MAS Digital Payment Token (DPT) licensing under the Payment Services Act 2019 is rejected most often because of weak AML/CFT controls, unclear fund flows, or directors who are not assessed as fit and proper — this guide sets out the recurring gaps and how to close them before submission.
Raffles Corporate Services works with a panel of corporate and employment law firms; this article is general information, not legal advice, and does not replace a formal licensing opinion from MAS-facing counsel before an application is lodged.
What MAS Digital Payment Token (DPT) licensing is
A Digital Payment Token service is one of the payment services regulated under the Payment Services Act 2019 (PS Act), covering the buying, selling, or facilitating the exchange of digital payment tokens — broadly, cryptocurrencies and functionally similar tokens — for a business based in or operating from Singapore. Section 5 of the Payment Services Act 2019 requires a person carrying on a business of providing any payment service in Singapore, including a DPT service, to hold a licence issued by the Monetary Authority of Singapore (MAS), unless a specific exemption applies. Entities offering DPT services without a licence, or outside the scope of an existing licence’s approved activities, are operating in breach of the Act and expose their directors to personal liability.
DPT services sit alongside six other regulated payment service categories under the PS Act — account issuance, domestic money transfer, cross-border money transfer, merchant acquisition, e-money issuance, and money-changing. Many applicants under-appreciate that a single licence application can (and often should) bundle several of these categories where the business model genuinely spans them, for example a token exchange that also issues e-money wallets to facilitate fiat on-ramps. Bundling the wrong categories, or omitting one the business actually intends to use, is itself a recurring cause of later licence variation applications and MAS follow-up queries.
Who DPT licensing is for
DPT licensing is relevant for token exchanges, over-the-counter (OTC) trading desks, custodial wallet providers dealing in DPTs, and fintechs building payment rails on top of tokens. It is not the correct licence for entities that only deal in capital markets products referencing digital assets, which may instead sit under the Securities and Futures Act 2001, or for businesses that never touch Singapore customers or Singapore-based operations and are genuinely regulated elsewhere. Groups that also run a fund vehicle alongside a token business — for example a Variable Capital Company holding digital assets on behalf of investors — should map the DPT licence and the fund structure separately, since they sit under different MAS regulatory perimeters with different capital, custody, and reporting obligations; see our VCC for digital asset and crypto funds — eligibility and requirements checklist for the fund-side rules.
Start-ups exploring DPT licensing purely to “future-proof” a product idea, without a live customer base or committed launch date, are usually better served applying for an exemption assessment or delaying the application until the business model is closer to launch-ready. MAS’s fee structure and ongoing compliance obligations (annual audits, regulatory returns, AML/CFT independent reviews) are not proportionate to a pre-revenue business, and an early, thin application is more likely to draw the extended query cycles described below.
Eligibility and requirements
MAS assesses three broad areas when reviewing a DPT application. First, fitness of the applicant entity: a Singapore-incorporated company with a permanent place of business in Singapore and at least one Singapore-resident director or CEO actively involved in day-to-day management. Second, fitness of individuals: directors, the CEO, and substantial shareholders (generally those controlling 20% or more of shares or voting power) must be fit and proper, with clean regulatory and criminal histories disclosed in full, including matters in other jurisdictions that a cursory Singapore-only check would miss. Third, fitness of the business itself: a coherent business model, robust AML/CFT policies aligned to the MAS Notice on Prevention of Money Laundering and Countering the Financing of Terrorism for DPT service providers, and demonstrated technology risk management covering custody, key management, and incident response.
Applicants seeking to conduct DPT services as a Major Payment Institution (MPI) — required once projected transaction or e-money float thresholds are expected to be exceeded — face closer scrutiny of capital adequacy and safeguarding arrangements than a Standard Payment Institution (SPI) applicant operating below those thresholds. MAS also expects a named, appropriately qualified compliance officer (which may be outsourced in the early stages, subject to MAS’s comfort with the outsourcing arrangement) and a board composition that is not dominated by a single individual holding all the relevant licences, roles, and shareholdings.
Cost and timeline
Numerical specifics vary by advisory scope and the complexity of the applicant’s proposed activities, but as a general planning guide:
- Base capital: S$100,000 for a Standard Payment Institution; S$250,000 for a Major Payment Institution.
- Security deposit or bank guarantee: typically between S$100,000 and S$200,000 for an MPI providing DPT services, held as required under the PS Act safeguarding framework.
- MAS processing time: officially up to 4 months from a complete application, though DPT applications in practice have taken 12–24 months given the volume of AML/CFT and technology risk queries typically raised.
- Pre-submission preparation: 8–16 weeks to build the business plan, policies, and fit-and-proper documentation to a submission-ready standard.
