Crypto Licensing in Singapore: MAS (PSA) Explained

Executive Summary Choosing Your Asian Crypto Hub

For exchanges, custodians, and stablecoin issuers evaluating where to anchor their Asia-Pacific operations, crypto licensing Singapore under the Monetary Authority of Singapore’s Payment Services Act 2019 (PSA) remains one of the most structured and credible licensing routes available. Singapore’s regime offers granular regulatory guidance, established licence classes (Standard Payment Institution and Major Payment Institution for Digital Payment Token services), and a finalised single-currency stablecoin (SCS) framework all underpinned by detailed supervisory notices on technology risk management and AML/CFT.

Hong Kong, meanwhile, has moved from regulatory blueprint to operational execution. The Securities and Futures Commission (SFC) now licences Virtual Asset Trading Platforms (VATPs) and Virtual Asset Service Providers (VASPs) under its established supervisory architecture, while the Hong Kong Monetary Authority (HKMA) administers the Stablecoins Ordinance for fiat-referenced stablecoin issuers. By mid-2026, both jurisdictions offer mature, enforceable licensing pathways making this a genuine decision point for firms that need to commit capital, hire teams, and build compliance infrastructure.

Below are condensed recommendations for three core buyer profiles:

• Exchanges: Singapore’s MPI licence under the PSA provides a well-tested route for DPT buying, selling, and exchanging with clear AML/TRM obligations. Firms seeking retail access in both Singapore and Hong Kong should plan for dual licensing, as no passport exists between the two regimes. Consider Singapore-first for regulatory clarity and speed to market.
• Custodians: MAS sets high expectations for segregated custody, independent attestations, and TRM controls. Firms with robust custody architecture and SOC2-level assurance practices will find the application process more predictable. Hong Kong’s SFC imposes similarly rigorous custody standards but layers on additional local entity and associated-entity requirements for retail-facing operations.
• Stablecoin Issuers: Singapore’s finalised SCS framework covering reserve composition, redemption at par, and regular attestation offers a defined path for single-currency stablecoins issued in Singapore. Hong Kong’s Stablecoins Ordinance creates a parallel regime administered by the HKMA, with strict capital, reserve, and AML guidelines. Issuers targeting both markets should model costs for dual compliance early.

Quick Comparison: Singapore vs Hong Kong at a Glance

Singapore and Hong Kong both offer credible, regulator-backed licensing frameworks for crypto activities, but they differ in architecture, cost, and retail market-access rules. Singapore’s MAS operates a single-statute model under the PSA with detailed supervisory notices; Hong Kong splits responsibilities between the SFC (trading platforms, VASPs) and the HKMA (stablecoin issuers), each with distinct application processes and capital thresholds. For a granular, side-by-side breakdown including custody standards, AML/KYC, passporting limitations, timelines, and ballpark costs consult the comparison table immediately below. Industry observers expect firms to increasingly pursue dual-entity strategies as both jurisdictions tighten enforcement and refine retail-access conditions through 2026 and beyond.

Side-by-Side Comparison: MAS (PSA) vs SFC (VATP / VASP) & HKMA Stablecoins Ordinance

How to Obtain a MAS Crypto Licence: Step-by-Step Process

Securing a crypto licensing Singapore approval under the PSA requires methodical preparation across governance, technology, and compliance domains. The following numbered steps outline the practical path from initial scoping to post-grant readiness.

Step 1: Confirm Activity Classification Under the PSA

Begin by mapping your business activities against the payment service categories defined in the Payment Services Act 2019. Digital Payment Token (DPT) services buying, selling, exchanging, or providing custody of DPTs fall under specific definitions in the Act. Custody-only models, exchange-only models, and hybrid models each attract different regulatory treatment. Firms that also provide money-changing, cross-border money transfer, or e-money issuance must identify all applicable payment service categories, as MAS expects a single consolidated application where multiple services are offered.

Estimated timeline: 2–4 weeks of internal scoping and legal analysis.

Step 2: Determine Licence Class (SPI vs MPI) and Capital/Safeguarding Needs

The PSA distinguishes between Standard Payment Institutions (SPI) and Major Payment Institutions (MPI). Thresholds relate to monthly transaction volumes and e-money float. Most firms offering DPT services at scale particularly those serving retail customers or holding client assets will require an MPI licence, which triggers enhanced prudential and safeguarding requirements including minimum base capital and ongoing security deposits or safeguarding arrangements.

