A MAS digital payment token licence lets a Singapore firm buy, sell, transfer or facilitate exchange of cryptocurrency and similar tokens for customers on a regulated basis; you need one if you deal in or exchange digital payment tokens as a business in or from Singapore, unless a specific exemption applies. This guide sets out a practical decision tree for founders weighing that choice.
What the MAS digital payment token licence actually covers
Digital payment token (DPT) service is one of the payment services regulated under the Payment Services Act 2019 (PSA 2019). Section 5 of the PSA 2019 prohibits a person from carrying on a business of providing any payment service specified in the First Schedule, including a DPT service, in Singapore unless that person holds a licence granted under section 6, or is exempt. DPT service broadly covers dealing in digital payment tokens (buying or selling on the firm’s own account or facilitating an exchange) and facilitating the exchange of digital payment tokens between persons, whether or not the firm takes possession of money or tokens in the process.
Firms carrying on a DPT service in Singapore are licensed as either a standard payment institution (SPI) or a major payment institution (MPI), with the tier depending on transaction and e-money float thresholds set out in the PSA 2019 and its regulations. Section 21A of the PSA 2019 adds further, DPT-specific requirements on top of the general licensing conditions, reflecting the additional money-laundering, terrorism-financing and technology risk that MAS associates with token businesses. A firm that only builds software for someone else’s licensed DPT business, or that deals purely in its own tokens for internal treasury purposes without serving customers, may fall outside scope, but this needs to be checked activity by activity rather than assumed.
The decision tree: DPT licence, another MAS licence, or none at all
Start with the customer-facing question: does the business ever take a fee, spread or commission for dealing in, or facilitating the exchange of, a digital payment token belonging to or destined for a third party? If the answer is no, because the company only issues its own token, only accepts tokens as payment for its own goods, or only invests firm or fund money in tokens without providing that as a service to others, a DPT licence is unlikely to be required, though the position should still be documented and revisited each time the business model changes.
If the answer is yes, the next branch is volume and float. A business expecting to stay under the major payment institution thresholds for both transaction value and e-money float can start as a standard payment institution, which carries a lower base capital requirement and a lighter (though still substantial) supervisory footprint. A business that expects rapid volume growth, institutional flow, or a stablecoin or e-money float from day one should plan and capitalise for major payment institution status from the outset, because moving tiers mid-flight under section 7 of the PSA 2019 (variation of licence) is more disruptive than building for the higher tier from the start.
The final branch is whether the activity might instead sit under the Securities and Futures Act 2001 rather than the PSA 2019: tokens that are structured, or that a court would characterise, as capital markets products (for example security tokens representing equity or debt) fall under Capital Markets Services licensing rather than DPT licensing, and a firm dealing in both plain payment tokens and security tokens may need both licences side by side. Getting this characterisation wrong at the outset is one of the more expensive mistakes a token business can make, because it is discovered only after the wrong licence application has already been submitted.
Who needs a DPT licence
You need to work through this licence if your Singapore entity intends to run a crypto exchange, an over-the-counter token desk, a token payment gateway, or a platform that lets customers convert digital payment tokens into fiat currency or into other tokens, and you are doing this as a business rather than as an occasional private transaction. It also captures Singapore-incorporated entities that route DPT dealing or exchange activity through the company even where the counterparties or end clients are mostly overseas, because the PSA 2019’s territorial trigger is the place of business, not the location of the customer.
It typically does not capture a company that merely accepts digital payment tokens as consideration for goods or services it sells (a merchant accepting crypto payments), nor one that only issues its own token without dealing in or exchanging third-party tokens for a fee. Groups running a fund that holds digital assets as an investment, rather than dealing in them as a service to others, usually sit under securities and futures or fund management rules instead, and should not default to a DPT licence without first mapping the actual activity against the PSA 2019 First Schedule.
Eligibility and core requirements
MAS assesses a DPT licence applicant on: base capital and financial soundness appropriate to the licence tier (standard vs major payment institution); a permanent place of business or registered office in Singapore; fit and proper directors, chief executive officer and shareholders; a security deposit or equivalent safeguard for customer money and tokens; and a technology risk management framework covering custody, wallet security and business continuity. Anti-money laundering and countering the financing of terrorism (AML/CFT) controls are scrutinised especially closely for DPT applicants, given the pseudonymous and cross-border nature of token transfers, and MAS routinely asks for evidence of transaction monitoring, source-of-funds checks and travel-rule compliance for token transfers above prescribed thresholds.
Section 13 of the PSA 2019 sets out categories of exempt payment service provider; some entities that already hold another relevant MAS licence, or that fall within a prescribed exemption class, may not need a standalone DPT licence for the same activity, but reliance on an exemption should be confirmed with MAS or a qualified adviser rather than assumed from a general reading of the Act.
Shareholders crossing prescribed control thresholds are also assessed: a person becoming a 5%, 12% or 20% controller of the licensee is subject to notification or approval requirements, and a change of controller after licensing can itself require fresh MAS approval. Groups structuring the Singapore licensee with a holding company overseas should map out the controller chain early, since an opaque or frequently changing ownership structure is one of the more common reasons MAS extends its review of a DPT application beyond the typical timeline.
