Singapore Crypto Licence Requirements 2026
Full MAS Digital Payment Token licence requirements for 2026 — a Singapore company, SPI or MPI base capital, a resident director.
Contents
A Singapore crypto licence requires a Singapore-incorporated company holding a Standard or Major Payment Institution licence under the Payment Services Act, with base capital of S$100,000 (SPI) or S$250,000 (MPI). Singapore suits operators whose business depends on trust. A Digital Payment Token (DPT) licence from the Monetary Authority of Singapore is among the most respected crypto credentials in the world — and the requirements file behind it reflects exactly that. Where a light offshore regime asks for a company and a fee, MAS asks for a real, well-governed financial business, vetted in depth before a single customer is served.
We use this checklist on our own client files. It covers what the 2026 MAS regime actually demands (a Singapore company with genuine substance, the right SPI or MPI capital, fit-and-proper controllers, and a working AML and technology-risk pack), so you can price the licence on what it truly takes rather than the headline capital figure. If you are weighing Singapore against a faster jurisdiction, this is the substance you are really paying for.
- The applicant is a Singapore-incorporated company with a permanent local office and a resident executive director, which gives it real substance under the Payment Services Act.
- Base capital is S$100,000 for a Standard Payment Institution and S$250,000 for a Major Payment Institution, plus any risk buffers MAS imposes — funded and evidenced.
- MAS runs fit-and-proper vetting on every controller and key person, testing competence and integrity, and expects a compliance function with an appointed AML officer.
- Plan for nine to fourteen months realistically, and note that an overseas-only business needs a DTSP licence, which MAS generally will not grant.
The company, the two tiers and the licence
Everything starts with a Singapore company. MAS licenses a Singapore-incorporated entity — the applicant is registered in Singapore itself and provides DPT services under the Payment Services Act 2019. Digital payment token dealing and transfer are a regulated payment activity, and you cannot provide them from Singapore without one of two licences.
Which one you need follows your scale. A Standard Payment Institution (SPI) fits smaller operators whose monthly DPT transaction volume stays at or below S$3 million and whose average daily float stays at or below S$5 million; it carries S$100,000 base capital. Cross either threshold and you need a Major Payment Institution (MPI) licence, with S$250,000 base capital, plus any buffers MAS imposes on top. Getting this call right early matters, because it drives your capital, your governance depth and how MAS reads the whole application — our SPI vs MPI guide walks through where a given business lands, and the flagship Singapore crypto licence overview covers what the credential buys you.
| Requirement | Standard Payment Institution | Major Payment Institution |
|---|---|---|
| Base capital | S$100,000 | S$250,000 (+ MAS buffers) |
| Monthly DPT volume | ≤ S$3 million | Above the SPI threshold |
| Average daily float | ≤ S$5 million | Above the SPI threshold |
| Singapore company | Required | Required |
| Resident executive director | Required | Required |
| Best suited to | Smaller / early-stage DPT operators | Scaled operators above the caps |
Costs sit outside scope here — for the capital, MAS fees and the year-one all-in, see the Singapore crypto licence cost guide. The point to hold onto is that base capital is funded working capital you must evidence, and the money remains on your balance sheet.
Substance: office, resident director and governance
This is the requirement that catches operators pricing Singapore on capital alone. MAS demands genuine substance in Singapore, and it has to be in place when you apply. You must have in place:
- A Singapore-incorporated company as the licensee — the entity that holds the SPI or MPI licence, registered and administered in Singapore.
- Base capital funded and evidenced — S$100,000 for an SPI, S$250,000 for an MPI, plus any risk buffers MAS imposes based on the nature and scale of the business.
- A permanent place of business in Singapore — a real operating office (a mail-forwarding address does not count) from which the business is actually run.
- A resident executive director — someone genuinely accountable, resident in Singapore, sitting over the operation.
- Robust governance and internal controls — a board and management structure MAS can hold responsible, with clear reporting lines.
The contrast with a light offshore route is clear: this local presence, resident director and funded capital are exactly what a nameplate permit does not require, and they are why a MAS licence banks where an offshore registration struggles.
Pick the wrong tier or under-build the Singapore substance and MAS will see it immediately. We size the tier from your real volumes and stand up the company, resident director, office and capital as one package — see the Singapore crypto licence service for how we run it end to end.
Fit-and-proper: competence and integrity
MAS runs fit-and-proper vetting itself, and every controller, director and key person is vetted alongside the named applicant. Two standards run in parallel: competence and integrity. The regulator wants to see people who know how to run a regulated payments business and who can be trusted with customer money and tokens.
Vetting of controllers and shareholders. Ultimate owners and significant shareholders are identified, screened against criminal records and sanctions lists, and assessed for financial soundness and source of funds. Undocumented wealth or an adverse connection in the ownership chain is one of the most common reasons a file stalls.
Competence of key persons. The board, senior management, the compliance function and the appointed AML officer are each assessed for relevant experience and capability. MAS is not satisfied by names on an org chart — it expects people who can genuinely operate the controls the licence requires.
Integrity across the structure. Anyone in the ownership or control structure carrying disqualifying issues (sanctions exposure, serious convictions, regulatory findings) will fail the assessment. There is no working around it, and MAS will not license a business it cannot stand behind.
Because these files take the longest to assemble, especially source-of-funds evidence and documentation from multiple jurisdictions, start them on day one rather than treating vetting as a closing step.
AML, technology and safeguarding: the operational pack
Alongside people and substance, MAS reviews a defined operational file, and each element has to be a working system; templated documents will not get through. This is where a payments regulator’s rigour shows.