Key decision: Model your projected transaction volumes against SPI/MPI thresholds early. Incorrectly classifying under SPI when MPI is required can force a disruptive re-application.

Estimated timeline: 1–2 weeks (concurrent with Step 1).

Step 3: Prepare the Governance Package

MAS places significant weight on the fitness and propriety of directors, senior management, and compliance officers. Assemble the following:

• Board and management CVs: Detailed professional histories demonstrating relevant financial services, technology, or compliance experience.
• Fit and Proper declarations: For each director, CEO, and key appointment holder, addressing criminal history, insolvency, regulatory sanctions, and professional competence.
• MLRO appointment: A designated Money Laundering Reporting Officer with demonstrable AML expertise and Singapore market familiarity.
• Governance policies: Board charter, conflict-of-interest policy, risk management framework, internal audit plan.

Estimated timeline: 3–6 weeks for preparation and internal review.

Step 4: Build TRM and Custody Architecture

MAS Notice PSN05 on Technology Risk Management sets granular expectations for DPT service providers. Your application must demonstrate:

• Segregated custody design: Client assets must be clearly separated from the firm’s proprietary assets, with reconciliation and independent attestation mechanisms.
• TRM controls: Cybersecurity architecture, access management, incident response plans, penetration testing schedules, and disaster recovery protocols.
• Assurance plans: Independent assurance (e.g., SOC2 Type II) or equivalent attestation programmes covering key controls.

Estimated timeline: 6–12 weeks for architecture design, implementation, and initial assurance engagement.

Step 5: Develop the AML/CFT Programme

Your AML/CFT programme must comply with MAS Notice PSN02 and address Travel Rule implementation. Core components include:

• Customer due diligence (CDD): Risk-based onboarding, enhanced due diligence for high-risk customers, ongoing monitoring.
• Transaction monitoring: Automated systems capable of flagging suspicious patterns, with escalation workflows to the MLRO.
• Travel Rule technology: Integration with a compliant messaging solution for originator/beneficiary information exchange on qualifying DPT transfers.
• Suspicious transaction reporting: Procedures for filing STRs with Singapore’s Suspicious Transaction Reporting Office (STRO).

Estimated timeline: 4–8 weeks (can run in parallel with Step 4).

Step 6: Submit the Formal Application

File the application through MAS’s designated portal, including Form 1 and all supporting documentation: business plan, financial projections, governance package, TRM documentation, AML/CFT manuals, custody arrangements, and proof of capital adequacy. Expect MAS to issue initial queries and requests for clarification or remediation within 4–8 weeks of submission. Responsive, well-organised replies materially shorten the review cycle.

Estimated timeline: 6–9 months from submission to licence grant for MPI applications; 3–6 months for SPI with narrower scope. MAS may conduct on-site inspections or request technology walk-throughs during this period.

Step 7: Post-Grant Readiness

Receiving the licence is not the final step. Pre-operation readiness requirements typically include:

• Bank relationships: Secure fiat on-ramp/off-ramp banking partnerships often the most time-consuming post-grant task.
• Auditor attestations: Engage auditors for reserve attestation (stablecoin issuers) or custodial assurance reports.
• Operational runbooks: Finalise compliance monitoring schedules, regulatory reporting cadence, and incident response drills.
• MAS reporting: Understand monthly and periodic reporting obligations, including transaction data and AML metrics.

Deep Dive: MAS (PSA) Requirements and Practical Interpretations

The Payment Services Act 2019 is the legal cornerstone of crypto licensing Singapore. Its DPT-specific provisions including Section 21A, which imposes additional requirements on DPT service providers give MAS broad supervisory authority over exchanges, custody providers, and payment token facilitators. The Act is supplemented by a suite of notices, guidelines, and FAQs that together form a detailed regulatory handbook.

Governance and Fit-and-Proper Standards

MAS requires every licensee’s directors, CEO, and key appointment holders to satisfy fit-and-proper criteria covering honesty, integrity, competence, and financial soundness. The regulator actively assesses the track record of applicants including whether management has previously been subject to regulatory action in other jurisdictions. Firms with management teams new to Singapore’s financial services landscape should allocate additional time for this assessment.

