🇸🇬Singapore's DTSP Regime: Why a Singapore-Registered Crypto Company Must Licence or Leave

What Part 9 Closed: the "Registered Here, Clients There" Structure

Until mid-2025 Singapore's crypto rulebook was strictly territorial. The Payment Services Act 2019 licenses digital payment token services provided in Singapore; the Securities and Futures Act 2001 catches tokens that are capital markets products; the Financial Advisers Act 2001 catches advice. A Singapore Pte Ltd serving only foreign customers fell outside all three — even though "Singapore-based" carried real commercial value, and FATF standards require a virtual asset service provider to be licensed at least in its jurisdiction of creation.

Part 9 of the Financial Services and Markets Act 2022 sat uncommenced for almost three years. MAS switched it on through the Financial Services and Markets (Digital Token Service Providers) Regulations 2025 (S 342/2025), with effect from 30 June 2025. The logic is inverted relative to ordinary licensing: you need the licence not because you operate in Singapore, but precisely because you do not, while remaining a Singapore person. This is not extraterritoriality in the usual sense — it is a refusal to let a Singapore registration exist without Singapore supervision.

MAS then went further than any European regulator has. Its clarification of 6 June 2025 states plainly: "MAS has set the bar high for licensing and will generally not issue a licence" — laundering risk in such models is higher, and MAS cannot supervise activity conducted entirely abroad. Without a licence, such providers must stop.

The Perimeter: Place of Business and the Singapore Corporation Test

The perimeter rests on two independent limbs of section 137 FSMA. The first, subsection (1): an individual or a partnership must not, from a place of business in Singapore, carry on a business of providing any digital token service outside Singapore without a licence. The second, subsection (3): a Singapore corporation — any body corporate formed or incorporated in Singapore, including an LLP — must not carry on such a business "whether from Singapore or elsewhere". The second limb is the radical one: it requires no office, no staff, no servers on the island. An entry in the ACRA register is enough.

"Place of business" is defined broadly in section 136 — any location in Singapore used for carrying on business, down to a movable kiosk; "permanent place of business" means each fixed location. In its response to consultation feedback of 30 May 2025 MAS added a functional test: in deciding whether the business is carried on "outside Singapore", it is relevant where front-office functions sit — sales, business development — and where the customers are.

Subsections 137(2) and 137(4) deserve separate attention. Where a person provides a token service alongside a primary business, it is presumed to carry on a secondary business of providing that service — and the presumption cannot be rebutted by proving the service is related or incidental to the primary business. The defence "it is a feature inside our app, not a product" is closed off by statute in advance.

The catalogue runs to ten items in Part 1 of the First Schedule: dealing, facilitating exchange, accepting and arranging transmission, inducing transactions, safeguarding a token or a digital token instrument (in substance, keys) where the provider has control, executing instructions on either, plus advice and research connected with the sale of tokens. Tokens are of two kinds: digital payment tokens and digital representations of capital markets products. MAS took utility and governance tokens outside the perimeter on 6 June 2025.

Borderline cases. An employee of a foreign-incorporated company working from Singapore under an employment contract does not, in itself, trigger a licensing requirement — MAS recorded this at paragraph 4.4 of the response to feedback. An independent contractor or sole proprietor providing the same services from a Singapore place of business is inside. Pure technical providers — data processing, IT security, authentication, networks, terminals — are excluded by Part 2 of the First Schedule, but only while they never come into possession of money or tokens; a developer who holds keys fails that condition. Holding companies and entities set up "solely for tax residency" are the honest grey zone: a respondent asked MAS exactly that question (paragraph 3.5), and MAS's answer (paragraph 3.10) restated the statutory test without granting such structures a safe harbour or confirming that they are caught.

Who Is Outside: PSA, SFA, FAA and the Second Schedule

The principal carve-out is section 137(5)(a). No DTSP licence is required from a person who, for the relevant activity, is required to hold a licence, approval or recognition, or is exempted from one, under the SFA, the FAA or the PSA. The consequence inverts intuition: a full domestic-market licence covers the global business too. A Singapore major payment institution with a DPT service may serve foreign clients with the same activity without a separate DTSP licence, while a company with no Singapore clients cannot. MAS confirmed in the June clarification that licensed providers "may also provide services to customers outside of Singapore", with no change to what they may do.

The Second Schedule adds a narrow list: public statutory corporations; lawyers, law practices and public accountants, but only where the token service is "solely incidental" to the practice; the Official Assignee, Official Receiver and Public Trustee; liquidators, receivers and judicial managers of companies, LLPs, partnerships and VCCs. Holding companies, family offices, group treasury vehicles and development studios are not on that list. The marketing side is closed symmetrically: section 139 prohibits holding yourself out as a licensee, or as a person carrying on an outbound token business from Singapore, with the same penalties.

