A practical guide to obtaining a crypto exchange licence in Singapore under MAS — covering the PSA, FSMA, SPI vs. MPI, application steps, and ongoing obligations.

Singapore has built one of the most respected regulatory environments for digital assets in Asia. The Monetary Authority of Singapore (MAS) licences crypto exchanges and Digital Payment Token (DPT) service providers through a framework that prioritises compliance, consumer protection, and institutional credibility — not just market access.

That credibility comes at a cost. Becoming a licensed crypto exchange in Singapore requires navigating multiple pieces of legislation, meeting demanding governance and capital standards, and submitting an application that MAS will scrutinise in considerable detail. The process typically takes twelve months or more end to end, with no firm upper bound.

This guide explains exactly what the licensing path involves — which law applies to your business model, how to select the right licence type, what MAS expects in an application, and what ongoing obligations come after approval. The aim is to give founders, legal counsel, and compliance officers the clarity to make well-informed decisions before committing to the process.

Singapore’s Regulatory Framework for Crypto Exchanges

Three pieces of legislation define the regulatory perimeter for crypto businesses in Singapore. Understanding which one applies to your operation is the starting point for every licensing decision.

Payment Services Act 2019 (PSA) — This is the primary law governing DPT services provided to customers in Singapore. It was amended in 2021 to extend licensing requirements to a broader set of activities, including custodial services, DPT exchange facilitation, and cross-border transfers. Any business buying, selling, exchanging, or safeguarding cryptocurrencies for customers in Singapore must be licensed under the PSA as either a Standard Payment Institution (SPI) or a Major Payment Institution (MPI).

Financial Services and Markets Act 2022 (FSMA) — Effective June 30, 2025, the FSMA introduced a separate licensing regime for Digital Token Service Providers (DTSPs): entities incorporated in Singapore that provide digital token services to clients outside the country. This closed the previous gap that allowed some firms to use Singapore as an operational base while serving only overseas clients without a local licence. There is no transitional period — firms in scope were required to hold a DTSP licence from the date the regime took effect.

Securities and Futures Act (SFA) — Where a token qualifies as a capital markets product (for example, a security token representing equity or debt), the SFA governs. Issuers and intermediaries dealing in such tokens require a separate licence under that framework, which is outside the scope of this guide.

MAS also issues binding notices and guidelines that sit alongside these laws, including Notice PSN02 (AML/CFT obligations for DPT service providers), Technology Risk Management Guidelines covering cybersecurity and IT governance, and a stablecoin regulatory framework for tokens pegged to the Singapore dollar or G10 currencies, which requires full reserve backing.

Licence Types: SPI, MPI, and DTSP

For businesses serving customers in Singapore, the PSA offers two licence tiers based on transaction volume. For businesses serving customers outside Singapore from a Singapore base, the FSMA DTSP regime applies instead.

Standard Payment Institution (SPI)

The SPI licence suits smaller operators whose projected volumes remain within the prescribed thresholds: monthly DPT transaction volume up to SGD 3 million per service, or SGD 6 million across services, and an average daily e-money float not exceeding SGD 5 million. The minimum base capital is SGD 100,000. SPI holders face lighter ongoing reporting obligations and are not subject to the full safeguarding requirements that apply to MPI holders.

Major Payment Institution (MPI)

The MPI licence applies when either SPI threshold is exceeded. There are no upper volume limits under the MPI framework, making it the appropriate structure for any exchange targeting meaningful transaction scale. The minimum base capital is SGD 250,000, and MPI holders must additionally maintain a security deposit of at least SGD 100,000 or SGD 200,000 with MAS, depending on projected volume. The MPI regime carries full prudential and safeguarding obligations, stricter internal control requirements, and more detailed regulatory reporting.

Most institutional crypto exchanges and businesses targeting regional growth will require an MPI licence. The capital difference between SPI and MPI is modest; the compliance burden is not.

Digital Token Service Provider (DTSP)

The DTSP licence under the FSMA applies to Singapore-incorporated companies — and individuals or partnerships operating from a Singapore business location — that provide digital token services exclusively to clients outside Singapore. Base capital of SGD 250,000 is required, as is a Singapore-based compliance officer, and applicants must conduct penetration testing of their proposed DT services prior to licence issuance. MAS has stated clearly that DTSP licences will be granted only in extremely limited circumstances, reflecting a deliberate policy choice to restrict rather than encourage this structure.

Businesses already licensed under the PSA, SFA, or Financial Advisers Act for the same activities do not require a separate DTSP licence for those overlapping services.

Who Needs a Licence — and Under Which Law

MAS licences activities, not entities. The key question is what your business does, not what it is called.

