Understand when a MAS DPT licence applies versus a CMS licence for crypto, covering PSA, SFA, FSMA regimes, SPI vs MPI thresholds, and key application requirements.

Singapore is one of the few jurisdictions where crypto regulation has reached genuine operational maturity. The Monetary Authority of Singapore (MAS) has built a structured, activity-based licensing framework — but for many applicants, the first and most consequential question remains unanswered: do you need a Digital Payment Token (DPT) licence under the Payment Services Act, a Capital Markets Services (CMS) licence under the Securities and Futures Act, or both?

The answer depends entirely on what your business does and what type of token it handles. Getting this wrong at the outset means either applying under the wrong regime or, more commonly, underestimating the scope of what MAS expects to see.

This article sets out exactly how the two main licence types work, what triggers each one, how they interact with the newer FSMA regime for overseas-facing providers, and what applicants need to prepare. If you are a founder, legal counsel, or compliance officer mapping your Singapore licensing strategy, this is the starting point.

How MAS Structures Crypto Regulation

MAS regulates crypto-related activities across three primary statutes, each targeting a different type of token and a different category of business activity.

• Payment Services Act 2019 (PSA) — governs Digital Payment Tokens (DPTs) such as Bitcoin and Ether, and covers buying, selling, exchanging, transferring, and custodying these assets for customers in Singapore.
• Securities and Futures Act 2001 (SFA) — governs capital markets products, including security tokens (tokenised equities, debt instruments, fund units). Entities dealing in, managing, or advising on these assets require a Capital Markets Services (CMS) licence.
• Financial Services and Markets Act 2022 (FSMA) — extends MAS oversight to Singapore-incorporated entities providing digital token services exclusively to customers outside Singapore, effective 30 June 2025.

The framework is activity-based and token-type-specific. The same business model can trigger one, two, or all three regimes depending on what it offers and to whom. This is the foundational principle that every Singapore crypto licensing strategy must start from.

The DPT Licence: Payment Services Act Explained

A DPT licence is the standard regulatory authorisation for businesses that handle cryptocurrencies — assets that function as a medium of exchange but do not represent an ownership stake in a company or fund. Bitcoin, Ether, USDC, and most mainstream cryptocurrencies fall into this category.

Under the PSA, the following activities involving DPTs require a licence:

• Buying or selling DPTs
• Facilitating the exchange of DPTs between buyers and sellers
• Transferring DPTs on behalf of customers
• Providing custodian wallet services
• Facilitating cross-border DPT transfers

Operating any of these services in Singapore without a licence is a criminal offence. MAS maintains a public register of licensed DPT providers, and enforcement against unlicensed activity has become increasingly active. A DPT licence under the PSA is issued in one of two classes: Standard Payment Institution (SPI) or Major Payment Institution (MPI).

SPI vs. MPI: Which Licence Class Do You Need?

The choice between an SPI and an MPI licence is determined primarily by transaction volume and the nature of the payment services being provided. Both licences cover DPT services, but they carry different capital requirements and regulatory obligations.

For most institutional-grade crypto exchanges and DPT service providers, the MPI is the relevant licence. The SPI path works for lower-volume or single-service operators, but if your 12-month projections approach the thresholds, applying for an MPI at the outset avoids the cost and delay of a later licence variation. In some cases, the nature of the activity itself — particularly large-scale DPT services — places an operator within MPI-level obligations regardless of volume.

The CMS Licence: When the Securities and Futures Act Applies

A Capital Markets Services (CMS) licence is required when the digital assets in question are not DPTs but rather capital markets products — tokens that represent an ownership interest, investment return, or economic exposure to an underlying asset.

Security tokens, tokenised equities, tokenised debt instruments, and units in collective investment schemes (CIS) all fall under the SFA, not the PSA. MAS applies a technology-neutral approach: the tokenisation of a capital markets product does not change its regulatory status. A tokenised share is still a share. A tokenised bond is still a bond.

