# Singapore's PSA Payment Licences: Money-Changing, SPI, MPI and the Seven Regulated Services

> How MAS sorts payment firms into three licence classes, what the 3/6/5 million SGD thresholds really measure, and what safeguarding, capital and security actually cost.

Author: Dana Berzeg — Attorney-at-law, Family Office (https://wiki.private.law/en/authors/berzegova)
Last modified: 2026-08-14T13:14:00.000Z
Canonical: https://wiki.private.law/en/singapore-psa-payments
Topics: banking
Jurisdictions: singapore
Product tags: neobank, neobank, compliance, banking, crypto
Semantic tags: neobank, neobank, compliance, banking, crypto

---

## Three Classes, Seven Services: How the PS Act Is Built

The [Payment Services Act 2019](https://sso.agc.gov.sg/Act/PSA2019) came into force on [28 January 2020](https://www.mas.gov.sg/news/media-releases/2020/payment-services-act-comes-into-force), replacing two earlier statutes on money-changing and remittance and on payment systems oversight. The design is deliberately activity-based rather than product-based: MAS does not license "a fintech", "a wallet" or "an exchange" — it licenses seven named payment activities. A single licence covers as many of them as the applicant has justified and paid for; adding an eighth product is not a new licence but a variation of the existing one under section 7.

There are three licence classes, set out in [section 6\(2\)](https://sso.agc.gov.sg/Act/PSA2019?ProvIds=pr6-): a money-changing licence, a standard payment institution \(SPI\) licence and a major payment institution \(MPI\) licence. What separates them is not the menu of permitted services but scale. Money-changing is a narrow licence for buying and selling foreign currency notes and nothing else — to add anything, the holder must change class. SPI and MPI both permit all seven services, but the SPI lives under a volume ceiling, while the MPI has no ceiling and pays for that with security, safeguarding and double the capital.

That structure drives the conclusion advisers rarely state plainly: choosing between SPI and MPI is not a matter of ambition but of forecasting. The [Guidelines on Licensing for neobanks PS-G01](https://www.mas.gov.sg/regulation/guidelines/ps-g01-guidelines-on-licensing-for-payment-service-providers), as revised on 8 October 2025, require an applicant to pick a licence that "accommodates its needs over a reasonable timeframe", and require an SPI approaching the thresholds to start the variation process well in advance and to be able to meet MPI requirements at the point of application. There is no retroactive upgrade.

| **Service \(First Schedule, Part 1\)** | **What it means in practice** | **Counts toward SPI thresholds** |
| --- | --- | --- |
| Account issuance service | Issuing a payment account to a person in Singapore and operating it \(deposits, withdrawals\), excluding transfers themselves | Yes — except e-money account issuance |
| Domestic money transfer service | Transfers where both payer and payee are in Singapore | Yes |
| Cross-border money transfer service | Accepting money in Singapore for transmission abroad and receiving money from abroad; since 2024, also arranging transfers between two foreign points | Yes |
| Merchant acquisition service | Accepting and processing a transaction for a merchant where the merchant operates in Singapore or the contract is formed here | Yes |
| E-money issuance service | Issuing electronic money for making payment transactions | Separate float threshold |
| Digital payment token service | Dealing in DPTs, facilitating exchange, transmission, inducing transactions, custody of tokens and keys | Yes |
| Money-changing service | Buying and selling foreign currency notes | No |

## Thresholds: Where the SPI Ends and the MPI Begins

The thresholds sit in section 6\(5\) and are more intricate than the usual summary suggests. The first limb, 6\(5\)\(a\), takes the average over a calendar year of the total value of all payment transactions accepted, processed or executed in one month — measured separately for each of five services \(account issuance other than e-money accounts; domestic money transfer; cross-border money transfer; merchant acquisition; DPT\). The threshold is S$3 million for any one of them, or S$6 million across two or more.