The Licence MAS Promised Not to Grant

The formal requirements are moderate and deliberately flat. A permanent place of business or registered office in Singapore where books and records can be securely held, with at least one person present — Notice FSM-N32 requires a minimum of 10 days a month and eight hours on each. An executive director resident in Singapore for a corporation; a resident partner for a partnership. Capital, per the Guidelines on Licensing for DTSPs: S$250,000 of base capital, aggregate capital contribution or cash deposit with MAS depending on the vehicle — flat, with no scaling by size, plus a buffer covering six to twelve months of operating expenses. A compliance officer at management level based in Singapore, either as an independent local function or as group compliance support with demonstrable local oversight. An annual audit under section 158 FSMA plus a standing internal audit function. The application must carry a legal opinion from a reputable law firm on whether the services are regulated; a penetration test with all high-risk findings remediated before grant; and, after in-principle approval, an external auditor assessment of technology and cyber risk. The annual fee is a flat S$10,000.

The ongoing stack is the full FSM-N27 to N33 set: AML/CFT with mandatory CDD extending to customers onboarded before the licence; restricted third-party reliance (licensed neobanks are excluded from the definition of "third party"); correspondent-account measures; a prohibition on bearer negotiable instruments and on cash payouts of S$20,000 or more; value-transfer requirements aligned to the FATF standard with originator verification by the ordering institution; suspicious activity and fraud reporting within five working days; periodic returns; technology risk management and cyber hygiene. What those obligations must physically look like inside a licensed entity is set out in the compliance stack of a licensed operator.

And now the substance. The admission bar appears in paragraphs 2.2 and 3.8 of the response to feedback as "extremely limited circumstances": the applicant must show a business model that makes economic sense and explain why it does not intend to serve Singapore despite being Singaporean; be already regulated and supervised against FSB, IOSCO and FATF standards in every jurisdiction where it operates; and raise no MAS concerns about its structure. There is no transitional period — instead MAS gave a four-week commencement notification so that existing DTSPs could suspend or cease the activity by 30 June 2025.

Practice matches the declaration. As of 13 August 2026 the MAS Financial Institutions Directory contains no sector and no licence type for DTSPs, and there is no publicly announced grant. The review procedure is equally discouraging: an application affected by major restructuring or a change of key personnel goes on a six-month, non-extendable hold; missing a response deadline means deemed withdrawal; and resubmission without remediating earlier concerns is, in MAS's own words, "likely to result in rejection".

The penalty is almost always reported inaccurately. Section 137(6) distinguishes between offenders: for an individual, a fine of up to S$125,000 and/or imprisonment of up to three years, plus up to S$12,500 per day for a continuing offence after conviction; for any other person, a fine of up to S$250,000 plus up to S$25,000 per day. There is no prison term for a company, and "S$250,000 and three years" is a press conflation of two separate limbs. Breach of a licensee's own obligations under section 138(9) carries up to S$100,000 and S$10,000 per day.

Four Regimes, One Regulator

The SPI thresholds come from section 6(5) of the PS Act: S$3m in monthly transactions for any one payment service, S$6m across two or more, S$5m of outstanding e-money; above those, only an MPI licence will do. Capital and security requirements follow the Guidelines on Licensing for neobanks as updated on 8 October 2025. Adjacent tracks — fund management and the VCFM regime — sit under the SFA and fall outside the DTSP perimeter; detail in fund management in Singapore.

For the Client: Where Your Tokens Actually Sit

Since 30 June 2025 the "Singapore company" flag has stopped being a quality signal on its own. It now means one of two things: either the counterparty holds a PSA or SFA licence, or it is conducting unlicensed activity — there is no third state left for a Singapore entity with crypto services. The check takes five minutes: the MAS Financial Institutions Directory for the licence, the Investor Alert List for the negative signal. The second is neither a ban nor an accusation but a register of persons who may be wrongly perceived as MAS-supervised; in June 2026 Bybit appeared on that list, and in July 2026 Bitget stated publicly that it holds no MAS licence or registration of any kind.

What a PSA licence gives an asset holder. Since 4 October 2024 — six months after the PS Act expansion of 2 April 2024 — DPT service providers must segregate customers' tokens in a trust account for the customers' benefit, keep proper records and operate controls protecting those assets. The same expansion brought DPT custody, facilitation of transfers and exchange without possession, and cross-border transfers that never touch Singapore into the perimeter. Retail gets a further layer from 23 November 2023: a customer risk-awareness assessment, no trading incentives, no financing, margin or leverage, no locally issued credit cards, and crypto excluded from net-worth calculations, phased in from mid-2024.

What the licence does not give. This is not a deposit and there is no deposit insurance — the protection is segregation plus the discipline of the individual institution, and that discipline gets tested. On 20 May 2026 MAS revoked the MPI licence of Bsquared Technology with effect from 14 May: a 2025 onsite inspection found significant weaknesses in risk management and conflict-of-interest policy, breaches of the outsourcing guidelines and, separately, false or misleading information supplied to MAS repeatedly from the licence application onwards. The firm had been licensed on 1 January 2025; no customer assets remained at revocation. The lesson for a private holder is to check not only that a licence exists but what its history looks like, and to spread large positions — see crypto for private wealth.

The third layer is transparency. The CARF Regulations 2026 took effect on 11 August 2026 alongside the IRAS e-Tax Guide; Singapore intends to begin Crypto-Asset Reporting Framework exchanges with partner jurisdictions from September 2028. A Singapore venue is no longer quiet by default — which matters for families whose token positions sit alongside reportable accounts elsewhere.

