Crypto Exchange Licensing in Singapore: MAS Requirements & FSMA Guide

Thinking about launching a crypto exchange in Singapore? You might be surprised to learn that the rules changed drastically on June 30, 2025. The Monetary Authority of Singapore (MAS) didn’t just tweak the guidelines; they overhauled them with the Financial Services and Markets Act (FSMA). If you’re operating as a Digital Token Service Provider (DTSP), you no longer have the luxury of serving only overseas clients from a Singapore base without a license. That loophole is closed. Today, if you want to operate here, you need to meet strict capital, compliance, and reporting standards immediately. There are no transitional grace periods anymore.

This shift matters because Singapore remains a top-tier financial hub in Asia. But it’s also a place where regulators are serious about preventing regulatory arbitrage. They don’t want crypto firms using the city-state as a quiet office while doing all their risky business elsewhere. So, whether you’re a startup founder or an established exchange expanding into Southeast Asia, understanding these requirements is non-negotiable. Let’s break down exactly what you need to do to get licensed and stay compliant under the current regime.

The New Regulatory Landscape: PSA and FSMA

To understand your obligations, you need to know which laws apply to you. Currently, two main pieces of legislation govern crypto activities in Singapore: the Payment Services Act 2019 (PSA) and the newer Financial Services and Markets Act 2022 (FSMA). While the PSA laid the groundwork for digital payment tokens since 2020, the FSMA expanded MAS’s powers significantly. It specifically targets entities that might otherwise slip through the cracks by claiming they serve only foreign markets.

The key change effective mid-2025 is that MAS now treats all DTSP operations under a unified framework. Previously, some businesses argued that because their customers were offshore, they didn’t need a full local license. Not anymore. If your company is incorporated in Singapore or has significant operational presence there, you fall under MAS supervision. This means you must adhere to the same anti-money laundering (AML) and counter-financing of terrorism (CFT) standards as traditional banks. Chengyi Ong, head of Asia Pacific policy at Chainalysis, noted that this move reinforces financial integrity as a red line. The goal is simple: insulate Singapore from reputational risks associated with unregulated crypto activity.

Choosing Your License Type: Standard vs. Major

Not every crypto exchange needs the same level of oversight. Your required license depends largely on your transaction volume and the scope of services you offer. Under the PSA, there are three primary categories you’ll likely encounter. Choosing the right one affects your capital requirements, compliance burden, and application timeline.

Most new exchanges start with the Standard Payment Institution License. It’s designed for smaller operators who process up to SGD 3 million monthly. You’ll need SGD 100,000 in paid-up capital. This license covers basic services like buying, selling, and transferring digital payment tokens. However, once you cross that SGD 3 million threshold, you must upgrade to the Major Payment Institution License. This requires SGD 250,000 in capital and demands much more rigorous internal controls. Think advanced risk management systems, independent external audits, and detailed reporting on suspicious transactions.

What about the Exempt Payment Service Provider? This category is narrow. It applies to very specific low-risk activities, such as certain types of merchant acquisition or limited money-changing services. For most crypto exchanges dealing with token trading, this exemption rarely applies. Don’t assume you’re exempt just because you’re small; check the specific activity definitions carefully.

Anti-Money Laundering: The Core Requirement

If there’s one area where MAS doesn’t compromise, it’s AML compliance. The cornerstone of this requirement is MAS Notice PSN02. This notice dictates how you must handle customer identification and transaction monitoring. It’s not enough to just collect names and emails. You need a robust system for verifying identities, screening against sanctions lists, and monitoring ongoing behavior.

Your KYC (Know Your Customer) procedures must go beyond the basics. For individual users, you need government-issued ID verification and proof of address. For corporate clients, you must identify beneficial owners holding more than 25% equity. But verification isn’t a one-time event. You need ongoing monitoring. If a user suddenly starts moving large volumes of tokens after months of inactivity, your system should flag it. Why? Because sudden changes in pattern can indicate layering-a common money laundering technique.