The second and third limbs cover electronic money and measure a float rather than a flow. Limb \(b\): for e-money account issuance, the yearly average of the daily total of e-money held in accounts issued to persons the licensee has determined to be Singapore residents, plus — and this matters — e-money issued in Singapore to anyone the licensee has *not* determined to be resident outside Singapore. Limb \(c\): for e-money issuance, the yearly average of the daily total of specified e-money issued. Both sit at S$5 million. In other words, an unclassified customer counts as Singaporean by default: the burden of classification falls on the operator.

Money-changing does not enter the threshold arithmetic at all — a currency exchange of any size stays outside the SPI calculation. And one counter-intuitive detail: the test is a calendar-year average, not a peak month. One anomalous December does not breach it; steady growth through the year does.

Section 6\(6\), read with [regulation 6\(2\) of the Payment Services Regulations](https://sso.agc.gov.sg/SL/PSA2019-RG2), governs what happens on breach: the licensee has 30 days after the relevant date to apply for a change of class in Form 2. While those 30 days run — and thereafter until MAS approves, refuses, or the applicant withdraws — the threshold rule does not apply to it. This is a procedural bridge, not an amnesty: if the application is refused, the operator is retroactively out of class, with the consequences in section 6\(14\), where MAS may restrict or suspend operations.

| **Parameter** | **Money-changing** | **SPI** | **MPI** |
| --- | --- | --- | --- |
| Permitted services | Currency exchange only | All seven | All seven |
| Volume ceiling | None | S$3m/month one service, S$6m two or more, S$5m e-money float | None |
| Base capital | Not prescribed | S$100,000 | S$250,000 |
| Security lodged with MAS | None | None | S$100,000 or S$200,000 |
| Safeguarding of customer money | No | No \(save where prescribed\) | Yes, under section 23 |
| Applicant form | Any, including sole proprietor | Company or foreign corporation | Company or foreign corporation |
| Application fee | S$500 | S$1,000 per service | S$1,500 per service |
| Annual fee | S$1,500 | S$5,000 per service | S$10,000 per service |
| Holders on the MAS register, 13.08.2026 | 231 | 13 | 246 |

## Capital, Security and What MAS Tests at Entry

Base capital is set by regulations 8 and 12 of the PS Regulations: S$100,000 for an SPI and S$250,000 for an MPI — or equivalent net head office funds for a foreign company operating through a Singapore branch. The obligation is twofold: it must be met at grant and maintained for the life of the licence, with immediate notification to MAS on any failure under section 6\(13\). The definition is narrow: paid-up ordinary share capital plus irredeemable non-cumulative preference shares plus unappropriated profit, less interim loss and declared dividends. Shareholder loans do not count.

The regulation figure is not a budget. Paragraph 3.1.5 of PS-G01 sets the rule of thumb that actually determines the size of the commitment: base capital should cover at least 6 to 12 months of the applicant's operating expenses. For a ten-person team in Singapore that is an order of magnitude above the formal S$250,000.

Security is a second, separate sum, and only for MPIs. Under section 22 and regulation 13 it is S$100,000 where the average over the current calendar year of monthly transaction value does not exceed S$6 million for each payment service provided, and S$200,000 in all other cases. It takes the form of a cash deposit with MAS or a bank guarantee in the prescribed format, lodged before business commences. Legally the construct is strong: the security cannot be attached or levied upon, is deemed not to form part of the licensee's property on insolvency, and MAS may enforce it to pay out customers. On exit, an MPI has 45 days to file a closure certificate from its auditors confirming that customer money reached its intended recipients.

