Fintech Licensing in Singapore: MAS Requirements for Payment and Digital Asset Firms

What This Guide Delivers

Securing a Monetary Authority of Singapore (MAS) payment-services licence is a defining milestone for fintech founders, compliance officers, and venture investors targeting Southeast Asia. A well-prepared application signals operational maturity, opens institutional banking relationships, and gives investors confidence that the business can scale within a regulated framework.

Yet the licensing path is not a form-filling exercise. MAS examines business models, capital, governance, anti-money-laundering controls, and technology risk in parallel. A weak area in any one of them can delay or derail an otherwise promising application.

This guide explains the Payment Services Act 2019 (PS Act) framework as it applies to payment firms and digital-asset service providers. You will learn which activities trigger licensing, how the Standard Payment Institution (SPI), Major Payment Institution (MPI), and Money-Changing (MC) classes differ, what capital and security deposits are required, how MAS evaluates AML/CFT and technology risk, and where applications commonly fail. Use it as a planning framework before committing to an entity structure or a licensing timeline.

The Regulatory Landscape

Why the PS Act Matters

The PS Act consolidated licensing for payment services and brought digital payment token (DPT) services under MAS supervision for the first time. It is the single statute that governs how fintech firms carry on payment services in Singapore, replacing the earlier Money-Changing and Remittance Businesses Act and the Payment Systems (Oversight) Act.

From a founder’s perspective, the PS Act creates clarity. It defines exactly which activities are regulated, sets out three licence tiers, and gives MAS powers to impose technology, conduct, and AML/CFT requirements. From an investor’s perspective, the licence itself is a due-diligence asset: it shows that a company has met MAS standards for governance, capital, and risk controls.

The Seven Regulated Payment Services

Before choosing a licence class, identify which of the following activities your business performs or plans to perform:

• Account issuance service — issuing payment accounts that allow funds to be stored, withdrawn, or transferred.
• Domestic money transfer service — accepting funds for execution of payment transactions within Singapore.
• Cross-border money transfer service — accepting funds for inward or outward remittances.
• Merchant acquisition service — accepting and processing payment transactions for merchants.
• E-money issuance service — issuing e-money to allow users to pay merchants or transfer funds.
• Digital payment token (DPT) service — buying, selling, or facilitating the exchange of DPTs such as cryptocurrencies and other digital tokens.
• Money-changing service — buying or selling foreign currency notes and traveller’s cheques.

“E-money” means electronically stored monetary value denominated in fiat currency, while a “digital payment token” is a digital representation of value that is not denominated in fiat currency and can be used as a medium of exchange. The distinction matters because e-money and DPT services carry different capital, safeguarding, and AML/CFT obligations.

Licence Classes and Triggering Activities

Not every payment service requires an MPI licence. The PS Act offers three tiers, with the choice depending on the type and scale of activity.

Money-Changing (MC) Licence

An MC licence is for firms that provide only money-changing services. If your business adds remittance, e-money, or DPT activities, you must hold an SPI or MPI licence instead. The MC route is typically used by foreign-exchange kiosks, travel services, and small bureaux de change.

Standard Payment Institution (SPI) Licence

An SPI licence covers any payment service below specified regulatory thresholds. It is designed for smaller or early-stage fintech firms. You remain licensed by MAS, but capital, safeguarding, and operational requirements are lighter than for an MPI.

Major Payment Institution (MPI) Licence

An MPI licence is required once a firm crosses the SPI thresholds, issues e-money, or provides DPT services at scale. MPIs are subject to higher capital, safeguarding, and technology-risk standards because they hold larger customer balances or handle higher transaction volumes.

Licence Class Comparison

Figures are indicative of MAS requirements under the PS Act and related notices. Base capital must generally be unencumbered and in cash or cash-equivalent instruments. Security deposits are lodged with MAS in an approved form, such as a bank guarantee, and act as a safeguard for customer funds.

Digital Payment Token Service Provider Requirements

DPT services attract heightened scrutiny because of volatility, anonymity risks, and the cross-border nature of crypto markets. MAS has layered specific conduct and AML/CFT obligations on top of the general PS Act requirements.

Which DPT Activities Need a Licence?

You need an MPI or SPI licence if your platform facilitates any of the following in Singapore:

• Buying or selling DPTs.
• Establishing or operating a DPT exchange.
• Providing a platform that matches buyers and sellers of DPTs.
• Arranging or facilitating any of the above.

