The answer depends on the activity, token rights, contracting entity and customer location. Incorporation does not authorise an exchange, custody, transfer or brokerage service. Applicants should classify each product flow, then verify the entity and approved activities in the MAS Financial Institutions Directory.
Key takeaways
- PSA licensing covers DPT services provided in Singapore; SPI and MPI status depends on the payment services and transaction thresholds.
- A token representing securities, fund units or derivatives may require CMS or financial-advisory permission rather than only a DPT licence.
- Singapore-linked providers serving solely overseas customers face the restrictive FSMA DTSP regime and cannot rely on incorporation alone.
Which MAS licence route applies?
The first decision is not whether the business is a crypto company, but what the named entity does with which token and for whom. TheCCPress’s product-specific regulator map uses the same method: follow the transaction and legal responsibility instead of assigning one licence to an entire brand.
| Business model | Primary Singapore route | What brings it into scope | Evidence to prepare |
|---|---|---|---|
| Exchange, broker, transfer service or custodian serving Singapore customers | PSA DPT service under an SPI or MPI licence | Dealing, facilitating exchange, transmitting DPTs, safeguarding assets or controlling access instruments | Transaction flow, custody model, customer geography, volume forecast and safeguarding controls |
| Trading or arranging tokenised securities, fund units or derivatives | CMS licence under the Securities and Futures Act | The token represents a capital-markets product and the entity performs a regulated activity | Legal classification, product terms, offering structure, execution flow and customer type |
| Advising on tokenised capital-markets products | Financial adviser’s licence or applicable exemption | The entity makes regulated recommendations or issues research within the Financial Advisers Act | Advice process, client classification, conflicts, competence and disclosure controls |
| Singapore-linked provider serving only customers outside Singapore | DTSP licence under FSMA Part 9 | Specified DPT or capital-markets-product token services are conducted solely overseas | Singapore nexus, overseas customer map, AML controls and evidence that MAS can supervise the activity |
DPT activity is wider than operating an exchange
DPT service can include buying or selling tokens, facilitating exchange, transmitting DPTs, safeguarding tokens or instruments that control them, and inducing a person to enter certain DPT transactions. A non-custodial interface may fall outside one activity but enter another through order routing, brokerage, transfer control or customer solicitation. Each step needs its own perimeter conclusion.
Limited-purpose tokens may be excluded, but the label “utility token” is not decisive. When a token represents shares, debt, fund units or derivatives, the analysis moves toward the Securities and Futures Act and possibly the Financial Advisers Act, even if the platform also holds a DPT payment licence.
SPI, MPI and DTSP financial thresholds
An applicant chooses SPI or MPI according to its services and projected scale, not company age. Under the Payment Services Act, the MPI threshold is crossed when average monthly transactions exceed SGD 3 million for one regulated service or SGD 6 million across two or more services.
| Licence position | Operating boundary | Base capital or head-office funds | Additional financial requirement |
|---|---|---|---|
| Standard Payment Institution | Operates below the applicable PSA thresholds | At least SGD 100,000 | Must monitor volumes and apply to vary the licence before exceeding the threshold |
| Major Payment Institution | May operate without the SPI volume ceilings | At least SGD 250,000 | Security of SGD 100,000 or SGD 200,000, depending on payment volumes and services |
| FSMA Part 9 DTSP | Supplies specified digital-token services solely outside Singapore | At least SGD 250,000 | Must satisfy the separate DTSP financial, governance and AML requirements |
These amounts are entry floors, not a full application budget or proof of solvency. The Payment Services Regulations add customer-asset, audit and ongoing financial requirements. CMS capital depends on the regulated activity and conditions, so the SPI or MPI figure cannot replace it.
The live directory provides useful market context. A check on 2 September 2026 returned 37 Major Payment Institutions listing DPT service as an approved activity. That count shows MAS has licensed a real operating market, but it is not an approval-rate statistic: it excludes unsuccessful applicants, withdrawn files and firms licensed under different activities.
What a complete DPT application needs
A credible application connects the business model to the requested payment services. MAS needs the corporate structure, controllers, directors, chief executive, Singapore operating presence, financial projections, transaction flows and outsourcing model to tell one consistent story. Fit-and-proper evidence must cover the people who control the applicant and those accountable for its regulated operations.
New SPI and MPI applicants must provide a legal opinion from a Singapore law firm experienced with the PSA. It should describe the model, identify each regulated payment service and explain any exclusion. Existing licensees adding DPT service face the same perimeter discipline rather than treating a variation as a simple update.
DPT applicants also need an independent external-auditor assessment of their controls. Evidence should cover AML/CFT, sanctions, Travel Rule processes, token risk, custody, reconciliation, technology security, incidents and complaints. A template policy is weak evidence unless it identifies the applicant’s systems, owners, thresholds, escalation paths and records.