Capital and Safeguarding

MPI licensees must maintain minimum base capital and comply with safeguarding requirements for customer money and DPTs. Safeguarding typically involves holding customer funds in a trust account with a safeguarding institution, or obtaining an undertaking from a qualifying financial institution. SCS issuers face additional reserve and capital minima under the MAS SCS framework.

Stablecoin (SCS) Framework

MAS’s finalised SCS framework applies to single-currency stablecoins pegged to the Singapore dollar or any G10 currency, issued in Singapore. Key requirements include:

• Reserve composition: Reserves must be held in low-risk, highly liquid assets denominated in the same currency as the stablecoin’s peg.
• Redemption at par: Issuers must honour redemption requests at par value within five business days.
• Attestation and audit: Regular independent attestations of reserve adequacy, with MAS emphasising monthly reporting and transparency.
• Disclosure: White paper and ongoing disclosure obligations to token holders.

Technology Risk Management

MAS Notice PSN05 imposes detailed TRM expectations covering cybersecurity governance, access controls, system availability, cryptographic key management, and incident reporting. The accompanying TRM FAQs provide practical guidance on how MAS interprets and enforces these standards. DPT licensees should expect supervisory queries on penetration testing frequency, third-party vendor risk, and cloud infrastructure controls.

AML/CFT and Travel Rule

MAS Notice PSN02 establishes AML/CFT obligations for DPT service providers, including customer due diligence, ongoing monitoring, sanctions screening, and STR filing. Singapore has implemented Travel Rule requirements aligned with FATF standards, requiring DPT service providers to collect and transmit originator and beneficiary information for qualifying transfers. MAS actively supervises compliance through thematic inspections and data requests.

Deep Dive: SFC (VATP/VASP) and Hong Kong Stablecoin Rules

Hong Kong’s crypto licensing architecture splits between two regulators. The SFC licences Virtual Asset Trading Platform operators under the VATP regulatory framework, drawing on the Anti-Money Laundering and Counter-Terrorist Financing Ordinance (AMLO) and, for platforms dealing in securities-type tokens, the Securities and Futures Ordinance (SFO). The HKMA administers the Stablecoins Ordinance, which governs the issuance of fiat-referenced stablecoins.

Key Differences from Singapore

• Token admission policies: The SFC requires VATPs to conduct due diligence on each virtual asset before making it available for trading. Certain tokens may only be offered to professional investors, creating a tiered retail-access model that differs from Singapore’s approach.
• Retail investor protections: Hong Kong’s regime includes prescriptive investor-protection requirements including knowledge assessments, exposure limits, and suitability assessments that may exceed Singapore’s current expectations for DPT providers.
• Local custody and entity requirements: The SFC’s licensing handbook specifies custody segregation, local recordkeeping, and associated-entity rules for custody and market-making functions. Firms must typically establish or designate local entities for these functions.
• External assessor pathway: VATP applicants must engage an external assessor to evaluate their systems, controls, and compliance arrangements before the SFC grants a full licence a distinct procedural requirement not present in Singapore’s regime.

HKMA Stablecoins Ordinance

The Stablecoins Ordinance, with implementing guidelines issued by the HKMA, requires fiat-referenced stablecoin issuers to obtain a licence from the HKMA. Key obligations include maintaining full reserve backing, meeting capital requirements, undergoing regular audits, and complying with HKMA AML guidelines. The Ordinance creates a separate licensing track from the SFC’s VATP regime issuers that also operate trading platforms will need to hold both approvals.

Timeline and Cost Estimates

The following estimates are indicative bands based on typical application complexity. They assume no material regulatory objections, an established local banking partnership, and reasonable pre-application preparation. All figures are ballpark estimates and should not be treated as legal advice.

Singapore (MAS PSA)

Cost breakdown drivers: Legal and application fees (20–30%), technology and TRM remediation (25–35%), capital and safeguarding deposits (20–30%), first-year compliance headcount and operational costs (15–25%).

