MAS-Approved Crypto Exchanges: How Approval Works and What It Actually Means

Understand what MAS approval really means for crypto exchanges in Singapore, how the DPT licensing process works, and what obligations licensed firms carry.

When a crypto exchange describes itself as “MAS-approved” in Singapore, that phrase carries a specific regulatory meaning — and some important limitations. MAS does not operate a general approval stamp for crypto platforms. What it issues is a formal licence under the Payment Services Act 2019, and the requirements for obtaining and maintaining that licence are among the most stringent for digital asset firms anywhere in Asia.

This article explains what MAS licensing actually means for a crypto exchange, how the approval process works in practice, what MAS evaluates before granting a licence, and what ongoing obligations a licensed firm must meet. It also covers the distinction between in-principle approval and a full licence — a difference that matters when assessing any platform’s regulatory status.

Whether you are evaluating a platform as a user, assessing a market entry as a founder, or reviewing a firm’s regulatory standing as a compliance officer, this guide provides the factual grounding you need.

What “MAS-Approved” Actually Means

The Monetary Authority of Singapore (MAS) does not maintain a specific “approved exchange” designation for crypto firms the way it does for securities exchanges. The correct term is MAS-licensed. A crypto exchange operating legally in Singapore holds an active payment institution licence under the Payment Services Act 2019 for Digital Payment Token (DPT) services — in practice, almost always a Major Payment Institution (MPI) licence.

When a platform claims to be MAS-approved, it should mean one of two things: it holds an active MPI licence listed in the MAS Financial Institutions Directory (FID), or it holds a formal in-principle approval (IPA) as a step toward that licence. Anything short of those two statuses is not MAS-authorised operation.

This distinction matters in practice. Platforms that describe themselves loosely as “MAS-registered” or “MAS-compliant” without referencing a specific licence type may not hold any formal authorisation. The only authoritative source is the MAS FID public register.

The Legal Framework: Payment Services Act and DPT Services

The Payment Services Act 2019 (PSA) is Singapore’s primary statute governing payment services and digital asset activities. Administered by MAS, it came into force on 28 January 2020 and was significantly amended in 2022 and 2024 to expand the scope of regulated crypto activities.

Under the PSA, a Digital Payment Token refers to any cryptographically secured digital representation of value used — or intended to be used — as a medium of exchange. This covers cryptocurrencies such as Bitcoin and Ether. Any entity that buys, sells, facilitates the exchange of, or transmits DPTs in Singapore must hold a valid payment institution licence under the PSA. Entities incorporated in Singapore that serve only overseas clients fall under the FSM Act DTSP regime instead — and MAS has said it will generally not issue those licences.

The regulated activities that trigger a licensing requirement include:

• Buying or selling DPTs for customers
• Operating a platform that allows customers to exchange DPTs
• Transmitting DPTs on behalf of customers
• Providing DPT custody or safekeeping services
• Facilitating DPT exchanges, even without taking possession of assets

In June 2025, MAS tightened the framework further by bringing cross-border digital token services under the Financial Services and Markets Act 2022 (FSM Act). From 30 June 2025, entities incorporated in Singapore that provide digital token services solely to overseas clients must also hold a licence under the FSM Act — with MAS stating publicly that it has set the bar high and will generally not issue such licences due to the elevated money laundering risks and supervisory challenges involved.

The practical effect is that there is no longer any grey area. As of mid-2025, every crypto business operating in or from Singapore — regardless of where its clients are located — must be appropriately licensed.

SPI vs MPI: Which Licence Tier Applies

The PSA licensing regime uses a two-tier structure based on transaction volume and systemic risk. Both tiers cover DPT services, but they carry materially different obligations.

Standard Payment Institution (SPI): Applies to firms whose monthly transaction volumes fall below SGD 3 million per service and SGD 6 million in aggregate. The SPI licence carries lighter requirements and is suited to lower-volume or early-stage operations.

Major Payment Institution (MPI): Applies to any firm exceeding either threshold. The MPI licence imposes substantially higher capital requirements, more rigorous ongoing reporting obligations, and stricter technology risk management standards. Most institutional DPT businesses — and virtually all crypto exchanges serving retail users at scale — require an MPI licence.

When the term “MAS-approved crypto exchange” is used in Singapore, it almost always refers to MPI licensees. The current MAS FID list includes several dozen active MPI holders for DPT services. This group includes pure-play exchanges, institutional custodians, consumer platforms offering crypto as a feature, dual-licensed stockbrokers, and B2B payment processors — not all of them are exchanges in the traditional retail sense.

How the Approval Process Works

The MAS licensing process for DPT service providers follows a structured, multi-stage pathway. A well-prepared applicant should expect the full process from initial preparation to licence issuance to take twelve months or more, with complex business models or incomplete applications extending this further.