The CMS licence covers the following regulated activities under the SFA’s Second Schedule:

• Dealing in capital markets products (including security tokens)
• Fund management (including crypto asset funds and digital asset portfolios)
• Providing custodial services for capital markets products
• Operating an organised market (exchange or trading platform for securities)
• Advising on corporate finance
• Providing credit rating services

Capital requirements under the CMS regime vary by activity type, ranging from SGD 50,000 to SGD 1,000,000 depending on the scope of regulated activities. Confirm the applicable figure against MAS guidance for your specific activity before budgeting. The CMS licence does not carry the transaction volume thresholds seen in the PSA — eligibility is based on fit-and-proper criteria, governance structure, and the nature of the activity rather than transaction scale.

DPT vs. CMS: A Side-by-Side Comparison

The FSMA Layer: Digital Token Service Providers

From 30 June 2025, MAS introduced a third licensing layer under the Financial Services and Markets Act 2022 (FSMA), targeting Singapore-incorporated entities that provide digital token services exclusively to customers outside Singapore. Previously, such businesses could operate from Singapore without a MAS licence. That exemption has been closed.

MAS has been explicit that it will grant DTSP licences only in extremely limited circumstances. Applicants must demonstrate a valid business reason for not serving Singapore customers, robust compliance with international AML standards, and a structure that does not raise regulatory concerns. The bar is high — and intentionally so. MAS has cited the higher money laundering risk in purely offshore models and the practical difficulty of supervising businesses with no Singapore customer base.

Entities already licensed under the PSA, SFA, or FAA to serve Singapore customers are not separately affected by the DTSP regime. The FSMA layer applies specifically to operators whose entire customer base sits outside Singapore. Businesses serving both Singapore and overseas customers continue to operate under the PSA or SFA as before.

For businesses evaluating whether a Singapore entity should serve overseas clients at all, this development has significant implications for entity structuring. This is exactly the kind of question a jurisdiction advisory engagement should address before incorporation.

When You Need Both a DPT and a CMS Licence

Several common crypto business models require both a DPT licence and a CMS licence. The PSA and SFA are not mutually exclusive — they apply in parallel when a business handles both DPTs and security tokens.

Dual licensing is typically required in the following scenarios:

• Hybrid exchanges that list both cryptocurrencies (DPTs) and tokenised securities or structured products
• Security token offering (STO) platforms that also handle DPT-denominated settlement or custody
• Crypto asset fund managers whose funds hold both DPTs and tokenised capital markets products
• Custodians providing custody for both DPT assets and tokenised securities in a single platform

Token classification is not always straightforward. MAS assesses the substance of a token — its economic features, governance rights, and how it is marketed — rather than how the issuer labels it. A token that offers profit participation or represents fractional ownership of a real-world asset is likely a capital markets product regardless of what it is called. Applicants with tokens in a grey area should obtain a formal regulatory classification before committing to a single licensing pathway. Our crypto and VASP licensing practice works through exactly this analysis as part of engagement onboarding.

Core Requirements Across Both Regimes

While the DPT and CMS regimes operate under different statutes, they share several substantive requirements that any applicant must prepare for.

Corporate Structure

Applicants under both regimes must be incorporated in Singapore (or registered as a foreign company with a permanent place of business here). At least one executive director must be ordinarily resident in Singapore. For CMS applications, the CEO must demonstrate relevant experience — typically a minimum of 10 years in the relevant activity. For DPT applications, a local compliance officer with direct AML/CFT responsibility is mandatory.

Fit and Proper

All directors, the CEO, and substantial shareholders (generally those holding more than 10%) must pass MAS’s fit-and-proper assessment. This covers integrity, financial soundness, regulatory track record, and professional competence. MAS applies this assessment rigorously, and a history of regulatory action in any jurisdiction — even outside Singapore — will be scrutinised.

AML/CFT Framework

Both DPT and CMS applicants must have an operational AML/CFT framework in place, not merely documented. For DPT applicants, MAS requires an enterprise-level ML/TF risk assessment, customer due diligence procedures, a travel rule solution, and a compliance officer appointed at management level. Since August 2024, DPT applicants must also submit an Independent External Auditor Assessment covering AML/CFT and consumer protection obligations as part of the initial application. A robust AML and compliance programme is not a post-approval obligation — it is an application prerequisite.

