Singapore Crypto Licence Requirements 2026

A Singapore crypto licence requires a Singapore-incorporated company holding a Standard or Major Payment Institution licence under the Payment Services Act, with base capital of S$100,000 (SPI) or S$250,000 (MPI). Singapore is where you license when trust is the entire proposition. A Digital Payment Token (DPT) licence from the Monetary Authority of Singapore is among the most respected crypto credentials in the world — and the requirements file behind it reflects exactly that. Where a light offshore regime asks for a company and a fee, MAS asks for a real, well-governed financial business, vetted in depth before a single customer is served.

This guide is the requirements checklist we work from on our own desk. It covers what the 2026 MAS regime actually demands — a Singapore company with genuine substance, the right SPI or MPI capital, fit-and-proper controllers, and a working AML and technology-risk pack — so you can price the licence on what it truly takes rather than the headline capital figure. If you are weighing Singapore against a faster jurisdiction, this is the substance you are really paying for.

The company, the two tiers and the licence

Everything starts with a Singapore company. MAS licenses a Singapore-incorporated entity — the applicant is registered in Singapore and provides DPT services under the Payment Services Act 2019, not an offshore holding company applying from elsewhere. Digital payment token dealing and transfer are a regulated payment activity, and you cannot provide them from Singapore without one of two licences.

Which one you need follows your scale. A Standard Payment Institution (SPI) fits smaller operators whose monthly DPT transaction volume stays at or below S$3 million and whose average daily float stays at or below S$5 million; it carries S$100,000 base capital. Cross either threshold and you need a Major Payment Institution (MPI) licence, with S$250,000 base capital, plus any buffers MAS imposes on top. Getting this call right early matters, because it drives your capital, your governance depth and how MAS reads the whole application — our SPI vs MPI guide walks through where a given business lands, and the flagship Singapore crypto licence overview covers what the credential buys you.

Costs sit outside scope here — for the capital, MAS fees and the year-one all-in, see the Singapore crypto licence cost guide. The point to hold onto is that base capital is funded working capital you must evidence, not a fee you write off.

Substance: office, resident director and governance

This is the requirement that catches operators pricing Singapore on capital alone. MAS demands genuine substance in Singapore, and it demands it at application, not later. You must have in place:

• A Singapore-incorporated company as the licensee — the entity that holds the SPI or MPI licence, registered and administered in Singapore.
• Base capital funded and evidenced — S$100,000 for an SPI, S$250,000 for an MPI, plus any risk buffers MAS imposes based on the nature and scale of the business.
• A permanent place of business in Singapore — a real operating office, not a mail-forwarding address, from which the business is actually run.
• A resident executive director — someone genuinely accountable, resident in Singapore, sitting over the operation.
• Robust governance and internal controls — a board and management structure MAS can hold responsible, with clear reporting lines.

The contrast with a light offshore route is the whole story: this local presence, resident director and funded capital are exactly what a nameplate permit does not require, and they are why a MAS licence banks where an offshore registration struggles. Substance is not a box to tick — it is what makes the credential real.

Fit-and-proper: competence and integrity

MAS runs fit-and-proper vetting itself, and it runs it on every controller, director and key person — not just the named applicant. Two standards run in parallel: competence and integrity. The regulator wants to see people who know how to run a regulated payments business and who can be trusted with customer money and tokens.

Vetting of controllers and shareholders. Ultimate owners and significant shareholders are identified, screened against criminal records and sanctions lists, and assessed for financial soundness and source of funds. Undocumented wealth or an adverse connection in the ownership chain is one of the most common reasons a file stalls.

Competence of key persons. The board, senior management, the compliance function and the appointed AML officer are each assessed for relevant experience and capability. MAS is not satisfied by names on an org chart — it expects people who can genuinely operate the controls the licence requires.

Integrity across the structure. Anyone in the ownership or control structure carrying disqualifying issues — sanctions exposure, serious convictions, regulatory findings — will fail the assessment. There is no working around it, and MAS will not license a business it cannot stand behind.

Because these files take the longest to assemble, especially source-of-funds evidence and documentation from multiple jurisdictions, start them on day one rather than treating vetting as a closing step.

AML, technology and safeguarding: the operational pack

Alongside people and substance, MAS reviews a defined operational file, and it expects each element to be a working system, not template filler. This is where a payments regulator’s rigour shows.

AML/CFT to MAS Notices and FATF standards. You need customer due diligence, ongoing transaction monitoring, sanctions screening, suspicious-transaction reporting and the Travel Rule for originator and beneficiary data on token transfers — built to MAS’s AML/CFT Notices and the FATF standards for virtual assets. A dedicated compliance function and an appointed AML officer must actually run this programme. Our primer on AML and KYC covers what an operable programme looks like in practice.

Technology risk and cyber-hygiene to MAS standards. Systems and controls must align to MAS’s technology-risk-management expectations — encryption, access control, secure key management and wallet design, monitoring, resilience and independent testing. For a crypto business handling private keys, this is not peripheral; it is core to whether MAS trusts you with customer assets.

Safeguarding of customer money and DPTs. Client fiat and digital tokens must be segregated and safeguarded under the Payment Services Act, so customer assets are protected and identifiable if the business fails. Audit and reporting obligations run alongside — audited financials or credible projections at application, then ongoing MAS reporting, independent audit and prompt notification of material changes once licensed.

Phased rules and assembling the file in order

The requirements are also a moving target you must build ahead of. Payment Services Act and DTSP amendments are phasing in — capital and governance changes from July 2026, and full operational compliance from January 2027. The direction of travel is higher expectations on capital adequacy, governance, safeguarding and conduct. We build every application to the incoming standard, so a licence granted this year is not caught short by rules landing a few months later. A MAS licence does not passport into the EU, so if you also serve European users you will still need an EU CASP — but for institutional and banking credibility across Asia, MAS is the benchmark.

Requirements are one thing; sequence is another. The order that avoids rework is: determine SPI versus MPI from your real volumes; incorporate the Singapore company, fund the base capital, secure the office and appoint the resident executive director; assemble every controller and key-person fit-and-proper file in parallel, because they take the longest; then build the AML/CFT, technology-risk, safeguarding and user-protection frameworks against your actual operating model. Only then does the MAS application go in — and even then, expect a deliberate, evidence-heavy review measured in months, not weeks.

None of this is the light-touch permit a smaller jurisdiction offers, and that is the point. MAS asks for a real Singapore company, real capital, vetted people and a working compliance and technology programme, and in exchange gives you the most trusted crypto credential in Asia. Get the file complete and internally consistent the first time and the nine-to-fourteen-month window is achievable; file with gaps and it drifts well beyond that.

Ready to assemble your MAS requirements pack, or want a second opinion on a file you have already started? Our team handles the full Singapore substance, fit-and-proper and framework build end to end and will review any application against MAS’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.