Understand what MAS-regulated means for crypto exchanges in Singapore — which laws apply, SPI vs MPI licences, the FSMA DTSP layer, and what ongoing compliance requires.

When an exchange claims to be “MAS-regulated,” that phrase carries specific legal weight. It is not a quality badge or a marketing term. It means the entity holds an active licence issued by the Monetary Authority of Singapore under a defined statutory framework, and that it operates under enforceable ongoing obligations.

For founders, compliance officers, and investors, understanding what MAS regulation actually requires — and what it does not — is essential. The Singapore framework has evolved significantly since 2020, most recently with a new licensing layer for cross-border digital token services that came into force on 30 June 2025.

This article explains the regulatory structure in plain language: which laws apply, what activities require a licence, how the two main licence types differ, and what obligations a licensed exchange must maintain on an ongoing basis.

What Is MAS and Why Does Its Oversight Matter?

The Monetary Authority of Singapore (MAS) is Singapore’s integrated financial regulator and central bank. It supervises banks, insurers, capital markets intermediaries, and payment service providers, including cryptocurrency exchanges, under a single regulatory umbrella.

MAS is widely regarded as one of the more rigorous regulators in the Asia-Pacific region. Its approach to digital assets has been deliberately selective: the framework is designed to admit serious operators while filtering out those who cannot meet institutional-grade compliance standards. Several well-known global exchanges exited Singapore after failing to secure a licence under the Payment Services Act.

For a business seeking to operate a crypto exchange from Singapore, holding an MAS licence is not optional — it is a legal prerequisite. For counterparties, banking partners, and institutional clients, an MAS licence is a meaningful signal of regulatory standing.

The Legal Framework: Three Laws You Need to Know

Singapore’s crypto regulatory framework rests on three statutes. Each covers a different aspect of digital asset activity.

1. The Payment Services Act 2019 (PSA)

The PSA is the primary licensing law for crypto exchanges operating in Singapore. It came into force on 28 January 2020, consolidating an earlier fragmented regulatory structure into a single framework covering seven defined payment service categories — one of which is Digital Payment Token (DPT) services.

The Payment Services (Amendment) Act 2021, which took effect in April 2024, significantly broadened the PSA’s scope. It brought DPT custody, facilitation of DPT transfers between accounts, and facilitation of DPT exchanges — including models where the service provider never takes possession of the tokens — within the regulated perimeter.

2. The Securities and Futures Act 2001 (SFA)

The SFA applies where a digital asset is classified as a capital markets product — most commonly a security token. If an exchange lists or intermediates in tokens that qualify as securities under Singapore law, it falls under the SFA and requires separate authorisation. Most standard crypto exchanges dealing in Bitcoin, Ether, and similar assets operate under the PSA, not the SFA.

3. The Financial Services and Markets Act 2022 (FSMA)

The FSMA introduced a separate licensing regime for Digital Token Service Providers (DTSPs) — entities that provide digital token services from Singapore to clients located outside Singapore. This regime came into force on 30 June 2025. It operates alongside, not instead of, the PSA.

If an exchange already holds a PSA licence to serve Singapore clients, it can also serve overseas clients under that same licence. The FSMA DTSP layer is separate: it applies to Singapore-based entities that serve only overseas clients and do not already hold a PSA, SFA, or equivalent licence for the same activity.

What Counts as a Regulated DPT Service?

Under the PSA, the following activities require a licence when conducted in Singapore:

• Buying or selling Digital Payment Tokens (including Bitcoin, Ether, and similar assets)
• Operating a platform through which users can exchange DPTs
• Facilitating the transmission of DPTs between accounts, even where the provider does not take custody
• Facilitating the exchange of DPTs, including indirect or arranged transactions
• Providing custody or safeguarding of DPTs on behalf of clients

MAS applies a functional test rather than a structural one. What matters is the nature of the activity, not how the entity has organised itself legally. A firm that arranges DPT transactions without ever holding funds can still fall within the regulated perimeter. The PSA’s territorial reach also extends to overseas entities that actively solicit Singapore residents.

SPI vs MPI: Which Licence Applies?

Under the PSA, DPT service providers must hold either a Standard Payment Institution (SPI) licence or a Major Payment Institution (MPI) licence. The distinction is primarily based on transaction volume and the scale of operations.

Standard Payment Institution (SPI)

The SPI licence applies to lower-volume operators. The thresholds are as follows:

• Monthly transaction volume must not exceed SGD 3 million for any single payment service type
• Monthly transaction volume must not exceed SGD 6 million in aggregate across two or more service types
• Minimum base capital: SGD 100,000

The SPI licence is typically suited to earlier-stage businesses or those operating at limited scale. Regulatory obligations are lighter than under an MPI, but AML/CFT requirements, fit-and-proper assessments, and the need for a Singapore-resident compliance officer still apply.

Major Payment Institution (MPI)

The MPI licence is required once a business exceeds the SPI thresholds. It carries no transaction volume ceiling, making it the appropriate structure for exchanges operating at scale. Key requirements include:

• Minimum base capital: SGD 250,000
• Mandatory security deposit of at least SGD 100,000
• Stricter risk management, internal controls, and MAS reporting obligations
• Full prudential, safeguarding, and compliance obligations

Most institutional-scale exchanges operating in Singapore hold an MPI licence. As of early 2024, MAS had licensed 17 MPI holders and two SPI holders for DPT services — a figure that reflects how selective the regulator has been in granting approvals.

The practical difference between the two tiers is not just capital. MPI holders face materially more demanding expectations around internal governance, technology risk management, and ongoing MAS engagement. For any operator projecting meaningful trading volumes, planning toward MPI from the outset avoids a costly mid-operation licence variation.

