CBDC infrastructure: Singapore is trialling tokenised government bills settled using wholesale central bank digital currency in 2026. These are infrastructure-level experiments rather than immediate commercial opportunities, but they signal the direction of MAS’s long-term thinking on digital finance.

Continued AML/CFT tightening: MAS revised its DTSP AML/CFT guidelines under Notice FSM-N27 effective July 2025, with updated risk-based approach requirements. The FATF Travel Rule is now in full enforcement in Singapore in 2026. Founders should expect further refinement of the AML/CFT standards applicable to DeFi protocols and algorithmic assets as MAS continues to extend its supervisory perimeter.

Is Singapore the Right Jurisdiction for Your Business?

Singapore is the right answer for specific business profiles. It is not the right answer for everyone, and a credible adviser will tell you that clearly rather than defaulting to the premium jurisdiction regardless of fit.

Singapore tends to be the strongest choice when your business targets institutional clients, custodial partnerships, or stablecoin infrastructure; when your counterparty relationships require a Tier-1 regulated entity; when you are building for the Southeast Asian market and need the trust infrastructure that comes with a MAS licence; or when your growth trajectory will involve banking relationships with major Singapore institutions or prime brokers who require regulated-entity status. The MAS licence is recognised globally by the counterparties that matter most for institutional digital asset businesses.

It tends to be the less optimal choice when your primary market is retail-focused and consumer protection restrictions create operational friction; when your timeline is short and the 6–12 month review window creates commercial risk; or when your capitalisation does not comfortably clear the base capital requirements plus the compliance build-out cost. In those cases, jurisdictions like the UAE (VARA), Lithuania (CASP under MiCA), or Labuan FSA may offer better fit for the current stage of your business. A good jurisdiction advisory process starts with your business model, your target customers, and your capitalisation — not with a pre-determined answer.

It is also worth noting that a Singapore licence does not passport into the European Union. Businesses targeting EU retail clients need a separate CASP licence under MiCA, regardless of their MAS authorisation. If your strategy spans both APAC and EU markets, you will need separate licences in each. Our Jurisdiction Advisory service exists precisely to map these multi-jurisdiction strategies and identify the most efficient sequencing for your licensing roadmap. You can also explore our full range of services and jurisdictions to see how Singapore fits within a broader licensing strategy.

How GSS Legal Supports Your Singapore Licence Journey

GSS Legal operates from Asia desks in Singapore and Ho Chi Minh City, which means our Singapore licensing work is not conducted remotely from a European time zone — it is handled by a team embedded in the same regulatory environment as our clients. We have supported crypto, VASP, and payment service operators through MAS licensing processes, from initial jurisdiction assessment through entity incorporation, AML/CFT programme design, application preparation, and post-approval regulatory stewardship.

Our approach starts with the jurisdiction question, not the application form. We assess whether Singapore is genuinely the right structure for your business model, your target market, your capitalisation, and your timeline before a single document is prepared. Where Singapore is the right answer, we guide the process end to end — governance structure, compliance programme, banking introduction, and the ongoing obligations that keep a licence operational rather than merely issued. Where a different jurisdiction serves your business better at this stage, we say so.

With more than 800 licences delivered across 50+ jurisdictions — including MAS, Philippines PAGCOR, Labuan FSA, Lithuania CASP, UAE VARA, and Curaçao — we bring comparative perspective that purely Singapore-focused advisers cannot. If you are weighing Singapore against other options, or already committed and working toward your application, we are the team that takes you from jurisdiction selection to fully operational.

Explore our Crypto & VASP Licensing services, review our Success Cases, and visit our Insights hub for the latest regulatory updates across the jurisdictions we cover. You can also explore our complementary service lines including AML & Compliance, Banking & EMI / PSP, and Corporate Formation.