Singapore’s online retail scene has matured well past the days of a Carousell listing and a personal PayNow QR code. A seller moving from a side hustle to a proper storefront has to think about company structure, how customer payments are actually handled behind the scenes, what they are allowed to say about their products, and how they store the personal data that every checkout page collects. Get these right early and the business scales cleanly. Get them wrong and the fixes tend to arrive at the worst possible time, usually when a regulator, a bank, or an unhappy customer asks a question you were not ready for.
This guide sets out the four areas that matter most when setting up an online business in Singapore: choosing and registering the right business structure with ACRA, understanding when payment handling triggers a Monetary Authority of Singapore (MAS) licensing requirement, meeting your obligations under the Consumer Protection (Fair Trading) Act (CPFTA), and handling customer data properly under the Personal Data Protection Act (PDPA). Tax and GST treatment for e-commerce businesses is deliberately kept brief here, as we have covered that in detail in a separate article linked below.
None of this needs to be intimidating. Most online sellers will not need a payment services licence, most consumer protection obligations are simply good practice written into law, and PDPA compliance for a typical storefront is a matter of a few sound policies rather than a compliance department. This article aims to help you see clearly which boxes actually apply to you.
Choosing the Right Business Structure for an Online Business
The first decision, and the one that shapes everything after it, is whether to trade as a sole proprietorship or to incorporate a private limited company (Pte Ltd).
A sole proprietorship is cheap and quick to set up, and it suits a very early-stage seller testing a product on Shopee, Lazada, or Instagram before committing further. The trade-off is that there is no legal separation between the owner and the business: if a customer sues over a defective product, or a supplier chases an unpaid invoice, the owner’s personal assets are exposed. Sole proprietors also generally find it harder to open a merchant account, negotiate supplier terms, or bring in a co-founder or investor later.
A Pte Ltd company gives the business separate legal personality and limits the owners’ liability to their share capital. This matters more for e-commerce than it might for a quiet consulting practice, because online sellers carry product liability risk, payment-processing risk, and often hold customer funds briefly in transit. Most sellers who intend to scale beyond a part-time operation, apply for a business bank account with a reputable bank, or eventually seek a payment gateway’s merchant approval will find a Pte Ltd structure more practical. We have set out the detailed mechanics of converting from a sole proprietorship to a Pte Ltd, including the tax and timing considerations, in a separate guide.
Whichever structure is chosen, a company still needs a company secretary, a registered Singapore address, and at least one locally resident director if it incorporates as a Pte Ltd. These are standing obligations, not one-off registration steps.
Registering with ACRA and Choosing the Right SSIC Code
Business registration in Singapore is done through ACRA’s Bizfile+ portal. The practical steps are to reserve and get approval for a business name, decide on the business structure, appoint the required officers (director, company secretary, and shareholders for a Pte Ltd), and submit the registration with the relevant fee. Fees and processing benchmarks are published on ACRA’s website and are worth checking at the time of filing, as they are periodically revised.
One detail online sellers routinely get wrong is the Singapore Standard Industrial Classification (SSIC) code declared at registration. ACRA requires every entity to declare at least one, and up to two, SSIC codes describing its actual business activity. For an online business, this typically means a code under the retail sale via internet or retail trade classification, rather than a generic “management consultancy” or “general trading” code that some sellers default to out of habit. The code you declare is not a formality: it feeds into your eligibility for certain government grants, how your industry risk is assessed by banks during account opening, and how IRAS and other agencies classify your filings. If your online business also does wholesale, dropshipping, or fulfilment for other sellers, consider whether a second SSIC code should be declared. ACRA provides a searchable SSIC code tool on Bizfile+, and it is worth a few extra minutes at registration rather than a correction exercise later.
When Does Payment Licensing Become Relevant for an Online Seller?
Most online sellers assume this area does not apply to them, and in most cases they are right, but it is worth understanding the boundary clearly rather than guessing.
The Payment Services Act 2019 (PSA) regulates entities providing payment services in Singapore, including account issuance, money transfers, merchant acquisition, e-money issuance, and digital payment token services. Providers generally need to be licensed as a Standard Payment Institution (SPI) or, once transaction and float thresholds are exceeded, a Major Payment Institution (MPI).
The key distinction for an online retailer is this: if you simply accept payment through a licensed payment gateway or payment service provider (a card acquirer, a licensed e-wallet, or a licensed payment aggregator), you are a customer of a regulated payment service, not a provider of one, and generally do not need your own MAS licence. What changes the picture is if your business itself starts performing a licensable payment service: for example, issuing your own stored-value wallet or store credit that customers can top up and spend across multiple merchants, holding customer funds in an e-money-like facility rather than passing them straight through to a bank account, or acting as an intermediary settling funds between other merchants and their customers. At that point you may be providing a payment service in your own right and should assess your position against the PSA thresholds, rather than assuming that “we’re just a shop” puts you outside its scope.