The entry criteria for SPI and MPI are listed in section 6\(9\) and expanded in section 3 of PS-G01. The applicant must be a company or a corporation formed outside Singapore. It needs a permanent place of business or registered office in Singapore where books and records can be securely held; [Notice PSN07](https://www.mas.gov.sg/regulation/notices/psn07-notice-on-conduct) requires a human being present there for at least 10 days a month and at least eight hours on each of those days. At least one executive director must be a Singapore citizen or permanent resident. Fit and proper under FSG-G01 applies to the company itself, its directors, CEO, shareholders and employees — and the onus of proof sits with the applicant, not with MAS. Key individuals must be competent specifically in payments. Add compliance arrangements per Appendix 2, independent audit, the annual statutory audit under section 37, and, for online services, a penetration test with all high-risk findings remediated before the licence is granted.

Two requirements arrived later and now filter out the most applicants. First, a legal opinion from a law firm experienced in the PS Act must accompany every new SPI and MPI application, and every variation adding a DPT service. Second, a new DPT applicant must appoint a qualified external auditor to conduct an independent assessment of its AML/CFT and consumer protection policies and controls — the report is filed with Form 1 and must have been signed off within three months of submission.

Then comes the standing load. [Notice PSN04](https://www.mas.gov.sg/regulation/notices/psn04-notice-on-submission-of-regulatory-returns) requires monthly returns per service within 30 days of month-end, plus half-yearly and annual forms; MPIs in domestic and cross-border transfer, acquiring and e-money also file a monthly Form 8. The audit report in Form 4 is due within six months of financial year-end \(regulation 20\). AML/CFT sits in [Notice PSN01](https://www.mas.gov.sg/regulation/notices/psn01-aml-cft-notice---specified-payment-services) for payment services and [Notice PSN02](https://www.mas.gov.sg/regulation/notices/psn02-aml-cft-notice---digital-payment-token-service) for DPT, both in their 30 June 2025 editions effective 1 July 2025. Customer disclosures live in [Notice PSN08](https://www.mas.gov.sg/regulation/notices/psn08-notice-on-disclosures-and-communications). What all of this must physically look like inside the firm is set out in the [compliance stack for a licensed operator](https://wiki.private.law/en/compliance-stack); getting the licensee itself banked is a separate exercise, covered in [banking for licensed operators](https://wiki.private.law/en/banking-for-msb).

## Safeguarding: The Structure That Actually Holds Customer Money

The obligation to segregate customer funds falls on MPIs and is set by section 23. It splits into two regimes with different urgency. For domestic money transfer, cross-border money transfer and merchant acquisition, safeguarding must happen no later than the next business day after money is received. For e-money issuance, it applies from the moment of receipt — no window at all.

There are three methods, and each requires an external institution. First, an undertaking from a safeguarding institution to be fully liable to the customer for the money. Second, a guarantee from such an institution for the amount. Third, deposit into a trust account maintained with such an institution. Who qualifies as a safeguarding institution is defined in section 23\(14\) with regulations 14 and 15: a bank in Singapore, plus — as prescribed financial institutions — a merchant bank under the Banking Act 1970 and a finance company under the Finance Companies Act 1967; for guarantees, a financial guarantee insurer is added.

The mechanics carry obligations that are routinely underpriced at the budgeting stage. Before obtaining an undertaking or opening the account, the MPI must itself assess the suitability of the safeguarding institution, repeat that assessment annually, and keep the grounds on record for at least five years. The bank must acknowledge in writing that the account is designated as a trust account, held separately from the licensee's own money, and that it cannot exercise any right of set-off against it for debts the MPI owes the bank. The customer must be told in writing that the money sits in trust, whether it will be commingled with other customers' money, what the commingling risks are, and what happens if the safeguarding institution itself becomes insolvent. Under regulation 14\(1\)\(b\) the undertaking must be unconditional — a single carve-out in the bank's letter breaks the structure.

The practical meaning is straightforward: money in an MPI account is not a deposit, no deposit insurance applies, and what protects it is not the state but the quality of three things — the bank contract, the operator's discipline and MAS supervision. European and UK regimes run on the same logic; the comparison sits in [correspondent banking and safeguarding](https://wiki.private.law/en/correspondent-banking-safeguarding).