A PSA licence is required if your business, in the course of trade or business in Singapore, does any of the following:

• Buys or sells DPTs (including Bitcoin and Ether)
• Facilitates the exchange of DPTs for other DPTs or fiat currency
• Operates a platform on which customers can trade DPTs
• Provides custodial or safeguarding services for DPTs on behalf of clients
• Facilitates DPT transfers

The PSA’s territorial reach also extends to overseas entities that actively solicit Singapore residents. If your exchange’s marketing, onboarding, or services are directed at users in Singapore, you are likely captured — regardless of where the company is incorporated.

The DTSP regime under the FSMA captures the reverse scenario: Singapore-incorporated companies (or Singapore-based individuals and partnerships) whose DT services are directed exclusively at overseas clients. Under the rules effective from June 30, 2025, operating without a DTSP licence in these circumstances can result in penalties of up to SGD 250,000 and three years’ imprisonment.

Core Eligibility Requirements

MAS assesses readiness, not intention. An applicant must demonstrate operational capability and compliance infrastructure at the time of submission — not after approval. The core requirements across both PSA licence types are as follows:

Corporate structure: The entity must be incorporated in Singapore as a private limited company and registered with the Accounting and Corporate Regulatory Authority (ACRA).

Resident director: At least one executive director must be a Singapore citizen or permanent resident, or one executive director on an Employment Pass plus one other director who is a Singapore citizen or permanent resident. The executive director is expected to be resident in Singapore.

Local presence: A registered office and physical place of business in Singapore is required, with all books and records maintained there.

Capital: Minimum base capital of SGD 100,000 (SPI) or SGD 250,000 (MPI), with MAS also expecting the company to hold sufficient capital above the minimum to fund ongoing operations.

Fit and proper: Directors, shareholders with substantial interests, the CEO, and key officers must meet MAS’s fit and proper criteria covering honesty, integrity, and relevant competence.

Compliance officer: A dedicated AML/CFT compliance officer at management level, based in Singapore, is required.

Beyond these structural requirements, an applicant must submit documented frameworks covering:

• AML/CFT policies and procedures, including customer due diligence (CDD), transaction monitoring, and suspicious transaction reporting
• A Technology Risk Management (TRM) framework addressing cybersecurity, IT governance, and operational resilience
• A Business Continuity Plan and Disaster Recovery Plan
• A client asset custody policy
• A detailed business plan with three-year financial projections and fund flow diagrams
• A legal opinion from Singapore-qualified counsel covering the business model analysis, token classification, and regulatory perimeter mapping

MAS will also scrutinise the source of funds for the applicant entity and for its ultimate beneficial owners.

The Application Process, Step by Step

A realistic end-to-end timeline runs twelve months or more, with no firm upper bound. The quality of the initial submission is the single biggest variable — applications with weak AML frameworks, incomplete fund flow documentation, or inconsistent disclosures generate extended query rounds that can push timelines well beyond twelve months.

1. Regulatory scoping — Confirm whether your activities are in scope, identify which law applies (PSA, FSMA, SFA, or a combination), and determine the appropriate licence type based on your business model and projected volumes.
2. Corporate setup — Incorporate the Singapore entity with ACRA, appoint a resident director, and establish a registered office. For most applicants, this runs in parallel with document preparation.
3. Business model documentation — Produce end-to-end transaction flow diagrams, a board-approved business plan, three-year financial projections, and a legal opinion from Singapore counsel. These form the analytical backbone of the application.
4. Compliance framework development — Draft board-approved manuals for AML/CFT, technology risk management, and internal controls. MAS Notice PSN02 sets the AML/CFT standard; the TRM Guidelines set the cybersecurity standard. This is the most scrutinised and most commonly underestimated phase.
5. Submission through MAS LTVP/MASNET — The application is filed through MAS’s online licensing system with the full document package attached. MAS does not process partial submissions.
6. MAS review and query rounds — A case officer reviews the file and typically issues two to three rounds of written clarification requests. Key executives — including the CEO and compliance officer — may be interviewed directly by MAS. External advisers cannot attend these interviews.
7. In-Principle Approval (IPA) — If the application is substantively satisfactory, MAS issues an IPA that sets out conditions the applicant must satisfy before the full licence is granted. These commonly include penetration testing, finalisation of compliance systems, and evidence of operational readiness.
8. Full licence issuance — Once all IPA conditions are evidenced to MAS’s satisfaction, the PSA licence is granted and the business can legally commence operations. Ongoing compliance obligations begin from this date.

Post-Licence Obligations

Obtaining the licence is not the end of MAS’s oversight — it is the beginning of active supervision. Licensed DPT service providers are subject to continuous obligations that must be embedded into daily operations.