The process, in broad sequence:

1. Regulatory scoping — Confirm whether your specific activities fall within the regulated perimeter under the PSA. The key question is what the business does, not what it is called. This step should be completed before any other preparation begins.
2. Entity incorporation — You must establish a Singapore-incorporated company. Foreign companies cannot hold a Singapore payment institution licence directly; a local subsidiary is required.
3. Framework build-out — Before submitting, applicants must have a functioning AML/CFT programme, governance structure, technology risk controls, and compliance staffing in place. MAS expects these to be operational, not planned.
4. Application submission — Applications are submitted via the MAS regulatory portal with a full document pack, including a legal opinion on regulated activities and an independent external auditor’s assessment of AML/CFT and user protection compliance. The application fee is SGD 1,500 for MPI (SGD 1,000 for SPI), or the sum of the prescribed fees for each payment service applied for — whichever is higher.
5. MAS review and queries — MAS reviews the application and typically issues rounds of written queries. Applicants must respond precisely and promptly. Extended query cycles are usually caused by gaps in the compliance framework, not flawed business concepts.
6. Management interview — Senior personnel are interviewed by MAS as part of the fit-and-proper assessment. MAS evaluates whether the people running the business understand the regulatory obligations and can demonstrate genuine operational readiness.
7. In-Principle Approval (IPA) — If MAS is satisfied with the application and the management interview, it issues an IPA. This is not a licence. It indicates MAS’s intent to grant a licence once specified conditions are met.
8. IPA conditions and final licence grant — Applicants typically have up to six months after IPA issuance to complete remaining readiness work — capital injection, team build-out, and technical implementation. Once all IPA conditions are evidenced to MAS’s satisfaction, the full PSA licence is granted.

What MAS Evaluates Before Granting a Licence

MAS assesses applications against criteria that go well beyond business model viability. The evaluation framework covers several distinct dimensions, each of which must be evidenced at application stage — not planned for post-approval implementation.

Corporate structure and residency

The applicant must be a Singapore-incorporated company with a permanent place of business. At least one executive director must be a Singapore citizen, permanent resident, or Employment Pass holder. If the CEO holds an Employment Pass, at least one additional director must be a Singapore citizen or PR. All key personnel — directors, substantial shareholders, and senior managers — are subject to fit-and-proper assessment.

Fit-and-proper criteria

MAS’s fit-and-proper framework, set out in Guidelines FSG-G01, covers every director, substantial shareholder, and chief executive of a licensed entity. Fitness and propriety is assessed across dimensions including honesty, integrity, financial soundness, and competence. Critically, these criteria apply not only at the time of application but on an ongoing basis for the duration of the licence.

Financial resources

MPI applicants must maintain a minimum base capital of SGD 250,000, plus a security lodged with MAS of SGD 100,000 (SGD 200,000 if average monthly transactions exceed SGD 6 million). MAS also expects this capital to cover at least six to twelve months of operating expenses. Applicants must demonstrate an effective monitoring process for continuous compliance with the capital requirement — not merely a snapshot at the point of application.

AML/CFT framework

Anti-money laundering and counter-terrorism financing compliance is the single most heavily weighted factor in the assessment. MAS aligns closely with FATF standards and applies additional scrutiny to crypto-specific risks — including transaction monitoring, blockchain analytics tools, and Travel Rule implementation. Applicants must submit an independent external auditor’s assessment confirming AML/CFT readiness alongside the initial application.

Technology risk management

MAS treats DPT service providers as critical financial infrastructure. All licensed firms are subject to MAS’s Technology Risk Management Notice — a legally binding standard that governs cybersecurity controls, wallet management, incident response, and operational resilience. MAS expects institutional-grade technical infrastructure, not startup-grade arrangements.

What Ongoing Obligations a Licence Carries

Obtaining a licence does not mark the end of regulatory engagement. It signals the beginning of active, ongoing supervision. A firm that holds an MPI licence for DPT services carries the following standing obligations:

• Capital maintenance: The minimum base capital of SGD 250,000 must be maintained at all times, with regular internal monitoring.
• Singapore-based compliance officer: A dedicated compliance officer based in Singapore is mandatory.
• Annual external audit: Licensed firms must undergo annual audits, including an independent AML/CFT audit.
• Customer asset segregation: Licensed exchanges must hold customer assets separately from the firm’s own funds, on trust, with qualified financial institutions in Singapore.
• Material event reporting: Cyber incidents, AML breaches, financial deterioration, significant operational disruptions, and changes in ownership or control must be reported to MAS promptly. Failure to report is itself a regulatory offence.
• Periodic regulatory returns: Ongoing reporting to MAS on business activities, financial position, and compliance metrics.
• Consumer protection rules: MAS introduced enhanced consumer protection measures for DPT providers in 2024, including access controls, conflict of interest provisions, and restrictions on trading incentives and leverage offerings to retail customers.