You also need to report suspicious activities to the Suspicious Transaction Reporting Office (STRO) within 15 days of forming a suspicion. This includes both completed and attempted transactions. Failing to report can lead to heavy fines or license revocation. Many startups underestimate the cost of building or buying a compliance tool that meets these standards. Budget for specialized software; manual spreadsheets won’t cut it when you’re processing thousands of trades daily.

The Application Process: What to Expect

Applying for a license is intensive. It’s not a form you fill out online in ten minutes. You’re submitting a comprehensive package that proves you’re fit and proper to run a financial service. The typical timeline ranges from 3 to 6 months for a Standard License, but can stretch to 12 months for a Major License due to enhanced due diligence.

Here’s what your application dossier must include:

• Business Plan: Detail your mission, target market, revenue model, and growth strategy. Be realistic. MAS reviewers look for sustainability, not just hype.
• AML/CFT Policies: Submit your written policies for customer due diligence, record keeping, and suspicious transaction reporting. These must align with MAS Notice PSN02.
• Financial Projections: Provide projected income statements and balance sheets for the next three years. Show how you’ll maintain your minimum capital.
• Key Personnel Profiles: Include CVs for directors and senior management. MAS checks their track records for any history of financial misconduct or regulatory breaches.
• Risk Assessment Report: Identify potential risks (market, operational, legal) and explain how you mitigate them. Do you have insurance? How do you secure cold storage?

Expect multiple rounds of queries. MAS will ask for clarifications on your tech stack, your banking arrangements, and your contingency plans. It’s common for applications to bounce back and forth several times. Having a local compliance consultant or lawyer experienced in fintech regulations can save you months of delays. They know the specific language MAS prefers and can anticipate follow-up questions.

Common Pitfalls and Recent Enforcement Trends

Why did MAS tighten the screws in 2025? High-profile failures played a big role. The collapses of Three Arrows Capital and Terraform Labs in 2022 shook confidence. Both had significant ties to Singapore, yet operated with limited oversight because they served mostly global clients. Regulators realized they couldn’t effectively supervise entities whose substantive activities happened outside the country. Hence, the push for stricter local accountability.

One major pitfall is underestimating the “fit and proper” test. MAS scrutinizes the background of everyone involved. If a director has a history of poor financial management or undisclosed conflicts of interest, the application may fail regardless of your technical strength. Another trap is ignoring data localization. While not always explicitly mandated for all data types, storing critical customer records locally simplifies audits and demonstrates commitment to the jurisdiction.

Also, beware of “shell” structures. Some firms try to set up a minimal presence in Singapore-just a desk and a director-to satisfy residency requirements while running operations elsewhere. MAS is cracking down on this. They require substantive economic activity. If your servers, support team, and decision-making happen in Dubai or London, why should Singapore regulate you? You need to show real operational substance here.

Strategic Considerations for Operators

So, is Singapore still worth it? Yes, but the bar is higher. Compared to jurisdictions like Switzerland, where capital requirements can reach millions of Swiss francs, Singapore’s SGD 100k-250k range is accessible for medium-sized players. Unlike the fragmented US approach, you get a unified national standard. And unlike China’s outright ban, you get a clear path to legitimacy.

However, the immediate implementation of the DTSP regime means no easy ride. Smaller operators often struggle with the upfront costs of compliance infrastructure. Larger exchanges welcome the clarity because it weeds out bad actors, creating a cleaner market for institutional investors. If you’re planning to enter, assess your runway. Can you afford 6-12 months of high burn rate before generating revenue? If not, consider partnering with an existing licensed entity initially, though this comes with its own contractual complexities.

Finally, keep an eye on regional competition. Hong Kong recently launched its own crypto licensing framework. While Singapore has a first-mover advantage, HK is aggressive in attracting talent and firms. The best strategy is to build a compliance-first culture from day one. Treat your license not as a hurdle, but as a trust signal to your users. In a post-FTX world, regulatory certainty is a competitive advantage.