Crypto Exchange Licensing Requirements in Singapore: MAS Guide 2026

If you're running a crypto business and thinking about setting up shop in Singapore, the rules just got a lot stricter. The days of operating as a "global" entity from Singapore while serving only overseas clients are effectively over. As of June 30, 2025, the Monetary Authority of Singapore (MAS) closed that loophole with the implementation of the Financial Services and Markets Act (FSMA). This isn't just a minor tweak; it's a fundamental shift that forces every Digital Token Service Provider (DTSP) to hold a local license, regardless of where their customers actually live.

Why does this matter? Because Singapore wants to remain a premier financial hub without becoming a playground for regulatory arbitrage. If you want to use Singapore as your base, you need to play by Singapore's rules-fully. This guide breaks down exactly what you need to get licensed under the current framework, which combines the older Payment Services Act (PSA) with the new FSMA provisions.

The Core Regulatory Framework: PSA and FSMA

To understand the licensing landscape, you have to look at two legislative instruments working in tandem. The Payment Services Act 2019 (PSA) remains the backbone for payment-related activities, establishing three distinct license categories based on your transaction volume and operational scope. However, the Financial Services and Markets Act 2022 (FSMA), which took full effect in mid-2025, expanded the definition of regulated entities to include all DTSPs, even those previously exempted if they served no domestic clients.

This dual structure means you aren't just looking for one type of approval. You need to determine if your service falls under payment services (like digital token exchanges or transfers) or capital markets services, and now, critically, whether your status as a DTSP triggers mandatory licensing even if you have zero retail users in Singapore. The MAS has made it clear: if you operate here, you are supervised here.

Choosing Your License Type: Standard vs. Major

Your first major decision is which license tier fits your business model. The PSA defines these tiers primarily by monthly transaction volumes and the specific services you offer. It’s not just about size; it’s about risk exposure.

For most startups, the Standard Payment Institution License is the entry point. It requires SGD 100,000 in paid-up capital. This covers basic operations like digital token exchange and transfer services. But don't let the lower capital requirement fool you into thinking compliance is light. You still need robust Anti-Money Laundering (AML) procedures.

If you’re processing more than SGD 3 million a month, you move up to the Major Payment Institution License. Here, the stakes rise significantly. You need SGD 250,000 in capital, but more importantly, you face enhanced scrutiny. This includes comprehensive internal audits, advanced risk management protocols, and stricter reporting frequencies. For institutional-grade exchanges, this is often the necessary path to gain trust with larger corporate clients.

The DTSP Loophole Closure: What Changed in 2025

Before June 2025, many crypto firms registered in Singapore but claimed exemption because they served only foreign clients. They operated out of Singapore offices, hired local staff, and used local banking rails, yet avoided the heavy lifting of local licensing. The FSMA changed this dynamic entirely.

Under the new regime, if you are a Digital Token Service Provider carrying on business in Singapore, you must be licensed. Period. There was no transitional grace period for existing firms to wind down slowly. This sudden implementation forced many offshore-focused platforms to either apply for a full license or cease operations from Singapore immediately.

Chengyi Ong, head of Asia Pacific policy at Chainalysis, noted that MAS is reinforcing that "financial integrity is a red line." The goal is to insulate Singapore from reputational risks associated with illicit activity. If your firm is based in Singapore, MAS wants oversight, regardless of who buys your tokens. This move positions Singapore differently from jurisdictions like Switzerland, where higher capital requirements exist but the regulatory net might catch different types of entities, or the EU, where MiCA provides longer implementation timelines.

Anti-Money Laundering: The Non-Negotiable Foundation

No amount of capital can save you if your AML controls are weak. MAS Notice PSN02 is the bible for crypto platforms regarding financial crime. It mandates that you treat crypto transactions with the same rigor as traditional banking transactions.

What does this look like in practice?

• Customer Due Diligence (CDD): You cannot just accept a wallet address. You need verified identity documents, proof of address, and understanding of the source of funds.
• Ongoing Monitoring: Automated systems must flag suspicious patterns. Is a user suddenly moving large sums from a high-risk jurisdiction? Your system needs to catch it.
• Suspicious Activity Reports (SARs): If something looks off, you report it to the Suspicious Transaction Reporting Office (STRO). Failure to do so is a criminal offense.

Many applicants fail not because they lack money, but because their documentation doesn't prove they can execute these procedures consistently. You need to show MAS that your AML policies are living documents, integrated into your tech stack, not just PDFs sitting in a drawer.

The Application Process: Timeline and Documentation

Getting the license is a marathon, not a sprint. Expect the process to take anywhere from 3 to 12 months, depending on the complexity of your application and the responsiveness of your team.

Here is what you will likely need to prepare:

1. Comprehensive Business Plan: This isn't just a pitch deck. It needs detailed projections of revenue and expenses, marketing strategies, and a clear explanation of how your crypto operations work technically.
2. Policy Manuals: You must submit Singapore-compliant KYC and AML policy documents. These must align strictly with MAS guidelines.
3. Risk Assessment Report: Identify potential threats-market volatility, cyber security, liquidity risk-and explain your mitigation strategies.
4. Proof of Capital: Bank statements showing the required SGD 100k or SGD 250k is available and unencumbered.
5. Audit Reports: Annual internal and external audit reports regarding financial operations and regulatory compliance are mandatory for ongoing maintenance.

Be prepared for multiple rounds of queries. MAS reviewers are thorough. They will ask about your technology vendors, your data storage locations, and your disaster recovery plans. Using specialized legal counsel familiar with Singapore’s financial regulations is almost essential to navigate this efficiently.

Strategic Implications for Global Operators

Is Singapore still worth it? For well-capitalized firms committed to compliance, yes. The clarity of the rules reduces long-term uncertainty. Unlike the fragmented state-by-state approach in the United States, Singapore offers a unified national standard under MAS oversight. This makes scaling within Asia easier.

However, for smaller operators or those relying on a "light-touch" regulatory model, the barriers to entry are now very high. The immediate implementation of the DTSP rules meant some firms had to make rapid decisions: restructure to meet local standards or exit the market. Those who stayed gained a competitive advantage by signaling stability to institutional investors.

Looking ahead, other Asian jurisdictions are watching. Hong Kong has introduced its own licensing framework, creating competition. But Singapore’s early mover advantage and comprehensive scope give it a strong position. If you are building a serious crypto infrastructure company, Singapore remains one of the best places to anchor your global strategy, provided you respect the cost and effort of compliance.