The licence can be suspended or revoked if MAS determines that a firm no longer meets the required standards. This ongoing supervisory engagement is part of what distinguishes a genuinely MAS-licensed firm from one that has simply passed a one-time check.

In-Principle Approval vs Full Licence: The Distinction

During the period when MAS was processing a large volume of DPT licence applications from transitional-regime applicants, many platforms publicly disclosed that they held an In-Principle Approval (IPA). Some users and media reports treated this as equivalent to a full licence. It is not.

An IPA means that MAS has reviewed the application and found it broadly satisfactory, but the applicant has not yet completed all conditions required for full licence grant. At the IPA stage, MAS’s focus shifts from design to execution — the question is no longer what the applicant plans to do, but whether it can actually operate as proposed. The IPA holder typically has up to six months to satisfy all outstanding conditions before the full licence is granted.

A full MPI licence, by contrast, means all conditions have been met and evidenced, and the firm is formally authorised to provide DPT services. Only a full licence provides the complete set of consumer protections that MAS’s framework is intended to deliver. The MAS FID public register shows the current licence status of every authorised entity, and this is the only source that should be relied on for verification.

It is also worth noting that a large number of entities applied for DPT licences at various stages of the transitional regime. Of those, a significant proportion were rejected or withdrew their applications and exited the Singapore market rather than complete the process. Only firms that cleared MAS’s full review process hold active licences today.

How to Verify a Platform’s MAS Status

Any platform claiming to be MAS-licensed can be verified directly. The MAS Financial Institutions Directory (FID), accessible at eservices.mas.gov.sg/fid, is the authoritative public register of all licensed financial institutions in Singapore. To confirm a crypto exchange’s status:

1. Search for the firm by name or Unique Entity Number (UEN) on the MAS FID.
2. Check that the firm holds an active Major Payment Institution licence (not expired, suspended, or revoked).
3. Confirm the licence includes Digital Payment Token services as an authorised activity.

A firm may hold an MPI licence without being authorised for DPT services specifically — the licence scope must be checked, not just the licence tier. If a platform’s name does not appear on the MAS FID with an active MPI licence covering DPT services, it is not legally authorised to operate as a crypto exchange in Singapore.

Applying for a MAS DPT Licence

For businesses seeking to enter the Singapore crypto market, the MAS DPT licensing process is detailed, document-intensive, and calibrated to reject underprepared applicants. MAS evaluates whether a business is fully prepared to operate as a regulated financial institution — approval is only granted when that readiness is demonstrated, not promised.

Key preparation steps before any application is submitted:

• Confirm that your specific business activities trigger a licensing requirement under the PSA — not every business model does.
• Incorporate a Singapore entity and establish a permanent local place of business.
• Appoint at least one qualifying executive director and a Singapore-based compliance officer.
• Build out a complete AML/CFT policy framework, including transaction monitoring procedures and Travel Rule controls.
• Implement technology risk management controls to MAS’s TRM Notice standard.
• Engage an independent external auditor to assess AML/CFT and user protection readiness prior to submission.
• Obtain a legal opinion confirming your regulated activity classification.
• Ensure base capital of at least SGD 250,000 is in place, with capacity to cover six to twelve months of operating expenses.

For operators entering Singapore as part of a broader Asia or multi-jurisdiction strategy, the MAS DPT licence is one of the more credible regulatory approvals available in the region. The high bar for licensing reflects the thoroughness of MAS’s review process — and that same rigour is what makes the licence credible in institutional markets. Our Crypto & VASP Licensing practice works with applicants through every stage of this process, from initial regulatory scoping and entity setup through application submission, query management, IPA conditions, and post-licence compliance. We also advise clients comparing Singapore against other Asia and offshore frameworks through our Jurisdiction Advisory service.

What “MAS-Approved” Should Signal to You

A MAS DPT licence — specifically, an active Major Payment Institution licence covering Digital Payment Token services — is one of the more meaningful regulatory approvals a crypto exchange can hold. It requires institutional-grade AML/CFT controls, technology risk management to a legally binding standard, capital adequacy, fit-and-proper governance, customer asset segregation, and active ongoing supervision by one of Asia’s most rigorous financial regulators.

That said, “MAS-approved” is not a guarantee of commercial reliability or financial solvency. It means the firm has met MAS’s standards as a regulated entity. Verifying licence status on the MAS FID is a necessary first step — not the only due diligence step — when assessing any platform.

For businesses seeking to obtain a Singapore DPT licence, the process demands genuine operational readiness before submission. The firms that clear MAS’s review are the ones that arrive with their compliance infrastructure already built — not those that treat the application as the starting point for building it.