Hong Kong (SFC / HKMA)

Migration and Dual-Licensing Options

Because no mutual recognition or passporting arrangement exists between MAS and the SFC/HKMA, firms seeking retail market access in both Singapore and Hong Kong must plan for dual licensing. Three practical models dominate:

• Singapore-first + Hong Kong gateway: Obtain a MAS licence first, then apply for SFC VATP or HKMA stablecoin authorisation. This model suits firms that prioritise Singapore’s faster SPI timeline and established banking ecosystem, while building a Hong Kong pipeline in parallel. The trade-off is a 6–12 month lag before Hong Kong retail access.
• Parallel applications / dual entity: File simultaneously in both jurisdictions, typically through separate local entities. Best for well-capitalised firms that need to launch in both markets within the same commercial window. Expect higher upfront costs (duplicated legal, compliance, and entity-formation spend) but compressed time-to-market.
• Strategic partnerships: Use an already-licensed firm in one jurisdiction (e.g., a licensed VATP in Hong Kong or a licensed MPI in Singapore) for custody, trading, or distribution. This reduces regulatory lead time but introduces counterparty dependency and limits brand control.

Each model carries distinct implications for supervision complexity, ongoing compliance costs, and operational independence. The optimal choice depends on the firm’s capitalisation, target client segments, and risk appetite.

Operational Checklist Application Pack Contents

The following items should be assembled before submitting a crypto licensing Singapore application to MAS. This list also serves as a baseline for Hong Kong applications, with jurisdiction-specific modifications noted where applicable.

• Entity documentation: Certificate of incorporation, memorandum and articles of association, corporate structure chart, register of shareholders and directors.
• Board and management CVs: Detailed professional histories for all directors, CEO, key appointment holders, and the MLRO.
• Fit and Proper declarations: Completed forms for each relevant individual, covering criminal records, insolvency history, and regulatory sanctions.
• Business plan and financial projections: 3-year plan including revenue model, target markets, customer segmentation, projected transaction volumes, and capital adequacy analysis.
• Governance policies: Board charter, risk management framework, conflict-of-interest policy, internal audit plan, outsourcing policy.
• AML/CFT manual: CDD procedures, enhanced due diligence triggers, transaction monitoring rules, sanctions screening methodology, STR filing procedures, Travel Rule implementation plan.
• TRM architecture documentation: System architecture diagrams, cybersecurity controls, access management protocols, incident response plans, penetration testing schedule, disaster recovery/business continuity plans.
• Custody arrangements: Custodian agreements (if using a third-party custodian), segregation methodology, reconciliation procedures, client asset safeguarding arrangements.
• SOC2 or equivalent assurance reports: Independent assurance reports covering key technology and operational controls; or a plan to obtain such reports within a defined timeline.
• Auditor attestation plan: Engagement letter or proposal from an independent auditor for reserve attestation (stablecoin issuers) or custodial assurance.
• Proof of capital / reserves: Bank statements, letters of commitment, or evidence of safeguarding arrangements meeting MAS minimum requirements.

Next Steps

Firms evaluating crypto licensing Singapore under the MAS (PSA) framework or weighing a dual-licensing strategy that includes Hong Kong’s SFC VATP and HKMA stablecoin regimes should begin with a structured gap analysis against the operational checklist outlined above. Identifying shortfalls in governance, TRM, custody design, and AML/CFT programme maturity before filing the application materially reduces review timelines and remediation costs. The downloadable application checklist (available as a PDF) consolidates every document, policy, and submission item referenced in this guide into a single, actionable planning tool. For firms considering the Crypto compliance playbook for AML, Travel Rule, and custody assurance standards across both Singapore and Hong Kong, that resource provides the technical detail needed to operationalise each compliance pillar.

Sources

• Payment Services Act 2019 Singapore Statutes Online (consolidated text)
• MAS Media Release: MAS Finalises Stablecoin Regulatory Framework (15 August 2023)
• MAS Notice on Technology Risk Management (PSN05)
• MAS FAQs on Notice on Technology Risk Management
• MAS Financial Institutions Directory (licensed DPT / MPI example)
• SFC Licensing Handbook for Virtual Asset Trading Platform Operators
• HKMA Implementation of Regulatory Regime for Stablecoin Issuers (Press Release, July 2025)