The application should also show operational substance. MAS assesses whether governance and compliance resources are proportionate to the customer base, transaction volume, token exposure and outsourcing dependencies. A Singapore office without resident decision-making, technical oversight or access to records does not demonstrate that the licensed entity can control the service presented to customers.
Licensing changes the controls, not the investment risk
A DPT licensee remains responsible for customer due diligence, ongoing monitoring, sanctions screening, suspicious-transaction escalation and value-transfer information. MAS’s 2026 supervisory focus also covers token-listing risk, higher-risk customers, counterparties, outsourced providers and training. The test is whether controls operate on real customers and transactions, not whether a policy contains the correct headings.
Custody creates a separate evidence chain. PSA regulations require customer assets to be identified, recorded and safeguarded through prescribed arrangements, with reconciliations and controls over access. Readers should still inspect the customer agreement because group branding may hide which entity holds the assets, operates the exchange and controls withdrawals.
An MPI must also maintain the required security with MAS. That security supports obligations to payment-service users if the licence lapses, is surrendered or revoked, but it does not insure every token balance or eliminate insolvency risk. Capital, security, customer-asset safeguards and commercial insurance answer different questions and should remain separate in an editorial comparison.
Serving overseas customers from Singapore
An offshore-only customer base does not remove Singapore from the analysis. Since 30 June 2025, a Singapore-linked entity supplying specified digital-token services solely outside Singapore must obtain a DTSP licence. MAS said it would generally not issue these licences because offshore-only models create elevated money-laundering risk and are difficult to supervise effectively.
The rule is not a ban on every cross-border service. A PSA-licensed provider serving Singapore may also serve overseas customers, while out-of-scope utility or governance-token services produce a different result. Apply the overseas-service deadline to the entity, token and customer map rather than presenting it as a universal prohibition.
Affected unlicensed offshore-only providers received no transitional period. They had to cease the regulated activity when the regime began unless licensed or otherwise outside scope. A founder should test where management, employees, contracting, custody and solicitation occur before assuming that foreign customers make a Singapore company operationally offshore.
How to verify a Singapore crypto provider
Start with the legal entity in the customer agreement and search it in the MAS directory. Record the licence type, status, approved activities, website and verification date. The current directory showed 37 MPI records with DPT service when checked, but a brand may use several subsidiaries and only one may hold that activity.
The 2026 crypto regulator watchlist identifies MAS as the relevant authority for this check, but it cannot establish a provider’s current status. Only the live directory connects a licence type and approved activity to the legal entity serving the customer.
Next, match the licence to the product. Identify who executes the trade, safeguards keys, receives fiat, transmits DPTs and handles complaints. The MAS directory and Investor Alert List serve different purposes; TheCCPress’s Bybit alert analysis explains why an alert is not equivalent to an approved or rejected licence application.
Operational experience can reveal a separate bottleneck. In a Singapore exchange discussion reviewed on 10 August 2026, an Independent Reserve customer reported nearly instant linked-bank deposits and withdrawals after approval, while verification took longer. That individual result cannot establish performance for every bank, amount or review state.
The reader test is to make a small SGD deposit and withdrawal, compare the executable spread on the intended pair and record all charges before increasing exposure. Licensing establishes a supervised activity; it does not prove low fees, deep liquidity, fast support, uninterrupted banking or protection from token losses.
Stablecoin issuance also requires separate analysis. Singapore’s single-currency stablecoin framework addresses issuer, reserve and redemption requirements, while a DPT licence addresses the intermediary’s service. Listing a qualifying stablecoin does not make an exchange its issuer or extend its licence to every token product.
Conclusion
Singapore crypto licensing follows the transaction rather than the company description. A local DPT exchange, broker, transfer service or custodian generally starts with PSA licensing; tokenised capital-markets products may require CMS or advisory permission; and a Singapore-linked offshore-only provider must confront the restrictive FSMA DTSP regime.
The strongest application maps each activity to one accountable entity and supports that map with legal analysis, audited controls, capital, governance and Singapore operating substance. After licensing, customers and counterparties should still verify the exact product, custody arrangement, payment rail and contractual entity instead of treating a MAS logo as a complete risk assessment.
Frequently asked questions
Does a Singapore company automatically have a DPT licence?
No. Incorporation and licensing are separate facts. The provider must hold the relevant permission for the named legal entity and activity, unless a statutory exclusion applies. Check its current directory entry against the customer agreement, website and service being offered.
Does a DPT licence cover every token service?
No. A DPT permission covers approved payment-token activities under the PSA. Tokenised securities, fund units, derivatives, financial advice and offshore-only digital-token services can enter the SFA, FAA or FSMA framework and require a different licence or exemption analysis.
What should be recorded when checking MAS status?
Record the legal entity, licence type, approved activity, status, website, contracting party and verification date. Then identify who executes trades, controls customer assets and handles fiat transfers. This creates an auditable status record without implying that the licence guarantees product quality or customer returns.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