AML/CFT to MAS Notices and FATF standards. You need customer due diligence, ongoing transaction monitoring, sanctions screening, suspicious-transaction reporting and the Travel Rule for originator and beneficiary data on token transfers — built to MAS’s AML/CFT Notices and the FATF standards for virtual assets. A dedicated compliance function and an appointed AML officer must actually run this programme. Our primer on AML and KYC covers what an operable programme looks like in practice.
Technology risk and cyber-hygiene to MAS standards. Systems and controls must align to MAS’s technology-risk-management expectations — encryption, access control, secure key management and wallet design, monitoring, resilience and independent testing. For a crypto business handling private keys, this is core to whether MAS trusts you with customer assets.
Safeguarding of customer money and DPTs. Client fiat and digital tokens must be segregated and safeguarded under the Payment Services Act, so customer assets are protected and identifiable if the business fails. Audit and reporting obligations run alongside — audited financials or credible projections at application, then ongoing MAS reporting, independent audit and prompt notification of material changes once licensed.
| Requirement area | What MAS expects | Standard |
|---|---|---|
| AML/CFT | CDD, monitoring, reporting, Travel Rule | MAS Notices + FATF |
| Compliance function | Compliance officer + appointed AML officer | Competent and resourced |
| Technology risk | Cyber-hygiene, key management, testing | MAS TRM expectations |
| Safeguarding | Segregation of client money and DPTs | Payment Services Act |
| Audit & reporting | Audited accounts, ongoing MAS returns | Continuous obligation |
The DTSP threshold and assembling the file in order
Check one threshold question before any of this. Since 30 June 2025 a Singapore firm providing digital token services only to customers outside Singapore needs a DTSP licence under the Financial Services and Markets Act, and MAS has said it will generally not issue one. The requirements above are for businesses that serve customers in Singapore. A MAS licence does not passport into the EU, so if you also serve European users you will still need an EU CASP — but for institutional and banking credibility across Asia, MAS is the benchmark.
The sequence that avoids rework starts with determining SPI versus MPI from your real volumes. Then incorporate the Singapore company, fund the base capital, secure the office and appoint the resident executive director; assemble every controller and key-person fit-and-proper file in parallel, because they take the longest; then build the AML/CFT, technology-risk, safeguarding and user-protection frameworks against your actual operating model. Only then does the MAS application go in — and even then, expect a deliberate, evidence-heavy review that runs for months.
None of this resembles the light-touch permit a smaller jurisdiction offers. MAS asks for a real Singapore company, real capital, vetted people and a working compliance and technology programme, and in exchange gives you one of the most trusted crypto credentials in Asia. Get the file complete and internally consistent the first time and the nine-to-fourteen-month window is achievable; file with gaps and it drifts well beyond that.
Ready to assemble your MAS requirements pack, or want a second opinion on a file you have already started? Our team handles the full Singapore substance, fit-and-proper and framework build end to end and will review any application against MAS’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.
Frequently asked questions
What are the requirements for a Singapore crypto licence?
You need a Singapore-incorporated company holding a Standard or Major Payment Institution licence under the Payment Services Act, base capital of S$100,000 (SPI) or S$250,000 (MPI) plus any MAS buffers, a permanent Singapore place of business and a resident executive director. Behind that sit fit-and-proper controllers and key persons, a working AML/CFT programme, and technology-risk, safeguarding and audit frameworks built to MAS standards.
SPI or MPI — which licence do I need?
It follows your scale. A Standard Payment Institution fits smaller operators (monthly DPT transaction volume up to S$3 million and average daily float up to S$5 million), with S$100,000 base capital. Above those thresholds you need a Major Payment Institution licence with S$250,000 base capital plus MAS buffers. Our SPI vs MPI guide maps exactly where a business falls.
Do I need a resident director and physical office in Singapore?
Yes. MAS requires a permanent place of business in Singapore and a resident executive director, so the substance has to be genuine. The applicant is a Singapore-incorporated company that is actually directed and administered from Singapore, with a compliance function and appointed AML officer based to serve the business. This substance is part of what makes a MAS licence bankable and globally respected.
How long does a MAS licence take?
MAS's published indicative processing time is six months, but a realistic end-to-end timeline is nine to fourteen months for a well-resourced application. MAS is a deliberate, evidence-heavy regulator that reviews your business plan, controllers, AML programme and technology controls in depth. Most of the calendar goes into building a file complete enough to withstand that scrutiny before you file.
Who has to pass MAS fit-and-proper vetting?
Every controller, director and key person. MAS assesses each on competence and integrity, covering identity, track record, financial soundness and source of funds, with criminal and sanctions screening. The compliance and AML officer roles are vetted for genuine competence in the role. A single unresolved file (undocumented wealth, an adverse connection) can hold the whole application.
Are Singapore's crypto rules changing in 2026?
One rule shapes who can apply at all. Since 30 June 2025 a Singapore firm providing digital token services only to customers outside Singapore needs a DTSP licence, and MAS says it will generally not issue one. The SPI and MPI requirements in this guide apply to businesses that serve customers in Singapore.
Sources
This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.
We'll map the fastest route to a licensed, banked, live operation.
Book a free consultation →Recommended reading.
Stay ahead of the rules.
Licence fees, rules and deadlines change through the year. Subscribe and we'll email you Vantegris licensing updates.
Licence, done right.
300+ operators licensed across 40+ jurisdictions. Book a free consultation.
Book a free consultation