For the Builder: Four Routes and What Each Costs

Route one — enter the PSA or SFA perimeter. The only route MAS regards as normal. SPI below the thresholds, MPI above; the DPT service covers foreign clients too. The price is a Singapore market in the business model, local presence, segregation of client assets and the retail restrictions. A working example is FOMO Pay, an MPI with a DPT service built around merchant and crypto flows.

Route two — the DTSP licence. Formally available: S$250,000 of capital, S$10,000 a year, a resident executive director, a Singapore-based compliance officer, a legal opinion, a penetration test, an auditor assessment. In practice a bar described as "extremely limited circumstances", with no known grant in more than a year. No launch plan should depend on it.

Route three — change the registration. Where most groups get it wrong. Relocating the team is not enough: subsection 137(3) catches a Singapore corporation wherever it operates from. To leave the perimeter, no Singapore entity may remain in the service chain — transfer of registration out, liquidation or strike-off, novation of contracts to a foreign entity — while checking whether anyone still in Singapore now constitutes a place of business in their own right. Departures have gone mainly to the UAE and Hong Kong; the choice among UAE regulators is mapped in the UAE licence map, the passportable European alternative in the MiCA CASP licence guide.

Route four — stop the token services and keep the company. Development, IP holding and managing your own treasury are not services to third parties. The constraint is the presumption in subsections 137(2) and 137(4): any token feature "inside the product" is presumed a separate business, and the statute forbids rebutting that by showing it is incidental. What substance a Singapore company still needs afterwards is covered in the Singapore company guide.

What not to do in any scenario is rent someone else's perimeter: the "unlicensed operator under a licensee's umbrella" structure breaks against the secondary-business presumption and against section 139 on holding out. Why such arrangements fail systematically is set out in licence for rent and in the regulatory perimeter trends overview.

The Market in 2025–2026: an Exodus MAS Did Not See

The reaction was fast and loud. On 11 June 2025, Bloomberg reported that unlicensed venues were preparing to leave; over the summer Bitget and Bybit moved hundreds of roles, mainly to Dubai and Hong Kong; and headlines about "S$250,000 and jail" travelled worldwide. MAS itself sized the problem very differently in the 6 June release: "Based on available information, we are aware of a very small number of such providers" — it said it had already contacted potentially affected persons and discussed an orderly wind-down. Nobody has publicly reconciled that assessment with the market narrative, and as of August 2026 there are still no verifiable figures for how many companies actually left.

The domestic market did not shrink. As of 13 August 2026 the MAS directory lists 38 institutions carrying on a digital payment token service, among them Coinbase, OKX, Circle, Paxos, Ripple, Revolut, PayPal, Upbit, Sygnum, Anchorage, BitGo, HashKey and both StraitsX issuance entities. The point of the two-regime pairing is visible here: Singapore did not expel the crypto industry; it closed exactly one model — registration here, clients there.

Stablecoins remain the main unkept promise. MAS finalised its single-currency stablecoin framework on 15 August 2023: a peg to the Singapore dollar or a G10 currency, requirements on the composition, valuation, custody and audit of reserves, redemption at par within five business days, and the right to be labelled an "MAS-regulated stablecoin". As of August 2026 it has not been legislated: in November 2025 MAS Managing Director Chia Der Jiun said draft legislation was being prepared, focused on reserve backing and redemption reliability, but no text exists. Issuers therefore operate on PSA licences — Paxos Digital Singapore received full MPI approval on 2 July 2024. The contrast with Hong Kong, which has moved issuance into a dedicated statute, is drawn in the reviews of stablecoin regimes across Asia and of stablecoins as an asset class.

Three things are expected before 2028: the stablecoin statute, finalisation of the prudential treatment of cryptoassets for banks after consultation P009-2026, and the first wave of CARF exchanges. MAS has announced no separate custody regime outside the PSA — custody remains a regulated payment service with trust segregation, and on the evidence of the 2026 consultation agenda that is a design choice rather than a gap.

Family Offices and Proprietary Crypto

MAS has issued no direct Part 9 guidance for single family offices, so the boundary must be stated as legal analysis rather than a regulator's safe harbour. The statute catches a business of providing token services to other persons. Managing one family's proprietary wallets is therefore different from a Singapore service company charging offshore family vehicles for custody, execution or advice. The latter service link can fall within the DTSP perimeter even when every vehicle belongs to the same family.

This also sits beside, rather than inside, the 13O/13U family-office regime: crypto is not a designated investment for the incentive thresholds. A structure should test the fund-management exemption, the DTSP service perimeter and tax treatment separately instead of treating “family office” as a blanket exemption.

Stablecoins Are a Separate Regulatory Question

Part 9 governs outbound digital-token services; it is not Singapore's stablecoin-issuer regime. MAS finalised its single-currency stablecoin framework in August 2023, with reserve, redemption and disclosure requirements for SGD or G10 pegs. Issuance, custody, exchange and an offshore service company can therefore engage different rules. Map the activity first and only then choose between PSA, SFA/FAA and FSMA Part 9.