## DPT Inside the PSA: Retail Limits, Custody and the Travel Rule

DPT is one of the seven services rather than a separate licence, but it carries by far the heaviest load. On 23 November 2023 MAS finalised its [retail measures](https://www.mas.gov.sg/news/media-releases/2023/mas-strengthens-regulatory-measures-for-digital-payment-token-services), phased in from mid-2024: a provider must assess a retail customer's risk awareness before granting access, must not offer incentives to trade, must not provide financing, margin or leverage, must not accept locally issued credit cards, and must limit the weight of crypto in a customer's net worth calculation. On top of that: disclosure of conflicts of interest, a published token listing policy and a complaints procedure.

Since 4 October 2024, Division 2A of the regulations \(18A–18J\) has applied: customer assets are segregated and held on trust for customers, separate books and records are maintained, and systems and controls must protect the integrity and security of those assets. This is Singapore's only digital-asset custody regime — MAS has not introduced a standalone custody statute, and judging by the 2026 consultation agenda that is a deliberate design choice rather than a gap.

The Travel Rule for DPT sits in paragraph 13 of PSN02 and is stricter than its fiat counterpart: there is no de minimis. On any value transfer, the ordering institution must pass on the originator's name and account number or unique transaction reference, plus the beneficiary's name and account; above S$1,500 the data set expands. Below S$1,500 a simplified set is permitted for transfers to an intermediary institution in Singapore — but with an obligation to supply the full data within three business days of a request from MAS and immediately on a law enforcement request. How this standard differs across jurisdictions, and where it breaks, is covered in [the Travel Rule](https://wiki.private.law/en/travel-rule).

This is also where the boundary with the neighbouring regime runs. A DPT service is licensed under the PSA because it is provided *in* Singapore. The [DTSP regime under Part 9 of the FSMA 2022](https://wiki.private.law/en/singapore-dtsp), live since 30 June 2025, is the mirror image: it catches a Singapore person providing token services exclusively *outside* Singapore. The two do not overlap — [section 137\(5\)\(a\) of the FSMA](https://sso.agc.gov.sg/Act/FSMA2022?ProvIds=pr137-) expressly exempts anyone required to be licensed under the PS Act. The practical conclusion inverts the usual assumption: a full PSA licence covers overseas customers too, while the "incorporated here, customers only there" structure needs a separate licence that MAS has publicly said it will grant only in extremely limited circumstances.

## The Perimeter After the 2021 Amendments

The Payment Services \(Amendment\) Act 2021 was passed in 2021 but commenced in stages, and only [from 2 April 2024](https://www.mas.gov.sg/news/media-releases/2024/mas-expands-scope-of-regulated-payment-services), taking effect on 4 April. The perimeter expanded to cover three constructs. First, custodial services for DPTs. Second, facilitating the transmission of DPTs between accounts and facilitating the exchange of DPTs even where the provider never comes into possession of money or tokens — which closed the "we are only a matching engine" model. Third, and the most underestimated, facilitating cross-border money transfer between different countries even where money is neither accepted nor received in Singapore. A Singapore operator arranging a transfer from Indonesia to Malaysia is now inside the perimeter, though not a single dollar touches the island.

The transition window was short and had three steps: notify MAS within 30 days, file a licence application within six months of 4 April 2024, and attach an attestation report by a qualified external auditor covering the business and AML/CFT compliance within nine months of that date. Anyone who missed the steps had to cease. The window still runs on an individual basis: the [list of entities that notified MAS](https://www.mas.gov.sg/regulation/payments/entities-that-have-notified-mas-pursuant-to-ps-amend-act-2021-stpr), as at 11 August 2026, holds six companies — 8Hexa Financial, Acheron, Aspire FT, Bruc Bond, DBS Digital Exchange and EDXM Global. MAS warns explicitly that these entities are neither licensed nor supervised for the expanded-scope services, and that their customers do not have PS Act protections. One of them is the platform profiled separately in [Aspire](https://wiki.private.law/en/aspire).

