A practical guide to Singapore's PS Act: regulated activities, SPI vs MPI thresholds, DPT amendments, and the ongoing compliance calendar for payment service providers.

Singapore’s Payment Services Act 2019 (PS Act) provides the primary regulatory framework for payment service providers operating in or from Singapore. It consolidated two older laws, established a tiered licensing regime, and gave the Monetary Authority of Singapore (MAS) direct supervisory authority over a broad range of payment activities — including digital payment token services.

Since its commencement on 28 January 2020, the PS Act has been amended materially. The most significant changes took effect in stages from 4 April 2024, expanding the scope of regulated activities and introducing new requirements specifically for digital payment token (DPT) service providers. Any business considering a payment services operation in Singapore needs to work from the current, post-amendment version of the framework — not the original 2020 structure.

This article covers the full scope of regulated activities under the PS Act as it stands today, the thresholds that determine which licence class applies, the specific requirements that attach to DPT services, and the ongoing compliance obligations that licensees carry after approval.

What Is the PS Act?

The Payment Services Act 2019 (PS Act, Act 2 of 2019) came into force on 28 January 2020. It repealed two earlier statutes — the Payment Systems (Oversight) Act and the Money-Changing and Remittance Businesses Act — and replaced them with a single, modular framework. The PS Act operates two distinct regulatory regimes: a designation regime for systemically important payment systems, and a licensing regime for payment service providers.

The designation regime identifies payment systems whose disruption could cause systemic or broad-based harm to Singapore’s financial system. Examples include the MAS Electronic Payment System (MEPS+) and Fast and Secure Transfers (FAST). This regime is directed at infrastructure operators, not the payment service providers that most businesses will encounter.

The licensing regime is what matters for most operators. It requires any entity providing specified payment services in Singapore to hold one of three MAS-issued licences. The framework is proportionate: regulatory obligations scale with the volume and risk profile of the services provided.

The Payment Services (Amendment) Act 2021 was gazetted in 2021 and its operative provisions commenced in stages from 4 April 2024. Those amendments expanded the scope of regulated activities, tightened AML/CFT requirements, and introduced user protection obligations for DPT service providers. The current framework therefore reflects both the original 2020 Act and these 2024 amendments.

Regulated Payment Services Under the PS Act

The Original Seven Activities

From commencement in 2020, the PS Act regulated seven categories of payment service. Any entity providing one or more of these activities for customers in Singapore required a licence:

• Account issuance services — issuing payment accounts such as e-wallets or non-bank stored value cards, or operating those accounts on behalf of customers.
• Domestic money transfer services — facilitating the transfer of funds within Singapore, including online payment gateways and payment kiosks.
• Cross-border money transfer services — facilitating inbound or outbound fund transfers across Singapore’s borders.
• Merchant acquisition services — processing payments on behalf of merchants, including point-of-sale terminals and payment gateways.
• E-money issuance services — issuing stored electronic money that customers can use to pay for goods or services or transfer to others.
• Digital payment token (DPT) services — buying or selling DPTs (commonly called cryptocurrencies), or operating an exchange platform for DPT transactions.
• Money-changing services — buying and selling foreign currency notes.

The April 2024 Expansion

The April 2024 amendments added three further activities to the regulated perimeter. These additions reflect the growth of digital asset services and the cross-border reach of modern payment models. From 4 April 2024, the following activities also require a PS Act licence:

• DPT custodial services — holding or controlling DPTs, or holding private keys that allow access to DPTs, on behalf of customers.
• DPT transmission and exchange facilitation — facilitating the transmission of DPTs between accounts, or facilitating the exchange of DPTs, even where the service provider does not come into possession of the DPTs or funds involved.
• Facilitation of cross-border money transfers — facilitating money transfers between different countries, even where funds are not accepted or received in Singapore.

The third item is significant. Under the original framework, an operator could argue that cross-border transfer facilitation without a Singapore-side receipt of funds fell outside the PS Act. That gap is now closed. Operators running cross-border payment corridors from a Singapore entity need to review whether they fall within scope, regardless of where money physically moves.

For businesses already operating in these newly regulated categories before April 2024, MAS provided transitional arrangements. Entities that notified MAS by 4 May 2024 and submitted a licence application by 4 October 2024 were permitted to continue operating on a temporarily exempt basis while their applications were reviewed. Those that also submitted an external auditor attestation on their AML/CFT compliance by 4 January 2025 could maintain this interim status through the review period.