AML/CFT compliance: Ongoing compliance with MAS Notice PSN02, including customer due diligence at onboarding and on a risk-triggered basis, real-time transaction monitoring, and suspicious transaction reporting. The Travel Rule for cross-border DPT transfers is mandatory. A management-level compliance officer must remain in post in Singapore.

Technology risk: Cybersecurity standards under MAS Notice FSM-N14 apply on a continuous basis. Penetration testing must be conducted periodically, and high-risk findings must be remediated promptly.

Annual audit: An independent auditor must be appointed each year to review both financial compliance and regulatory adherence, with findings reported to MAS.

Regulatory reporting: Periodic financial and activity returns must be submitted to MAS. Material events — including cyber incidents, AML breaches, financial deterioration, significant operational disruptions, and changes in ownership or control — must be reported promptly. Failure to report is itself a regulatory offence.

Customer asset protection: Since 2024, MAS requires that customer DPTs be held in trust or segregated from company assets. MPI holders are subject to full safeguarding requirements.

Why Singapore for a Crypto Exchange Licence

Singapore’s appeal as a licensing jurisdiction for crypto exchanges rests on a combination of factors that are difficult to replicate in any single competing jurisdiction.

Regulatory credibility: MAS is consistently ranked among the world’s most capable financial regulators. A Singapore DPT licence signals to institutional counterparties, banking partners, and investors that the business meets a high compliance standard. That signal has commercial value — particularly when accessing banking services in Asia-Pacific.

Tax treatment: Singapore levies no capital gains tax. DPT transactions have been exempt from Goods and Services Tax (GST) since 2020. The corporate tax rate is 17%, with startup incentive schemes reducing the effective rate on early-stage income.

Market access: Singapore’s position as Southeast Asia’s primary financial hub provides direct access to the region’s fast-growing digital asset markets, alongside established relationships with institutional capital, fintech infrastructure, and qualified compliance talent.

Regulatory predictability: MAS’s approach has been consistently articulated and progressively updated — from the PSA in 2019 through to the FSMA in 2025. Businesses operating under MAS oversight know the rules and have confidence that regulatory developments will be consulted on in advance.

What Delays Applications — and How to Avoid It

MAS reviews applications on a rolling basis and does not publish queue positions. The most reliable way to control timeline is to submit a complete, well-structured application in the first instance. The most common causes of delay and rejection are:

• Incomplete or internally inconsistent fund flow documentation
• AML/CFT frameworks that fail to reflect the specific risks of the applicant’s business model
• Business plans that do not address MAS’s consumer protection expectations
• Key personnel who cannot demonstrate sufficient relevant experience during MAS interviews
• Underdeveloped technology risk management documentation
• Source of funds queries that are answered slowly or incompletely

Each of these issues generates written clarification requests. Each round of queries extends the timeline. MAS assesses the quality of responses as an indicator of the applicant’s overall compliance culture — slow, incomplete, or evasive answers reflect poorly on the application as a whole.

How GSS Legal Supports Your MAS Application

GSS Legal operates from Singapore, advising crypto and VASP clients across the full licensing lifecycle — from jurisdiction and licence-type selection through to application submission, MAS query management, and post-licence compliance. Our Singapore desk works directly with applicants on the documents that MAS scrutinises most: AML/CFT frameworks, fund flow architecture, and business plan structuring.

We work across more than 50 jurisdictions and have delivered over 800 licences globally, including across Asia’s primary crypto licensing centres. That breadth means we can help you assess Singapore against alternatives — whether that is other VASP frameworks, a CASP licence in the EU, or a parallel structure in a complementary jurisdiction. Where a Singapore MAS licence is the right answer, we build the application to pass first review.

Beyond licensing, we support clients with corporate formation, banking and PSP setup, and AML and compliance programme development — the full infrastructure a regulated exchange needs to go live and stay compliant. Our jurisdiction advisory service is available for clients who are still deciding where to licence, and our success cases reflect the practical outcomes we have delivered across the region.

Final Thoughts

Getting licensed as a crypto exchange in Singapore is a rigorous, multi-stage process. The framework is well-defined, MAS is accessible, and the jurisdiction offers genuine commercial advantages — but the bar for entry is deliberately high. Applications that treat compliance as a box-ticking exercise rarely succeed.

The businesses that move through the process efficiently are those that understand what MAS is actually assessing: governance maturity, AML/CFT readiness, technology risk discipline, and the credibility of key personnel. Building that substance before submission — not after — is what determines how far past the twelve-month floor a project runs.

If you are evaluating Singapore as a licensing destination, the right starting point is a clear-eyed assessment of your business model against the regulatory requirements, followed by a realistic plan for meeting them. That is where GSS Legal can help.