| **Date** | **Milestone** |
| --- | --- |
| 28 January 2020 | PS Act comes into force; the MCRBA and PSOA are repealed |
| 23 November 2023 | Retail measures for DPT providers finalised |
| 4 April 2024 | 2021 amendments live: DPT custody, facilitating exchange and transmission, cross-border transfer without money passing through Singapore |
| 4 May 2024 | Notification deadline for entities caught by the expanded perimeter |
| 4 October 2024 | Segregation and trust for customer DPTs \(Division 2A of the regulations\) |
| 16 December 2024 | Shared Responsibility Framework: MPIs alongside full banks |
| 4 January 2025 | Deadline for the external auditor attestation report for transitional applicants |
| 30 June 2025 | Neighbouring DTSP regime goes live \(Part 9 FSMA 2022\); PSN01 and PSN02 editions published, effective 1 July |
| 8 October 2025 | Revised PS-G01: legal opinion and external auditor assessment for DPT |
| November 2025 | MAS announces it is drafting stablecoin legislation |
| 6 May 2026 | FATF publishes its Mutual Evaluation Report on Singapore |
| 14 May 2026 | Bsquared Technology's MPI licence revoked |
| To 2028 | Expected: stablecoin legislation, tokenised MAS bills pilot, PayNow Generation 2 |

## The Register in Numbers and the Real Economics

The [MAS Financial Institutions Directory](https://eservices.mas.gov.sg/fid), as at 13 August 2026, returns 507 entries for the Payments sector: 246 major payment institutions, 231 money-changing licensees, 13 standard payment institutions, 4 credit and charge card licensees, 6 operators and 6 settlement institutions of designated payment systems, and 1 licensed credit bureau. The 246-to-13 ratio is the single most telling number in the regime: the SPI class is barely used. The arithmetic explains it — S$3 million a month is cleared by any functioning B2B payments business within its first year, and a licence variation costs both time and money, so serious applicants go straight to MPI.

The MPI breakdown by activity: cross-border money transfer 218, domestic money transfer 144, merchant acquisition 98, account issuance 88, e-money issuance 76, digital payment token 38, money-changing 35. Among SPIs: cross-border 11, domestic 7, account issuance 6, acquiring 6, e-money 4, money-changing 2 — and DPT, none at all. In other words, DPT exists in Singapore only at MPI level. Holders range from [Airwallex](https://wiki.private.law/en/airwallex) and Adyen to [FOMO Pay](https://wiki.private.law/en/fomo-pay-dpt-payment-services), which combines merchant flows with DPT.

MAS does not publish rejection statistics, but a [written parliamentary reply of 5 August 2026](https://www.mas.gov.sg/news/parliamentary-replies/2026/written-reply-to-parliamentary-question-on-virtual-asset-service-providers) supplies a rare conversion rate: "Out of close to 300 applications for licences, there are currently 37 licensed DPTSPs. Most of the other applications have been rejected or were withdrawn when the applicants realised they could not meet our requirements." That is roughly one in eight. Note the discrepancy: the register in the same week shows 38 institutions carrying DPT activity against the reply's 37. The one-unit gap has not been publicly explained and most likely reflects different snapshot dates.

Direct payments to the state are modest. Application fees under the Schedule to the PS Regulations: S$500 for money-changing, S$1,000 per service for an SPI, S$1,500 per service for an MPI, with account issuance free when combined with two or more services. Annual fees: S$1,500 for money-changing, S$5,000 per service for an SPI, S$10,000 per service for an MPI, pro-rated in the year of grant. Upgrading from SPI to MPI costs S$500 per service; removing a service is free. An MPI running acquiring, cross-border transfer and e-money pays S$30,000 a year.