Activities Outside the Licensing Requirement

Not every payment-adjacent business needs a PS Act licence. The following categories are explicitly excluded from the licensing requirement:

• Payment instrument aggregators that relay payment data but do not hold or move funds.
• Data communication platforms transmitting financial information without processing payments.
• Entities providing payment infrastructure services exclusively to other licensed payment service providers or financial institutions.

Whether a specific business model falls within or outside the regulated perimeter is a question of legal analysis, not just activity labelling. From August 2024, MAS requires new applicants for certain licence types — and all applicants adding DPT services — to submit a legal opinion mapping their proposed business model to the regulated activities under the PS Act. This requirement signals how seriously MAS treats perimeter determination.

Three Licence Classes

Entities that require a licence choose from three classes. The appropriate class depends on the services provided and the transaction volumes expected:

• Money-Changing Licence (MCL) — permits only money-changing services (buying and selling foreign currency notes). This licence carries governance requirements regarding citizenship of principals and directors, and applies largely the same standards as the predecessor Money-Changing and Remittance Businesses Act.
• Standard Payment Institution (SPI) Licence — permits any combination of the regulated payment services, subject to the transaction volume and e-money float thresholds described below. Regulatory obligations are proportionate to the lower risk profile of smaller-scale operators.
• Major Payment Institution (MPI) Licence — permits any combination of regulated payment services without threshold constraints. MPI holders are subject to more extensive ongoing obligations, including mandatory safeguarding of customer funds, higher capital requirements, and more detailed periodic reporting.

Businesses expecting to grow rapidly should consider their licence class choice carefully from the start. Upgrading from SPI to MPI requires a fresh application — not a simple variation — and the process takes approximately 120 business days. Operators who wait until they are close to breaching thresholds before initiating an upgrade are at risk of a compliance breach during the transition period.

SPI vs MPI: Thresholds and Capital Requirements

The distinction between SPI and MPI status turns on two transaction volume thresholds and one e-money float threshold, all measured as averages over a calendar year:

Breaching any one of these three thresholds requires an MPI licence. SPI holders must track their volumes on a rolling 12-month basis and maintain internal escalation triggers — best practice is to flag at 70% and again at 90% of each threshold — to allow time for an MPI application before a breach occurs.

Capital and financial requirements differ materially between the two licence classes:

Both licence types require the applicant to be a Singapore-incorporated company or a registered Singapore branch of a foreign corporation, with a permanent place of business where books and records can be maintained. Neither licence is available to an entity that does not yet legally exist — incorporation must precede the MAS application.

For operators who anticipate crossing SPI thresholds within 12 months of launch, applying directly for an MPI at the outset avoids the cost and delay of a mid-cycle licence upgrade. This is a structural decision that should be made during the corporate formation phase, not after operations begin.

Additional Requirements for DPT Service Providers

DPT service providers face a more demanding compliance environment than other payment service providers. This reflects MAS’s assessment that DPT activities carry higher money laundering and terrorism financing risk due to their speed, pseudonymity, and cross-border nature. Several requirements apply specifically to this category:

• AML/CFT Notice PSN02 — DPT service providers must comply with Notice PSN02, which sets out customer due diligence, transaction monitoring, suspicious transaction reporting, and sanctions screening obligations specific to digital assets.
• Travel Rule (DPT transfers of SGD 1,500 or above) — For transfers at or above this threshold, originating institutions must pass the originator’s full name, account or wallet identifier, and address — or date of birth and customer identification number to the beneficiary institution before or at the time of transfer. Beneficiary institutions must screen received data against sanctions lists before crediting funds.
• Asset segregation — From 4 October 2024, DPT service providers must segregate customer assets and hold them in trust accounts for the benefit of customers. They must maintain accurate books and records, and implement systems and controls to protect the integrity and security of customer assets.
• In-house local compliance officer — MAS expects DPT service providers to have a dedicated in-house compliance officer based in Singapore, given the higher risk and complexity of the business. Reliance on a group-level or overseas compliance function does not satisfy this requirement.
• Independent external auditor assessment — Applications to provide DPT services (whether new or by variation) must include an independent external auditor assessment covering AML/CFT controls and consumer protection measures.
• Record retention — CDD records, transaction records, and suspicious transaction report documentation must be retained for at least five years from the end of the relevant business relationship or transaction date.

For businesses in the crypto and digital asset space, the PS Act’s DPT framework is the primary licensing pathway in Singapore. Whether you are running a crypto or VASP operation, a custody platform, or a DPT exchange, your activities will engage these requirements. Understanding the full scope of what MAS expects before application significantly improves the probability of a first-pass approval.