If you are assessing which licence structure fits your business model, GSS Legal’s jurisdiction advisory service can help you map your activities to the correct regulatory tier before you begin the application process.

The FSMA Layer: When You Serve Clients Outside Singapore

Before June 2025, a company incorporated and operating in Singapore that served only overseas clients could argue it fell outside the PSA’s scope. The FSMA closed that position. From 30 June 2025, Singapore-incorporated entities — and individuals operating from Singapore — that provide digital token services to clients outside Singapore require a DTSP licence under the FSMA, regardless of where their clients are located.

MAS has stated explicitly that it will grant DTSP licences only in limited circumstances. Applicants must demonstrate a credible business rationale for serving overseas clients rather than Singapore residents, robust compliance with international AML/CFT standards, and a meaningful physical presence in Singapore. Key DTSP licence requirements include:

• Minimum base capital of SGD 250,000
• A permanent place of business in Singapore with staff present during business hours
• A Singapore-based compliance officer
• Annual audits and regular penetration testing
• An annual licence fee of SGD 10,000

The DTSP regime does not apply to providers of purely utility or governance token services. It targets DPT and capital markets product token services directed at overseas clients from a Singapore operational base.

For businesses considering a Singapore structure with a cross-border client base, understanding where the PSA ends and the FSMA begins is not straightforward. Our team at GSS Legal advises on Crypto and VASP licensing across both frameworks and can assess which regime — or combination of regimes — applies to your specific model.

Ongoing Obligations After the Licence Is Issued

Obtaining a licence is the beginning of regulatory life, not the end of it. MAS-regulated exchanges carry continuous obligations that must be maintained for as long as the licence is active.

AML/CFT Compliance

AML/CFT obligations for DPT service providers are set out in MAS Notices PSN01 (for MPIs) and PSN02 (for SPIs). These are not one-time setup requirements. They are continuous operational obligations covering five areas:

• Risk assessment (including, from 1 July 2025, proliferation financing risk assessment)
• Customer due diligence (CDD) and enhanced due diligence (EDD) for high-risk clients
• Ongoing transaction monitoring
• Suspicious transaction reporting to the Suspicious Transaction Reporting Office (STRO)
• Internal controls, audit, and record-keeping

Non-compliance with AML/CFT obligations carries fines of up to SGD 1 million per offence, with a further SGD 100,000 per day for continuing violations. MAS has demonstrated willingness to enforce: in 2025 it imposed significant fines and revoked licences for AML/CFT breaches across regulated firms.

Consumer and Asset Protection

From 4 October 2024, DPT licensees are required to deposit client assets received into a trust account or return them to the customer no later than the following business day. This was introduced following high-profile exchange collapses and forms part of MAS’s consumer protection framework under the 2024 PSA amendments.

Technology Risk and Cybersecurity

All MAS-regulated exchanges must maintain a Technology Risk Management framework and comply with MAS’s cybersecurity and technology risk guidelines. For DTSP licensees, penetration testing is a specific ongoing requirement. MAS expects firms to treat technology risk as a continuous governance responsibility, not a checkbox at application stage.

Managing these obligations in parallel with day-to-day operations is one of the most common pain points for licensed exchanges. GSS Legal’s AML and compliance service supports ongoing regulatory stewardship — from policy maintenance and MAS reporting to audit preparation.

How to Verify Whether an Exchange Is Actually MAS-Licensed

MAS publishes the Financial Institutions Directory (FID), a public register of all entities it has licensed, registered, or approved. This is the definitive source for verifying whether an exchange holds an active licence.

The correct designation to look for is “MAS-licensed” — specifically, an active Major Payment Institution or Standard Payment Institution licence with DPT services in scope. The term “MAS-approved” does not have a precise regulatory meaning in this context. “In-principle approval” means an application has passed MAS’s initial review but the licence has not yet been formally issued — the entity is not yet authorised to operate.

Firms that applied for a DPT licence but were not approved were required to wind down their Singapore operations. The FID reflects only those that successfully completed the process. Checking the register before entering a business relationship with any Singapore-based crypto platform is straightforward and takes minutes.

What MAS Regulation Means in Practice

For an exchange operator, MAS regulation means operating within a framework that has become one of the most demanding in Asia for crypto businesses. The application process is rigorous, timelines are long (typically twelve months or more from document preparation through to licence issuance), and the ongoing obligations are substantive.

The commercial upside is proportionate to that burden. An MAS licence signals institutional-grade compliance to banking partners, investors, and institutional clients. Singapore’s status as a regional financial hub, combined with a well-structured regulatory environment, makes it a viable base for exchanges seeking credibility across Southeast Asia and beyond.

The key variables that determine whether a Singapore licence makes commercial sense for your business include the client base you intend to serve, the services you plan to offer, your projected transaction volumes, and the capital you can commit to both the licence requirements and the ongoing compliance infrastructure. These questions are best resolved before committing to a jurisdiction, not after the application is filed.

GSS Legal’s work in Singapore forms part of a broader practice spanning VASP licensing, forex and FX licensing, and iGaming licensing across 50+ jurisdictions. Where Singapore is the right fit, we handle the process end to end — from jurisdiction assessment and application through banking setup and ongoing compliance. Where another jurisdiction serves the business model better, we will tell you that first.

“MAS-regulated” is a specific legal status. It means an entity holds an active licence under the Payment Services Act, the Financial Services and Markets Act, or both — and maintains continuous obligations in AML/CFT compliance, consumer asset protection, technology risk management, and regulatory reporting.

The framework that defines this status has evolved substantially since 2020 and continued to expand through 2024 and 2025. For any business considering a Singapore crypto exchange licence, understanding the full scope of that framework — not just the upfront application requirements — is the only basis for a sound licensing decision.