The table below is a simplified guide to where the line generally sits. It is not a substitute for a proper regulatory assessment where your model is not a straightforward retail checkout.
| Business model | Typical PSA licensing position |
|---|---|
| Online store using a licensed payment gateway or card acquirer, funds settle to the seller’s own bank account | Generally no MAS licence needed; the gateway/acquirer is the regulated party |
| Online store accepting PayNow, credit cards, or a licensed e-wallet at checkout | Generally no MAS licence needed for the seller |
| Marketplace holding buyer funds in escrow before releasing to third-party sellers | May constitute a payment service (e.g. e-money issuance or account issuance); licensing assessment required |
| Business issues its own store credit or stored-value wallet usable across multiple merchants | Likely triggers e-money issuance licensing considerations |
| Business settles payments on behalf of other merchants (payment intermediary) | Likely triggers merchant acquisition or account issuance licensing considerations |
We have covered the MPI and SPI licensing pathway, including documentation and processing timelines, in more detail in earlier guides, which are useful reading if your model looks like any of the last three rows above.
Consumer Protection Obligations for E-commerce Listings and Refunds
The Consumer Protection (Fair Trading) Act (CPFTA) is the principal statute governing how businesses, including online sellers, deal fairly with consumers in Singapore. It is administered by the Competition and Consumer Commission of Singapore (CCCS) and applies squarely to product listings, pricing, and promotional claims made on a webstore or marketplace page.
Accurate listings and pricing
Under the CPFTA, an unfair practice includes making false or misleading claims about a product’s grade, quality, or performance, advertising a price the seller does not genuinely intend to honour, and pressuring or taking advantage of a consumer who is not in a position to protect their own interests. For an online store, this translates into a few concrete practices: product photos and descriptions should match what is actually shipped, “was/now” pricing should reflect a real prior price rather than an inflated reference figure, and stock or urgency claims (“only 2 left”) should be genuine rather than a manufactured pressure tactic.
Refunds, returns, and the “lemon law” provisions
Part III of the CPFTA, commonly referred to as the lemon law provisions, gives consumers statutory remedies where goods do not conform to contract at the time of delivery, generally including a right to repair, replacement, price reduction, or refund within a defined period after purchase. An online seller’s own returns policy sits on top of this statutory floor: it can be more generous than the law requires, but it cannot contract out of the consumer’s underlying statutory rights. A clear, honestly worded returns and refund policy published on the storefront, rather than buried in fine print or omitted altogether, is both a CPFTA good practice point and, frankly, good commerce.
PDPA Obligations for Data Collected Through an Online Storefront
Every online checkout collects personal data: names, delivery addresses, phone numbers, and often payment-related metadata. This puts an e-commerce business squarely within the scope of the Personal Data Protection Act, which sets out obligations on consent, purpose limitation, notification, protection, retention, and (since amendments took effect some years ago) mandatory breach notification where a data breach meets the notification threshold.
In practical terms, a new online business should have a clear, accessible privacy notice explaining what customer data is collected and why, obtain and record consent appropriately at checkout and for marketing communications, avoid retaining customer data longer than needed, and put reasonable security measures around the systems that store customer and order data, including any third-party platforms or fulfilment partners the business shares data with. Responsibility for the data does not disappear simply because a plugin or platform processes it. A structured internal review of what data is collected, where it flows, and who can access it is a sound first step, and is essentially what a data protection inventory or management programme sets out to formalise.
A Brief Note on Tax and GST
Tax and GST treatment for e-commerce businesses, including when GST registration is triggered, how the Overseas Vendor Registration regime applies to imported low-value goods and digital services, and common deduction issues, is a substantial topic in its own right and is covered in depth in our dedicated guide on running an e-commerce business in Singapore. In short: GST registration follows the same S$1 million taxable turnover threshold as any other business, and sellers importing low-value goods or digital services from overseas should check whether OVR obligations apply to their supply chain rather than only to their own sales.
Registration and Compliance Checklist for a New Online Business
| Area | What to do | When |
|---|---|---|
| Business structure | Decide sole proprietorship vs Pte Ltd based on liability and growth plans | Before registration |
| ACRA registration | Reserve name, appoint officers, register via Bizfile+, declare the correct SSIC code | At set-up |
| Payment handling | Confirm your payment gateway or acquirer is MAS-licensed; assess your own PSA position if you hold or route customer funds | Before launch |
| Listings and pricing | Ensure product descriptions, photos, and pricing claims are accurate under the CPFTA | Ongoing |
| Returns policy | Publish a clear refund/returns policy consistent with the CPFTA lemon law provisions | Before launch |
| Data protection | Publish a privacy notice, map data flows, and secure systems handling customer data under the PDPA | Before launch, reviewed periodically |
| Tax and GST | Monitor the S$1 million GST threshold and OVR obligations for overseas supplies | Ongoing |
Setting up an online business in Singapore is not simply a matter of picking a platform and listing products. Getting the structure, ACRA registration, payment licensing position, consumer protection obligations, and data handling right early is what allows the business to scale without a nasty surprise later. If you want a second opinion on your structure, payment set-up, or compliance obligations before you launch, our team is glad to help.
The Editorial Team, Raffles Corporate Services