Pure advisory, educational, or ancillary services that do not touch customer assets generally fall outside the DPT licensing perimeter. If in doubt, MAS expects firms to seek a legal view rather than self-assess.

Retail Access Restrictions

Under the MAS Guidelines on Provision of Digital Payment Token Services to Accredited and Institutional Investors (PSG-G01), DPT service providers must not market DPT services to the general public. Public websites, roadshows, and mass-media campaigns directed at retail consumers are restricted. Firms may offer DPT services to accredited and institutional investors through appropriate channels. This materially affects how crypto fintechs design their onboarding funnels and marketing materials.

AML/CFT Obligations for Payment and DPT Firms

MAS Notice PSG-N01 requires all payment service licensees to implement a risk-based AML/CFT programme proportionate to their size, products, and customer base. Key components include:

• Customer due diligence (CDD) — identify and verify customers, beneficial owners, and authorised persons before establishing a business relationship.
• Enhanced due diligence (EDD) — apply stronger measures for higher-risk customers, including politically exposed persons (PEPs), correspondent relationships, and customers from higher-risk jurisdictions.
• Transaction monitoring — screen transactions for suspicious patterns, structuring, and activity inconsistent with the customer profile.
• Suspicious transaction reporting (STR) — file STRs with the Suspicious Transaction Reporting Office where there are reasonable grounds for suspicion.
• Sanctions screening — screen customers and transactions against United Nations and domestic sanctions lists.
• Travel rule compliance — for DPT transfers at or above S$1,500, obtain and hold originator and beneficiary information and transmit it to the receiving institution.
• Record keeping — maintain CDD records and transaction data for at least five years.
• Independent audit — test the effectiveness of AML/CFT controls on a risk-based basis.

“Travel rule” refers to the FATF Recommendation 16 standard that requires virtual asset service providers to share sender and recipient information with counterparties, similar to wire-transfer requirements for banks. Singapore implemented this requirement for DPT service providers from April 2023.

Capital, Base Money, and Security Deposits

Capital requirements are not arbitrary hurdles. They ensure that a licensee can absorb operational losses, meet withdrawal demands, and continue serving customers while MAS investigates any breach.

Base Capital

Base capital is the minimum amount of unencumbered capital a licensee must maintain. It must be in the form of paid-up ordinary shares or, in some cases, audited reserves, and it must be free of liens. For payment institutions, the minimum base-capital tiers are generally:

• MC licence: S$50,000.
• SPI licence: S$100,000.
• MPI licence: S$250,000.

MAS can impose a higher base-capital requirement if the business model carries additional risk, holds large customer balances, or operates complex proprietary trading.

Security Deposit

An MPI must lodge a security deposit with MAS to protect customer funds. The standard amount is:

• S$200,000 if the MPI carries on account issuance, domestic money transfer, merchant acquisition, or e-money issuance services.
• S$100,000 for DPT-only or other non-fiat payment service providers that do not hold significant customer fiat balances.

The deposit must be in an approved form, typically a bank guarantee or insurance bond from a Singapore-based institution. SPIs and MC licensees are generally not required to lodge a security deposit.

Safeguarding Customer Monies

For e-money issuance and certain payment services, an MPI must safeguard customer monies by holding them in a statutory trust account or approved instrument separate from the firm’s own funds. This is distinct from base capital: base capital absorbs losses; safeguarding protects customer balances. Failure to structure these accounts correctly is one of the most common pre-licence corrections MAS requests.

The MAS Application Process, Timelines, and Rejection Risks

How to Apply

Applications are submitted through the MAS digital application portal, typically accessed via GoBusiness Licensing. The package must include:

• A detailed business plan describing products, target customers, revenue model, and geographic reach.
• Organisational structure, shareholder chart, and group entity relationships.
• CVs and fit-and-proper assessments for directors, CEO, and senior management.
• AML/CFT policies, risk assessment, and controls documentation.
• Technology risk management framework and IT audit reports where applicable.
• Projected financial statements, capital base confirmation, and security-deposit arrangements.
• Customer-agreement drafts, fee schedules, and complaint-handling procedures.

Typical Timelines

Timelines vary with complexity. In our experience, a well-prepared SPI application can be assessed within four to six months, while MPI and DPT applications often take nine to twelve months because of the additional layers of AML/CFT and technology-risk review. These timelines assume the first submission is substantially complete; each round of MAS queries can add four to eight weeks.