The real budget lies elsewhere: base capital with a 6–12 month expense buffer \(for an MPI, rarely below S$1–1.5 million in total\), security of S$100,000–200,000, the legal opinion, the external auditor assessment for DPT, the penetration test, salaries for a resident executive director and a compliance officer, the annual audit and monthly reporting. Renting someone else's perimeter to avoid this is particularly dangerous in Singapore: section 8 of the PS Act separately penalises holding out as a licensee, and why such arrangements fail systematically is set out in [licence for rent](https://wiki.private.law/en/license-for-rent).

## What a PSA Licence Buys and Where Its Protection Stops

The first thing a licence buys is verifiability. Presence on the MAS register, the licence class and the list of permitted services are all public, and checking them is the only correct way to vet a counterparty. Marketing copy saying "MAS-regulated" means nothing on its own — MAS administers dozens of regulated statuses, and the Investor Alert List exists precisely for entities that could be mistaken for supervised ones.

The second is safeguarding, with a caveat. Segregation of customer money is mandatory only for MPIs and only across four services: the two transfer services, acquiring and e-money. An SPI generally has no section 23 obligation at all. Which makes "what class is your provider" not a formality but a direct question about whether your money sits in trust or in a general corporate account. In neither case is it a deposit or insured: on the operator's insolvency you have a claim on the trust account and on the security lodged with MAS, not on a compensation scheme.

The third layer is consumer protection, and it is recent. The Shared Responsibility Framework has applied since 16 December 2024 and, per the [MAS guidelines](https://www.mas.gov.sg/regulation/guidelines/guidelines-on-shared-responsibility-framework), covers full banks and major payment institutions: in a phishing scenario where the institution breached its duties, the payout to the victim is allocated along the chain of responsibility. The E-Payments User Protection Guidelines run in parallel for unauthorised transactions.

What a licence does not buy is the quality of the specific institution. On 27 June 2025 MAS [imposed composition penalties totalling S$960,000 on five MPIs](https://www.mas.gov.sg/regulation/enforcement/enforcement-actions/2025/mas-imposes-composition-penalties-against-five-major-payment-institutions) licensed for cross-border transfers: Remsea S$280,000, Arcade Plaza Traders S$260,000, J-Dee S$170,000, Mobile Community Tech S$140,000, OxPay SG S$110,000 — all for PSN01 breaches, including failure to include originator information in payment messages. On 14 May 2026 MAS [revoked the MPI licence of Bsquared Technology](https://www.mas.gov.sg/news/media-releases/2026/mas-revokes-the-major-payment-institution-licence-of-bsquared-technology-pte-ltd) for risk management weaknesses, outsourcing guideline breaches and providing MAS with false or misleading information from the licence application onwards. Check not just that a licence exists, but its history: [MAS publishes quarterly enforcement summaries](https://www.mas.gov.sg/news/media-releases/2026/key-enforcement-actions-taken-by-mas-in-q2-2026) that take five minutes to read. This is also the backdrop to the FATF's [2026 Mutual Evaluation Report](https://www.fatf-gafi.org/en/publications/Mutualevaluations/mer-singapore-2026.html) of 6 May 2026, which placed Singapore in regular follow-up while noting that its enforcement action count remains relatively low.

## The Application Route: Timing and Why Applications Fail

The process is described in Appendix 5 to PS-G01 and is built so that the applicant controls the clock only partly. Time starts running not on filing but on assignment of a case officer — and MAS warns openly that assignment may not happen immediately. Then come rounds of information requests and an interview with key management and the compliance officer, where one detail breaks the conventional advisory model: consultants, external counsel and any third parties are not permitted to attend. The team answers for itself.

MAS publishes no service standard, but it does publish the rules that stretch the timeline. Missing a response deadline means the application is deemed withdrawn. Major corporate restructuring, a change of key personnel at CEO, CFO, CRO or CCO level, or a material change to the business model entitles MAS to place the application on hold — for six months, non-extendable; fail to complete the change in that window and withdrawal is recommended. Resubmitting without remediating previously raised concerns is, in the regulator's own words, "likely to result in rejection". A realistic horizon for an MPI is a year or more from the start of preparation to grant, and that assumes a clean structure.

