Everything operators need to know about Singapore's Payment Services Act — MPI vs SPI licence classes, 2024 amendments, capital requirements, application steps, and ongoing compliance.

Singapore’s Payment Services Act 2019 (PS Act) is the primary regulatory framework governing all payment service providers operating in or from Singapore. Whether you run a cross-border remittance platform, a crypto exchange, an e-money wallet, or a merchant acquiring service, the PS Act determines whether you need a licence, which class of licence applies, and what your ongoing obligations look like.

This guide is written for founders, legal counsel, compliance officers, and investors making decisions about entering the Singapore payments market. It covers the complete licensing framework — from the seven regulated activities and three licence classes through to the 2024 regulatory amendments, the application process, capital requirements, and the compliance obligations that follow once a licence is granted.

What Is the Payment Services Act?

The PS Act came into force on 28 January 2020. It consolidated two earlier statutes — the Payment Systems (Oversight) Act 2006 and the Money-Changing and Remittance Businesses Act — into a single, activities-based licensing regime administered by the Monetary Authority of Singapore (MAS).

The reform was driven by a straightforward problem: Singapore’s fintech and crypto sectors had grown faster than the pre-existing framework could accommodate. E-wallets and cryptocurrency exchanges either sat outside the regulatory perimeter entirely or operated under rules not designed for them. The PS Act brought all of these within a unified, technology-neutral structure.

The Payment Services (Amendment) Act 2021 significantly expanded the original scope. From April 2022, digital payment token (DPT) service providers — including cryptocurrency exchanges, custodians, and DPT transfer facilitators — came under MAS licensing requirements. Further amendments took effect from April 2024, tightening the DPT framework further and introducing user protection obligations.

The Seven Regulated Payment Services

Section 5 of the PS Act lists the activities that require a licence. Operating any of these without authorisation is a criminal offence. The seven regulated payment services are:

• Account issuance service — operating payment accounts for customers
• Domestic money transfer service — transferring funds between parties within Singapore
• Cross-border money transfer service — transferring funds between Singapore and overseas recipients
• Merchant acquisition service — processing payment transactions on behalf of merchants
• E-money issuance service — issuing electronic money stored in payment accounts or instruments
• Digital payment token (DPT) service — buying, selling, facilitating the exchange, or transmitting DPTs (including cryptocurrencies)
• Money-changing service — manual foreign currency exchange

A single operator can hold authorisation for multiple services under one licence. The licence terms specify each authorised activity expressly.

Three Licence Classes: MPI, SPI, and Money-Changing

The PS Act establishes three licence classes. The appropriate class depends on the type and scale of activities the operator intends to carry out.

The Money-Changing Licence is the narrowest class. It is limited to manual foreign currency exchange and is not relevant to most fintech or digital asset operators.

The Standard Payment Institution (SPI) Licence applies to lower-volume operators. It is subject to monthly transaction thresholds and a daily e-money float ceiling. Below those thresholds, SPI is the applicable class.

The Major Payment Institution (MPI) Licence applies to operators that exceed SPI thresholds or that carry out certain activities — such as DPT services at scale — that require the higher-tier authorisation. The MPI carries more rigorous capital, safeguarding, and compliance obligations.

For operators considering a Singapore payments licence alongside other regulated activities, it is worth noting that some business models may also touch on capital markets regulation. Our Crypto and VASP Licensing service covers the intersection between DPT licensing and broader asset-class regulation in Singapore and comparable jurisdictions.

SPI vs MPI: The Threshold Tests

The threshold distinction between SPI and MPI is mechanical. A firm qualifies for the SPI class if it meets all three of the following conditions:

• Monthly transaction volume for any single payment service does not exceed SGD 3 million
• Monthly transaction volume across two or more payment services does not exceed SGD 6 million
• Daily outstanding e-money does not exceed SGD 5 million

Once projected or actual volumes breach any of these thresholds, the MPI authorisation is required. Cross-border money transfer is a regulated activity under both SPI and MPI. SPI is available if monthly volume stays within SGD 3 million per service and SGD 6 million combined. Above those caps, MPI is required.