Ongoing Compliance Obligations

Obtaining a PS Act licence is not a one-time event. Licensees carry a continuous set of regulatory obligations that persist throughout the life of the licence. The main categories are:

Periodic reporting to MAS. Both SPI and MPI holders must file periodic regulatory returns to MAS. MPI holders face more detailed and frequent reporting, including transaction volumes by service type, e-money outstanding balances, and safeguarding account reconciliations. MAS uses these returns to monitor compliance with licence conditions and threshold limits on an ongoing basis.

Annual independent audit. Licensed payment service providers must submit annual audit reports to MAS within stipulated timeframes. The annual audit covers customer fund safeguarding, capital compliance, accuracy of PSN04 regulatory returns, eligibility of exempted products, and remediation of any prior audit findings. Newly licensed PSPs and those introducing new payment services must also undergo an end-to-end audit review within one year of commencing those operations.

AML/CFT ongoing monitoring. Licensees must maintain live AML/CFT frameworks calibrated to their business model and customer risk profile. This includes ongoing customer due diligence, transaction monitoring, and sanctions screening. MAS publishes targeted notices addressing emerging financial crime risks, and compliance teams must track these updates. Internal AML/CFT programs require periodic review to remain aligned with MAS expectations and FATF standards. GSS Legal’s AML and compliance practice supports licensees in building and maintaining these frameworks.

Technology risk management. Licensees must comply with the MAS Technology Risk Management Guidelines. This includes cyber-security risk management, user authentication controls, data loss prevention measures, and cyber-attack prevention and detection capabilities. MAS may impose specific technology risk requirements by notice.

Material change notifications. Licence holders must notify MAS within 14 days of changes to key officers, shareholders, or other material aspects of the entity. Appointments of new CEOs or directors require pre-approval from MAS before taking effect. Any change of control triggers obligations under Section 28 of the PS Act.

MAS inspections. MAS conducts risk-based on-site inspections of licensees. MAS inspections are risk-based and can occur on-site without notice. The first review often falls within the first 12 to 18 months after licensing.

Compliance Calendar

The table below summarises the principal recurring and one-time compliance obligations for PS Act licensees. Specific filing windows are set by MAS and may vary by financial year-end. This table is a reference framework, not a substitute for licence-condition review.

Applying for a PS Act Licence

MAS assesses applications holistically, on a case-by-case basis. The key admission criteria across all licence classes include: fitness and propriety of controllers, directors, and key officers; governance and ownership structure; financial condition and track record; quality of the AML/CFT framework; operational readiness; and whether a licence grant serves the public interest. For DPT service applications, MAS also evaluates the adequacy of consumer protection and technology risk management arrangements.

From August 2024, certain applications — including all those seeking to add DPT services — must include a legal opinion on the mapping of the proposed business model to regulated activities under the PS Act. All DPT service applications must also include an independent external auditor assessment covering AML/CFT and consumer protection. These requirements reflect MAS’s expectation that applicants arrive fully prepared, not provisionally ready.

Typical processing time is 6–12 months for an SPI and 12+ months for an MPI, longer where DPT services are in scope, depending on the complexity of the application, completeness of documentation, and MAS’s assessment of the applicant’s risk profile. MAS may place an application on hold for up to six months where significant changes occur during the review period, such as corporate restructurings or changes to key management personnel.

The most common reason applications stall or fail is not a deficient business model but an AML/CFT framework that does not meet MAS’s expectations, or key personnel who have not been adequately assessed for fitness and propriety. Investing in compliance infrastructure before application — not after — materially improves the likelihood of a first-pass approval.

Businesses that require a Singapore payment services licence alongside other financial services infrastructure — such as banking, EMI, or PSP arrangements — should sequence these applications carefully, as some banking relationships are contingent on holding an appropriate MAS licence. For operators exploring the right jurisdiction for their payment services model, our jurisdiction advisory service provides a structured framework for that assessment.

Key Takeaways

The PS Act as it stands today — incorporating the April 2024 amendments — is a materially more expansive framework than its 2020 predecessor. DPT custody, DPT transmission and exchange facilitation, and cross-border transfer facilitation are now all regulated activities. Any operator who assessed their PS Act exposure before April 2024 should revisit that analysis.

Choosing the right licence class from the outset, structuring governance and capital requirements correctly, and building an AML/CFT framework that meets MAS expectations are the three factors that most influence application outcome and long-term compliance. The compliance obligations that follow licensing are substantial and ongoing — the regulatory relationship with MAS does not end at the point of approval.

For operators in the crypto, payments, or cross-border financial services space, Singapore remains one of the most structured and internationally recognised licensing jurisdictions in Asia. Getting the application right the first time is the most efficient path to operational status.