The failure modes read straight off the guidelines. A grossly incomplete or significantly deficient submission — MAS reserves the right to reject it outright. Key individuals unable to answer interview questions clearly. A resident director with no real time or involvement: "time commitment the relevant persons have for the entity in Singapore" is named explicitly as a fit-and-proper factor. An unconvincing source of capital, or any adverse reputation of the group in relation to financial crime. A compliance function that exists only on paper. And a category the Bsquared case made tangible — misleading information: section 94 of the PS Act makes it a criminal offence.

Finally, the competing routes. If the business is managing other people's money rather than moving it, the PSA is the wrong statute: see the [VCFM licence](https://wiki.private.law/en/vcfm) and the broader decision tree in [fund management in Singapore](https://wiki.private.law/en/singapore-fund-management-license), both of which live under the Securities and Futures Act. If the customers are exclusively offshore and the product is crypto, it is the [DTSP regime](https://wiki.private.law/en/singapore-dtsp), not the PSA. If the requirement is an Asian hub that is cheaper and faster, the comparison point is Hong Kong's [MSO licence](https://wiki.private.law/en/mso-license-hk), where the entry bar is visibly lower and supervisory density lighter. And if the product is stablecoin issuance, MAS [finalised its framework on 15 August 2023](https://www.mas.gov.sg/news/media-releases/2023/mas-finalises-stablecoin-regulatory-framework) but had not translated it into legislation as at August 2026: issuers operate under MPI licences with e-money or DPT services while the promised bill remains in drafting — context in [stablecoins](https://wiki.private.law/en/stablecoins).

> 🍓 The PS Act licenses activity, not product: three licence classes and seven services, with class determined purely by scale. The SPI thresholds are S$3 million of monthly volume in one service, S$6 million across two or more, and S$5 million of e-money float, all measured as a calendar-year average; a breach gives 30 days to apply for a change of class. The MAS register as at 13 August 2026 shows 246 MPIs against 13 SPIs — the SPI class is effectively dead and not worth planning around. Vetting a counterparty turns on two facts: its licence class, because section 23 safeguarding binds only MPIs and only across four services, and its enforcement history — across 2025–2026 MAS fined five MPIs S$960,000 and revoked one licence. The project budget runs not from the fees \(S$10,000 a year per service\) but from base capital with a 6–12 month expense buffer, S$100,000–200,000 of security, the legal opinion and the external auditor assessment for DPT. The DPT conversion rate is 37 licences from close to 300 applications.

## Q/A

### **SPI or MPI when there is no volume yet**

Model the next 12–18 months, not today's run rate. The SPI threshold is a calendar-year average of monthly volume: S$3 million in one service or S$6 million across two or more. Any functioning B2B payments business clears that in its first year, and a variation is a fresh application with fresh fees and a fresh wait — and PS-G01 requires the applicant to be able to meet MPI requirements at the point of filing the variation. The register confirms the pattern: 246 MPIs against 13 SPIs as at 13 August 2026. The SPI only makes sense for a niche model whose volume is capped by design.

### **Is a PSA licence needed when every customer is outside Singapore**

If the service is provided in Singapore, yes — the customers' nationality does not change that. If a Singapore company provides crypto services exclusively outside Singapore, that is no longer the PSA but the DTSP regime under Part 9 of the FSMA 2022, live since 30 June 2025. Section 137\(5\)\(a\) of the FSMA exempts anyone required to be licensed under the PS Act, so a PSA licence holder serves overseas customers without a second licence, while a company with no Singapore customers cannot. Separately: since 4 April 2024 the PSA perimeter covers facilitating cross-border transfers between two foreign countries even where money never passes through Singapore.