For DPT services, MPI is required where monthly transaction volumes exceed SGD 3 million or where the operator holds customer funds or digital tokens in custody. Most exchanges, OTC desks, and custodians operating at scale apply directly for an MPI. Operators anticipating growth past SPI thresholds within 12 months are generally advised to apply for an MPI from the outset to avoid a mid-cycle uplift application.

Eligibility Requirements

Both SPI and MPI licences are available only to Singapore-incorporated companies with a permanent place of business in Singapore. A foreign group that wishes to hold a PS Act licence must establish a Singapore subsidiary. The licence is granted to the entity — not the group — and any change of control triggers notification or approval obligations under Section 28 of the PS Act.

Key personnel requirements include:

• At least one executive director ordinarily resident in Singapore
• A CEO with substantive payments or fintech experience
• For MPIs: a dedicated risk and compliance officer with adequate authority and seniority
• All key controllers and directors must satisfy MAS fit-and-proper criteria

MAS expects a clear governance structure with an independent compliance function. For DPT service providers, a Money Laundering Reporting Officer (MLRO) must also be appointed.

Since August 2024, all new SPI and MPI applications must be accompanied by a legal opinion confirming the applicant’s business model and proposed activities comply with the PS Act. A generic in-house legal memo does not satisfy this requirement. Applications to vary an existing licence to add DPT services also require a legal opinion.

Capital and Prudential Requirements

Base capital requirements under the PS Act vary by licence class and by the type of payment services authorised:

• SPI: SGD 100,000 minimum base capital
• MPI (most services): SGD 250,000 minimum base capital

These are floor requirements, not operational targets. MAS expects an applicant’s base capital to cover at least 6 to 12 months of operating expenses. Applicants must also demonstrate an effective monitoring process and contingency plans for capital shortfalls.

MPIs involved in e-money issuance or certain account issuance activities must safeguard relevant customer money through one of three permitted methods: a trust account at an MAS-licensed bank, a written undertaking from a Singapore-incorporated bank, or an undertaking from a prescribed insurer. For DPT service providers, safeguarding requires segregating customer assets in a trust account, maintaining separate blockchain addresses for customer holdings, ensuring at least 90% of customer assets are held in cold wallets, and requiring multi-party authorisation for transactions.

Key 2024 Amendments and Their Impact

The April 2024 amendments to the PS Act and Payment Services Regulations represent the most significant expansion of the regime since the 2021 Amendment Act. Operators in the DPT space should treat the post-April 2024 framework as the operative baseline.

The key changes introduced or activated from April 2024 include:

• Expanded DPT scope: Custodial DPT services, DPT transmission, and DPT exchange activities were brought fully within the licensing perimeter
• User protection requirements: DPT service providers must segregate customer assets, maintain daily reconciliation, and comply with restrictions on lending or staking retail customers’ tokens
• Stablecoin framework: Single-currency stablecoin issuers with total circulation exceeding SGD 5 million must hold reserve assets equivalent to par value at all times, denominated in the same currency as the peg
• Technology Risk Management Notice (FSM-N13): From November 2024, all licensees providing DPT services must comply with this notice, supplementing the existing MAS Technology Risk Management Guidelines
• Legal opinion and external auditor assessment: New applicants (SPI and MPI) must submit both a legal opinion and an independent external auditor’s assessment confirming AML/CFT compliance and business activities

These changes reflect MAS treating DPT licensing as a higher-risk activity. The direction of regulatory travel is clear: institutional-grade controls are expected from day one, not after licensing.

The Application Process, Step by Step

The MAS application is filed with Form 1 through the MAS online licensing portal. The process is sequential, and preparation quality at each stage directly affects review timelines. The core steps are:

1. Incorporate the Singapore entity — Establish a Singapore private limited company or repurpose an existing entity. Open a corporate bank account. See our Corporate Formation service for practical structuring support.
2. Capitalise the entity — Fund the entity to at least the applicable base capital floor, with sufficient buffer to demonstrate 6 to 12 months of operating expense coverage.
3. Hire key personnel onshore — Appoint the CEO, resident executive director, and compliance officer. For DPT services, also appoint an MLRO.
4. Build the policy stack — Draft the AML/CFT manual, transaction monitoring policy, sanctions screening procedures, technology risk management policy, business continuity plan, and outsourcing policies. These must be production-ready, not template documents. Our AML and Compliance team supports this phase end to end.
5. Obtain the legal opinion — Commission an independent legal opinion confirming the proposed activities fall within the relevant PS Act categories and that no exemptions are incorrectly relied upon.
6. Commission the external auditor assessment — For DPT applicants and all new licence applications, obtain an independent auditor’s attestation on AML/CFT compliance and business activities.
7. Arrange safeguarding — Identify the safeguarding bank or insurer and execute the required trust deed or undertaking. MAS expects this to be in place before in-principle approval is granted.
8. File via FINNet — Submit the complete application: business plan, organisation chart, technology architecture, financial projections, policy documents, legal opinion, auditor assessment, and fit-and-proper declarations for all key persons and controllers.
9. Respond to MAS queries — MAS will typically issue one or more rounds of written queries. Response quality and turnaround time at this stage significantly affect overall timeline.
10. Operational walkthrough — MAS typically requests a live demonstration of the transaction monitoring system, sanctions screening tool, and customer onboarding flow before issuing in-principle approval.
11. Satisfy conditions and commence operations — Once in-principle approval is granted, complete any outstanding conditions. The full licence is then issued and operations may commence.

Costs and Timeline

MAS application fees are SGD 1,000 for an SPI and SGD 1,500 for an MPI. A separate flat annual licence fee of SGD 5,000 applies to both tiers at renewal. These are the regulatory fees only. External advisory costs are substantially higher.

Typical cost items for an MPI application (excluding capital injection and application fees):

• Annual audit and compliance: SGD 30,000 to SGD 80,000
• Resident director and admin: SGD 50,000 to SGD 150,000 per year

Fully loaded Year-1 cost is typically SGD 280,000 to SGD 430,000 for an MPI, inclusive of base capital and security deposit. SPI Year-1 cost is materially lower, at approximately SGD 80,000 to SGD 230,000, reflecting the lower capital requirement and reduced complexity of the application.

Timeline from filing to in-principle approval generally runs 12 months or more, with no fixed upper bound. Applications involving DPT services tend toward the longer end, particularly where independent audits, additional technology risk management testing, or multiple MAS query rounds are required.

Ongoing Compliance Obligations

Licensing is the beginning, not the end, of MAS engagement. Authorised MPIs and SPIs carry a structured set of ongoing obligations:

• Quarterly returns: Transaction volumes, e-money outstanding, safeguarding reconciliations, and complaints data
• Annual audited financials: Filed within four months of the financial year-end
• AML/CFT programme maintenance: Board-approved policies covering customer due diligence, beneficial ownership identification, sanctions screening, and transaction monitoring — updated to reflect the current version of MAS Notices PSN01 (specified payment services) and PSN02 (DPT services)
• Travel Rule compliance: For DPT transfers of SGD 1,500 or more, originating institutions must transmit originator identification data to the beneficiary institution before or at the time of transfer
• Technology risk management: Compliance with the MAS Technology Risk Management Guidelines and, for DPT licensees, Notice FSM-N13. MPIs must notify MAS within one hour of a service outage affecting customers, conduct annual penetration testing, and maintain a tested incident response plan
• MAS inspections: Risk-based and can be on-site without notice. First reviews often fall in the first 12–18 months after licensing. Later frequency depends on the firm’s risk profile
• DPT-specific: Daily reconciliation of customer assets, monthly and semi-annual MAS submissions, and annual audit with DPT custodial safety attestation

For operators managing parallel regulatory obligations across multiple jurisdictions, our Jurisdiction Advisory and AML and Compliance services are structured to keep licensees fully operational — not just initially approved.

MAS Enforcement: What the 2025 Penalties Signal

In June 2025, MAS imposed composition penalties totalling SGD 960,000 on five MPIs licensed to provide cross-border money transfer services — the first publicly reported instance of MAS issuing penalties against PS Act licensees specifically for AML/CFT breaches. The breaches included failures to screen customers and beneficial owners against sanctions lists, incomplete customer identification procedures, and non-compliance with wire transfer originator information requirements.