Technology Risk Management

MAS expects applicants to demonstrate cybersecurity controls, incident response procedures, and technology risk governance appropriate to the scale and nature of their operations. This applies to both DPT and CMS applicants providing online financial services. The requirement has become progressively more detailed as MAS has updated its Technology Risk Management guidelines.

Consumer Protection (DPT-Specific)

For DPT licensees serving retail customers, MAS has layered in a set of retail investor protection measures: mandatory risk warnings, prohibition on marketing DPT services to the general public, restrictions on credit card purchases, and customer risk assessment requirements before onboarding. These apply as ongoing conduct obligations, not just at application stage.

Application Process and Timeline

Both the DPT (PSA) and CMS (SFA) applications are submitted through MAS online portals. The process for each involves a pre-application preparation phase, formal submission, a MAS review period with potential queries, and a pre-conditions phase before final approval is granted.

For DPT applications, the typical process runs as follows:

1. Scope confirmation — Map each activity against the PSA First Schedule to confirm which services require licensing and at which licence class (SPI or MPI).
2. Compliance build — Establish the AML/CFT framework, appoint key personnel, set aside base capital, and prepare the required technology risk controls and custody arrangements.
3. Submission — Lodge the application through the MAS portal with the full document pack. The government application fee is SGD 1,000 for an SPI and SGD 1,500 for an MPI.
4. MAS review — Typically 6 to 12 months, during which MAS may issue queries. Incomplete applications or weak compliance documentation extend this phase considerably.
5. Pre-conditions and approval — Following in-principle approval, applicants must satisfy any pre-conditions before the licence is formally granted.

For CMS applications, processing typically takes 6 to 9 months for straightforward cases. Applications involving digital asset activities or complex structures — robo-advisory, crypto fund management, tokenised securities platforms — can take 12 to 18 months, and unresolved query rounds extend that further.

The most common causes of delay are incomplete documentation, AML/CFT policies that do not cover all required risk scenarios, unclear business model descriptions, and governance arrangements that do not meet MAS’s expectations for the scale of activity proposed.

Choosing the Right Licence for Your Business

The licence question in Singapore is not a filing formality — it is a structural decision that affects your entity setup, capital allocation, personnel requirements, and go-to-market timeline. Getting the right answer early prevents costly restructuring later.

Use the following as a starting framework:

• If you buy, sell, exchange, transfer, or custody cryptocurrencies (BTC, ETH, stablecoins) for Singapore customers → DPT licence under the PSA (SPI or MPI depending on volume).
• If you manage a crypto fund, operate an STO platform, or deal in tokenised securities → CMS licence under the SFA.
• If you do both → both licences are required; token classification analysis is essential before applying.
• If you are a Singapore-incorporated entity serving only overseas customers with DPT or capital markets token services → DTSP regime under FSMA applies from June 2025, and MAS will grant licences only in exceptional circumstances.
• If your token type is unclear → formal classification analysis before application is not optional — it is the first step.

Singapore’s licensing environment rewards preparation. MAS assesses applications on their merits, and applicants that arrive with a coherent business model, properly capitalised entities, operational compliance frameworks, and experienced management teams consistently move through the process more efficiently. Those that treat the application as primarily a paperwork exercise tend to encounter prolonged query cycles or outright rejections.

GSS Legal operates from Singapore and Ho Chi Minh City, advising clients across the full spectrum of MAS licensing — from initial jurisdiction and structure advisory through DPT and VASP licence applications, AML/CFT programme design, banking and EMI/PSP setup, and post-approval regulatory stewardship. If you are mapping a Singapore crypto licensing strategy, the right starting point is understanding exactly which regime — and which licence class — your business model triggers.

Summary

Singapore’s MAS crypto licensing framework is structured, enforceable, and broadening in scope. The DPT licence under the PSA applies to businesses handling mainstream cryptocurrencies for Singapore customers. The CMS licence under the SFA applies to businesses dealing in security tokens or capital markets products in tokenised form. The DTSP regime under the FSMA now closes the gap for Singapore-based entities serving overseas-only clients.

The decision between these pathways — and the question of whether more than one applies — turns on a precise analysis of what tokens your business handles, what activities it performs, and who its customers are. That analysis should happen before incorporation, not after. Getting the licence type right from the outset is the most efficient path to regulatory approval and operational launch in Singapore.