Common Grounds for Rejection or Delay

MAS does not publish a checklist of rejection reasons, but feedback from applicants and MAS speeches points to recurring issues:

• Inadequate AML/CFT controls — policies copied from templates without tailoring to the firm’s products, jurisdictions, and customer risk.
• Weak technology risk management — missing incident-response plans, untested business-continuity arrangements, or unclear third-party cloud governance.
• Insufficient resident leadership — no full-time Singapore-based executive director or CEO able to supervise day-to-day operations.
• Unverified capital or safeguarding — base capital not yet injected, security-deposit arrangements not in place, or customer-fund segregation poorly documented.
• Unclear business model — revenue projections that do not match the described product, or a model that conflicts with Singapore’s public-policy objectives.
• Adverse regulatory history — prior enforcement actions, undisclosed litigation, or concerns about beneficial-ownership transparency.

Governance, Resident Director, and Technology Risk Expectations

Governance and Resident Leadership

MAS expects licensees to have a robust governance framework with clear lines of accountability. For payment institutions, this typically means:

• At least one executive director who is ordinarily resident in Singapore and has relevant financial-services or fintech experience.
• A chief executive officer or equivalent who can be held accountable for compliance, risk, and operational decisions.
• A board or equivalent governing body that exercises effective oversight over management.
• Clearly documented compliance, risk, and internal-audit functions proportionate to the scale of the business.

For DPT service providers, MAS places particular weight on senior-management experience in digital assets, cybersecurity, and financial crime. A nominee director without operational involvement is unlikely to satisfy MAS.

Technology Risk Management

MAS expects all licensees to meet the standards set out in the Technology Risk Management (TRM) Guidelines. Although the TRM Guidelines are issued under other MAS Acts, MAS applies them by analogy to payment institutions, especially MPIs and DPT firms. Core expectations include:

• Board and senior-management accountability for technology risk.
• Secure system development life cycles, change management, and patch-management programmes.
• Cybersecurity controls aligned to the size and threat profile of the firm.
• Incident reporting to MAS for material system outages, cyber incidents, or data breaches.
• Business continuity and disaster-recovery plans tested at least annually.
• Third-party risk management for cloud hosting, custody providers, and payment processors.
• Penetration testing and vulnerability assessments on a risk-based schedule.

For DPT custodians and exchanges, MAS also examines wallet security, key-management controls, and segregation of customer assets. These are typically addressed through detailed IT policies and independent security assessments.

Practical Application: Pre-Licence Checklist

If you are preparing an MAS payment-services application in the next quarter, the following actions will reduce delays and improve the quality of your submission:

1. Map every current and planned activity against the seven regulated payment services to confirm the correct licence class.
2. Incorporate the Singapore entity, inject base capital into an unencumbered account, and prepare audited financial projections.
3. Confirm a Singapore-resident executive director or CEO with relevant experience before submitting the application.
4. Draft AML/CFT policies specific to your product, customer base, and jurisdictions; do not rely on generic templates.
5. Implement transaction monitoring, sanctions screening, and travel-rule tools before going live.
6. Prepare a technology risk management framework that references MAS TRM Guidelines and includes incident response and business continuity.
7. Arrange the security deposit, statutory trust accounts, and customer-monies safeguarding structure in advance.
8. Review customer terms, fee disclosures, and marketing materials for compliance with retail-access restrictions.
9. Build a MAS engagement plan, including internal rehearsals for likely queries on governance and controls.

Relevant external resources include the MAS Payment Services page, the ACRA company-registration portal, and the IRAS tax guidance.

Final Thoughts

MAS licensing is demanding, but it is also a gateway to one of Asia’s most credible fintech markets. The firms that succeed treat the application as a strategic exercise: they design governance, capital, AML/CFT, and technology controls before MAS asks for them, not afterwards.

Whether you are building a payments wallet, a remittance corridor, or a digital-asset exchange, the same principle applies: regulators look for evidence of mature risk management, resident accountability, and sustainable economics. Build those foundations early, and the licence becomes a competitive advantage rather than a bottleneck.

If your expansion timeline involves an MAS submission in the next two to three quarters, we recommend beginning structure and governance discussions 12 to 16 weeks in advance. Lansoln works with fintech founders, compliance officers, and investors to map licence classes, prepare MAS-ready documentation, and assemble the resident leadership and controls that MAS expects. Please contact us if you would like to explore how we can support your Singapore licensing strategy.