- Typical advisory and compliance build cost: S$30,000–S$80,000, depending on whether AML/CFT systems, transaction monitoring tooling, and policy suites are built from scratch or adapted from an existing framework used elsewhere in the group.
- Ongoing annual compliance cost post-licensing: commonly S$40,000–S$120,000 covering an independent AML/CFT audit, regulatory returns, and a part-time or full-time compliance function.
Step-by-step process
1. Confirm the licence class (SPI or MPI) and the specific payment service categories needed based on projected transaction volumes and product scope. 2. Incorporate or restructure the Singapore entity and appoint a Singapore-resident director or CEO who meets the fit-and-proper bar. 3. Draft the business plan, AML/CFT policies, technology risk management framework, and outsourcing arrangements, tailored to the applicant’s actual token flows rather than adapted wholesale from a template. 4. Prepare fit-and-proper declarations and supporting documents for all directors, the CEO, and controllers of 20% or more of shares or voting power, including overseas regulatory history checks. 5. Submit the application via MAS’s online portal with all supporting annexes, cross-referenced so MAS’s reviewers can trace each policy back to a specific business activity. 6. Respond to MAS queries — typically two to four rounds covering AML/CFT specifics, source of funds for customers, safeguarding of customer moneys and tokens, and technology risk controls. 7. On in-principle approval, complete any outstanding conditions, for example appointing a compliance officer or finalising the security deposit arrangement, before the licence is formally issued.
Common mistakes and rejection reasons
The recurring gaps we see in rejected or heavily delayed DPT applications:
- Generic AML/CFT policies. Applicants submit templated policies that do not reflect the applicant’s actual token flows, counterparties, or jurisdictions served, and MAS asks pointed questions the applicant cannot answer in the first response round.
- Unclear source-of-funds and source-of-wealth procedures for customers, particularly where the applicant plans to onboard retail customers or accept token deposits from wallets it cannot trace to a verified source.
- Directors or shareholders not properly vetted. Past regulatory issues, undisclosed directorships in other jurisdictions, or unclear beneficial ownership chains are common causes of an extended review or outright rejection.
- Business model drift. The application describes a narrower activity, for example custody only, than what the website or marketing materials suggest the business intends to do, for example also running an exchange, creating a mismatch MAS will query and may treat as a disclosure concern.
- Weak technology risk management. Applicants under-describe cyber security controls, cold and hot wallet segregation, and incident response procedures — an area MAS treats as core to DPT applications given the custody risk involved.
- Underestimating the security deposit or capital runway. Applicants budget for the base capital but not the ongoing security deposit, compliance headcount, and audit costs needed to remain licensed once approved.
- No local substance. An applicant with only nominee directors and no genuine Singapore operations struggles to demonstrate the “mind and management” MAS expects for a licensed entity, and this is increasingly a standalone ground for query or rejection.
- Rushed submission before the business model is settled. Applications lodged while the applicant is still deciding between custodial and non-custodial models, or between retail and institutional-only service, tend to generate inconsistent answers across the application annexes that undermine MAS’s confidence in the applicant’s readiness.
FAQs
Does every crypto business in Singapore need a DPT licence? Not every business — only those providing a payment service involving digital payment tokens as defined under the Payment Services Act 2019 need a licence, and some overseas-only businesses may fall outside scope, though this needs a case-by-case assessment against the Act’s territorial reach.
How long does MAS take to approve a DPT licence? The statutory processing benchmark is up to 4 months for a complete application, but DPT applications commonly take 12–24 months in practice due to AML/CFT and technology risk follow-up queries.
What is the difference between a Standard and Major Payment Institution for DPT services? The classification depends on projected transaction values and float thresholds under the PS Act; MPIs face a higher base capital requirement (S$250,000) and a security deposit that SPIs below the relevant thresholds do not.
Can a DPT licence applicant use nominee directors? MAS expects genuine local substance and a fit-and-proper Singapore-resident director or CEO actively involved in the business, not a passive nominee arrangement with no real oversight role.
Does a DPT licence cover token-based fund management too? No — a fund vehicle dealing in digital assets, such as a VCC, sits under a separate regulatory track and may need its own MAS authorisation depending on the fund manager’s licensing status, entirely apart from a DPT service licence.
Related guides
For the eligibility criteria in more detail, see our companion guide, MAS Digital Payment Token (DPT) licensing — Eligibility and requirements checklist. Businesses combining a token offering with an incorporation strategy in Singapore may also find our note on how IRAS treats digital payment tokens for tax purposes useful when modelling the full compliance and tax picture. For the statutory text itself, MAS publishes licensing guidance at mas.gov.sg, and the consolidated Act is available at the Payment Services Act 2019 on Singapore Statutes Online.
Need help with this? Call, SMS or WhatsApp +65 8501 7133, or email [email protected]. Raffles Corporate Services works with a panel of corporate and employment law firms; this article is general information, not legal advice.