Singapore has built one of the most credible regulatory environments for digital assets in the world. The Monetary Authority of Singapore (MAS) oversees crypto activity through two main pieces of legislation: the Payment Services Act (PSA) and the Financial Services and Markets Act (FSMA).
For crypto firms, this creates a real operational challenge. Scaling a product across borders while satisfying licensing, custody and marketing rules takes more than a compliance checklist. It requires infrastructure built with those rules in mind from the outset.
This guide sets out what MAS regulates, how licensing obligations differ by business model, and what operational steps firms take to stay compliant without slowing down growth.
What MAS regulates in the crypto industry
MAS regulates crypto through the activities firms carry out, such as DPT dealing, exchange, transmission, custody, safeguarding and cross-border digital token services. It also has a specific framework for certain single-currency stablecoins issued in Singapore.
Payment Services Act (PSA)
The PSA is Singapore's core statute for licensing digital payment token (DPT) service providers. It came into force in January 2020 and was significantly amended from April 2024 to widen the scope of regulated activity and introduce user protection and financial stability requirements.
Firms buying, selling, exchanging or transmitting DPTs in Singapore need a Major Payment Institution (MPI) or Standard Payment Institution (SPI) licence. An MPI licence carries no transaction volume cap; an SPI licence is capped at SGD 3 million a month per service. MAS maintains a public register of licensed payment service providers, and firms should check the current register when assessing a provider’s licence status.
FSMA and cross-border oversight
The FSMA closes a gap that the PSA did not cover before; firms based in Singapore that serve customers entirely outside the country. From June 2025, these Digital Token Service Providers (DTSPs) need a separate licence under the FSMA, set out in MAS's Guidelines on Licensing for DTSPs.
MAS has set a high bar for this licence and generally does not grant it, citing the difficulty of supervising money laundering risk in businesses with no domestic customer base. Firms with any Singapore-facing activity remain under the PSA rather than the DTSP regime.
Consumer protection and marketing restrictions
MAS Notice PSN02 sets out DPT-specific consumer protection rules. MAS’s AML/CFT requirements for DPT service providers are set out separately, including through Notice PSN02. Consumer protection and business conduct expectations are addressed through MAS’s DPT consumer protection safeguards and related Payment Services Act regulatory measures. These restrict advertising DPT services in public places and limit credit facilities offered to retail customers for crypto trading, reflecting MAS's stance that retail investors should not be encouraged into speculative positions.
How MAS requirements apply to crypto businesses
MAS does not apply a single rulebook to every crypto business. Obligations scale with the risk a business model presents, so a wallet provider, an exchange and a payments intermediary each face a different mix of requirements.
Wallet providers: key security and access controls
Wallet providers fall under the PSA where they hold or transmit DPTs on a customer's behalf. MAS expects effective technology risk management, strong access controls, and clear recovery procedures if a customer loses access to their private keys.
This is where operational resilience becomes a compliance question, not just a product one. A wallet that cannot demonstrate secure, auditable recovery processes carries regulatory exposure alongside the commercial cost of locked-out customers.
Exchanges: cold storage, segregation, and safeguards
Exchanges must segregate customer assets from the firm's own assets and hold them in trust for the customer's benefit. MAS's 2024 amendments formalised expectations around proper books and records, and systems and controls that protect the integrity and security of customer assets. In practice, this pushes exchanges toward a majority cold storage model, with hot wallet exposure kept to what is needed for day-to-day liquidity.
Service providers: travel rule and compliance controls
Payment intermediaries and other DPT service providers carry standard AML/CFT obligations under Notice PSN02, including counterparty due diligence on DPT transfers. MAS expects firms to maintain transaction monitoring and reporting capable of tracing the originator and beneficiary of a transfer, in line with international travel rule standards.
Compliance blueprint: retail vs institutional requirements
MAS obligations depend on the activity, customer base and operating model. Singapore-facing DPT services are generally regulated under the Payment Services Act, while Singapore-based firms providing digital token services solely outside Singapore may fall under the DTSP regime in the Financial Services and Markets Act. Firms should assess licensing, AML/CFT, safeguarding, consumer protection, technology risk and reporting obligations against their specific model rather than assuming a single retail/institutional split.
How firms operationalise MAS compliance
MAS obligations depend on the activity carried out, the customer base served and the operating model behind it, not on a simple retail versus institutional split.
Digital payment token services provided to customers in Singapore are generally regulated under the Payment Services Act 2019, alongside the Securities and Futures Act and Financial Advisers Act where capital markets products are involved. This is well-established territory with clear licensing and conduct requirements.
The picture is different for Singapore-incorporated firms, or those operating from a place of business in Singapore, that provide digital token services solely to customers outside Singapore. Since 30 June 2025, these firms fall under the DTSP regime in Part 9 of the Financial Services and Markets Act 2022. MAS has been explicit that this is not a routine licensing track: it has set a deliberately high bar and expects to grant DTSP licences only in extremely limited circumstances, citing the money laundering and terrorism financing risks it associates with cross-border, internet-based token services it cannot easily supervise. Firms without a licence are required to cease the relevant regulated activities, with no transitional relief built into the regime.
How Coincover supports MAS-aligned recovery infrastructure
Most of the operational load in the sections above comes back to one question MAS keeps returning to: can a firm prove, not just claim, that customer assets are safeguarded and recoverable.
CoinCover Recover for Institutions is designed to help firms evidence recovery preparedness through documented controls, recovery workflows, backup evidence, training records and recovery testing outputs. CoinCover Certified helps package that evidence in a structured way for internal governance, auditors, partners and regulatory discussions.
The infrastructure integrates with the major digital asset platforms firms are already running on, including BitGo, Cobo, Copper, Fireblocks, Fordefi, Liminal, Onramp and Utila, so certification and recovery testing can be layered onto an existing custody setup rather than requiring a rebuild.
Final thoughts
MAS's framework is demanding, but it is also a filter. Firms that meet it consistently signal to banks, institutional counterparties and customers that they operate to a standard few offshore alternatives can match.
Compliance, handled well, becomes a competitive advantage rather than a cost centre. CoinCover provides the security and recovery infrastructure, and the independent certification, that helps crypto firms turn MAS's asset safeguarding and access resilience expectations into evidence auditors and regulators can act on, without slowing down the product.
Get in touch with one of our recovery specialists now, for help with your institutional recovery infrastructure setup here.
.png?width=407&height=229&name=Frame%202147262385%20(1).png)