Cost and timeline: the numbers
Budget for the following order-of-magnitude figures, which vary with licence tier and the complexity of the AML/CFT and technology submissions:
- Base capital: typically S$100,000 for a standard payment institution and S$250,000 for a major payment institution carrying on DPT service, though the applicable figure depends on the full mix of payment services provided.
- Security deposit: broadly S$100,000 to S$200,000 once major payment institution thresholds are crossed, held with MAS or an approved bank.
- Professional fees for legal, compliance and technology risk documentation: commonly S$15,000 to S$60,000 for a first-time applicant, depending on how much of the AML/CFT framework, policies and technology risk assessment already exist in-house.
- MAS processing time: applicants should expect 6 to 12 months from a complete submission to grant of licence, longer where MAS raises queries on beneficial ownership, custody arrangements or overseas group structures.
- Ongoing costs: annual licence fees, an annual independent audit of AML/CFT controls, and periodic technology risk assessments once licensed.
Step-by-step application process
- Map every activity the business will perform against the PSA 2019 First Schedule to confirm DPT service applies, and whether standard or major payment institution status is expected at launch.
- Incorporate the Singapore entity (or confirm the existing entity’s constitution and shareholding permit the licensed activity) and appoint directors who can meet MAS’s fit-and-proper bar.
- Build the AML/CFT policy manual, technology risk management framework, business continuity plan and fit-and-proper declarations for all directors, chief executive officer and 20% controllers.
- Prepare the base capital and, once thresholds are known, the security deposit arrangement.
- Submit the licence application through MAS’s online portal with the full documentation set, then respond to MAS’s supervisory queries, which for DPT applicants usually focus on custody security and source-of-funds screening.
- On approval, complete any pre-commencement conditions MAS imposes before the licence is activated, and put the section 21A DPT-specific safeguards into live operation from day one.
Common mistakes and pitfalls
The most frequent rejection reasons are: underestimating the AML/CFT evidentiary bar (a policy document without a working transaction-monitoring system will not satisfy MAS); applying for standard payment institution status while already structurally certain to exceed the major payment institution thresholds within months of launch; treating overseas directors’ compliance experience as sufficient without a Singapore-based person genuinely able to discharge day-to-day oversight; and under-budgeting for the 6 to 12 month timeline, which then forces a business to either delay launch or operate through an unlicensed workaround that itself breaches section 5 of the PSA 2019. Firms should also avoid assuming an exemption under section 13 applies without a written basis for that view, since operating without a licence where one is required is an offence.
Staffing and governance for a licensed DPT business
Beyond the capital and technology tests, MAS looks closely at the composition of the board and the depth of the compliance function. A licensed DPT business is expected to have a chief executive officer resident and physically present in Singapore who can genuinely account for day-to-day operations, a designated compliance officer with AML/CFT experience appropriate to the scale of the business, and directors collectively able to demonstrate risk management, technology and financial services experience rather than purely commercial or marketing backgrounds. Applicants that concentrate all decision-making authority in an overseas parent, with a thin Singapore presence, routinely draw supervisory follow-up questions and delay.
Once licensed, ongoing governance obligations include periodic returns to MAS on transaction volumes and float, notification of material changes to shareholders, directors or the business model, and annual independent audits of the AML/CFT programme. Groups planning to use the Singapore DPT licensee as a hub for a broader regional token business should build these reporting obligations into their operating model from the start, since retrofitting compliance reporting into a live, revenue-generating business is materially more disruptive than designing it in before launch.
FAQs
Do I need a DPT licence if my customers are all outside Singapore?
Generally yes, if the business of dealing in or exchanging digital payment tokens is carried on from a Singapore place of business; the PSA 2019’s trigger is where the service is provided from, not where the customer sits.
What is the difference between a standard and major payment institution for DPT service?
The tier depends on transaction value and e-money float thresholds set under the PSA 2019 and its regulations; major payment institutions face higher base capital and security deposit requirements and closer supervision.
Can an existing payment services licensee simply add DPT service to its licence?
Often yes, through a variation of licence application under the PSA 2019 rather than a fresh licence, but MAS will still assess the AML/CFT and technology risk controls specific to token dealing.
How long does a first-time DPT licence application take?
Most applicants should plan for 6 to 12 months from a complete submission, with the AML/CFT and custody security review typically the longest stage.
Is a digital payment token licence the same as a Capital Markets Services licence?
No. A DPT licence under the PSA 2019 covers dealing in or exchanging payment tokens; a Capital Markets Services licence under the Securities and Futures Act 2001 covers regulated activities in capital markets products, which is a different regime with different thresholds.
Related guides
For background on how fund structures interact with token exposure, see this explainer on VCC legal personality and membership rules. If you are incorporating the Singapore entity that will hold the licence, this guide to Pte Ltd company registration for foreigners covers the incorporation mechanics. We have also published a companion piece of frequently asked questions on MAS DPT licensing that pairs well with this decision tree. For the regulator’s own guidance, see the MAS regulation portal and the text of the Payment Services Act 2019 on Singapore Statutes Online.
Need help with this? Call, SMS or WhatsApp +65 8501 7133, or email [email protected]. Raffles Corporate Services works with a panel of corporate and employment law firms; this article is general information, not legal advice.