### **What actually protects money held with a Singapore payment operator**

Section 23 segregation and the security lodged with MAS — but only at MPIs and only for domestic and cross-border transfer, acquiring and e-money. The money must be unconditionally protected by a bank undertaking or guarantee, or sit in a trust account with no bank set-off for the operator's debts, and the S$100,000–200,000 security is deemed outside the licensee's estate on insolvency. None of this is a deposit or deposit insurance. An SPI generally has no safeguarding duty at all, which is why the first question to a counterparty is not "are you licensed" but "in which class, and for which services".

### **How long an MPI licence really takes and what it costs**

MAS publishes no timeline. What it does publish: the clock starts on assignment of a case officer, not on filing; missing a response deadline means the application is deemed withdrawn; and material changes to structure or key personnel allow a non-extendable six-month hold. A realistic horizon for a clean structure is a year or more. Payments to the state are modest — S$1,500 per service on application and S$10,000 per service annually. The real money sits in base capital of S$250,000 with a 6–12 month operating-expense buffer, security of S$100,000–200,000, the legal opinion, the mandatory external auditor assessment for DPT, the penetration test, and ongoing cost for a resident director, compliance and the annual audit.

---

## FAQ

### Is a PSA licence needed when every customer is outside Singapore

If the service is provided in Singapore, yes — the customers' nationality does not change that. If a Singapore company provides crypto services exclusively outside Singapore, that is no longer the PSA but the DTSP regime under Part 9 of the FSMA 2022, live since 30 June 2025. Section 137(5)(a) of the FSMA exempts anyone required to be licensed under the PS Act, so a PSA licence holder serves overseas customers without a second licence, while a company with no Singapore customers cannot. Separately: since 4 April 2024 the PSA perimeter covers facilitating cross-border transfers between two foreign countries even where money never passes through Singapore.

### What actually protects money held with a Singapore payment operator

Section 23 segregation and the security lodged with MAS — but only at MPIs and only for domestic and cross-border transfer, acquiring and e-money. The money must be unconditionally protected by a bank undertaking or guarantee, or sit in a trust account with no bank set-off for the operator's debts, and the S$100,000–200,000 security is deemed outside the licensee's estate on insolvency. None of this is a deposit or deposit insurance. An SPI generally has no safeguarding duty at all, which is why the first question to a counterparty is not "are you licensed" but "in which class, and for which services".

### How long an MPI licence really takes and what it costs

MAS publishes no timeline. What it does publish: the clock starts on assignment of a case officer, not on filing; missing a response deadline means the application is deemed withdrawn; and material changes to structure or key personnel allow a non-extendable six-month hold. A realistic horizon for a clean structure is a year or more. Payments to the state are modest — S$1,500 per service on application and S$10,000 per service annually. The real money sits in base capital of S$250,000 with a 6–12 month operating-expense buffer, security of S$100,000–200,000, the legal opinion, the mandatory external auditor assessment for DPT, the penetration test, and ongoing cost for a resident director, compliance and the annual audit.

---

## Factual claims

- The Payment Services Act 2019 came into force on 28 January 2020, replacing two earlier statutes on money-changing and remittance and on payment systems oversight.
- There are three licence classes, set out in section 6(2): a money-changing licence, a standard payment institution (SPI) licence and a major payment institution (MPI) licence.
- The thresholds sit in section 6(5) and are more intricate than the usual summary suggests.
- Section 6(6), read with regulation 6(2) of the Payment Services Regulations, governs what happens on breach: the licensee has 30 days after the relevant date to apply for a change of class in Form 2.
- Base capital is set by regulations 8 and 12 of the PS Regulations: S$100,000 for an SPI and S$250,000 for an MPI — or equivalent net head office funds for a foreign company operating through a Singapore branch.
- The regulation figure is not a budget.
- The entry criteria for SPI and MPI are listed in section 6(9) and expanded in section 3 of PS-G01.
- The obligation to segregate customer funds falls on MPIs and is set by section 23.