One week later, in July 2025, MAS imposed further composition penalties of SGD 27.45 million on nine financial institutions in connection with the SGD 3 billion money laundering case uncovered in August 2023. Across both sets of actions, MAS emphasised the role of senior management accountability in ensuring AML/CFT compliance.

These enforcement actions carry a clear message: MAS expects PS Act licensees to maintain live, tested compliance programmes — not static policy documents. The two most common failure points identified were inadequate customer due diligence and transaction monitoring gaps. Both are areas MAS inspectors focus on from the first post-licensing review.

Common Application Mistakes

Based on the application patterns MAS reviews and the reasons applications are delayed or rejected, the most common avoidable errors are:

• Weak AML/CFT framework: Submitting template policies not tailored to the applicant’s specific business model and risk profile. MAS expects a production-ready framework, not a draft.
• Overclaiming activities: Applying for all seven payment services on day one without demonstrating operational readiness for each. MAS will question every activity claimed.
• Incomplete safeguarding arrangements: MAS expects the safeguarding bank to be identified and a signed trust deed or undertaking to be in place before in-principle approval is granted. Leaving this to post-approval causes material delays.
• Stale or misaligned policies: Submitting policies that predate the 2022 or 2024 amendments, or that lack coverage of DPT-specific risk scenarios where the applicant intends to provide DPT services.
• Underestimating technology risk requirements: The MAS Technology Risk Management Guidelines are a substantive compliance obligation, not a checklist. Applicants must demonstrate a functioning framework, not a paper commitment.
• Missing the legal opinion requirement: Since August 2024, this is mandatory for all new SPI and MPI applications. Applications submitted without it will not be accepted for review.

FAQs

Can a foreign company apply for an MPI or SPI directly?

No. Both licences require a Singapore-incorporated company with a permanent place of business in Singapore. Foreign groups must establish a Singapore subsidiary. The licence is granted to the entity, not the group.

Can I start with an SPI and upgrade to an MPI later?

Yes, but upgrading requires a fresh application with refreshed projections, capital, and safeguarding arrangements. Operators expecting to cross SPI thresholds within 12 months are generally advised to apply directly for an MPI to avoid the disruption and cost of a mid-cycle uplift.

What is the capital requirement for a crypto exchange?

A cryptocurrency exchange providing DPT services requires an MPI licence with SGD 250,000 in base capital, maintained on an ongoing basis.

What triggers a change-of-control notification under Section 28?

Acquiring 5% of a payment institution’s voting rights requires notification to MAS. Acquiring 12%, 20%, or 50% requires prior MAS approval. Any change of control that crosses these thresholds without the required notification or approval is a breach of the PS Act.

Does the PS Act apply to overseas operators serving Singapore users?

MAS made its extraterritorial position explicit in 2021. Entities incorporated abroad but actively marketing to Singapore residents are within the regulatory perimeter. Operating without a licence — including from offshore — is a criminal offence under Section 5 of the PS Act.

Is a PS Act licence sufficient for all fintech activities in Singapore?

Not always. Some business models touch on capital markets activities regulated under the Securities and Futures Act — for example, certain DPT custody structures or tokenised securities. Operators should assess whether a dual-licence footprint is required before filing. Our Jurisdiction Advisory service addresses this at the scoping stage.

Next Steps

The Singapore payments licensing framework is mature, well-structured, and increasingly enforced. Getting the licence class right, meeting MAS’s documentation standards, and building a compliance programme that holds up to inspection are all areas where preparation quality directly determines outcomes.

GSS Legal operates from Singapore and supports operators across the full lifecycle: jurisdiction selection, entity structuring, application preparation, banking and safeguarding setup, and long-term regulatory stewardship. If you are assessing whether Singapore is the right jurisdiction for your payment service, or preparing a PS Act application, our team can advise on the practical decisions that determine timelines and first-pass approval rates. Explore our Banking and EMI/PSP and AML and Compliance services, or review our Success Cases for examples of how we have supported payment and digital asset operators in Singapore and across the region.