MAS crypto licence for US businesses: practical guide

A US-incorporated business can obtain an MAS Digital Payment Token Service Provider (DTSP) licence, but the path is conditional. MAS will not licence a foreign shell. You must establish genuine operational substance in Singapore, appoint resident management, and satisfy prudential, governance, and AML/CFT standards that are among the most demanding in Asia. The MAS Guidelines on Licensing for Digital Token Service Providers set out the full eligibility framework, and MAS has been explicit that licences will be granted in only limited circumstances where risk controls are demonstrably robust.

Your three immediate next steps:

1. Incorporate a Singapore private limited company (or register a foreign company with a permanent place of business in Singapore).
2. Identify and appoint a resident chief executive who is a Singapore citizen or permanent resident.
3. Scope your services against the licensable activity list to confirm which licence tier applies.

Non-negotiable entry criteria:

• Singapore incorporation or registered foreign company with a physical office
• Resident chief executive and at least one resident executive director
• Board-level governance framework with independent compliance and risk functions
• AML/CFT programme aligned with FATF standards and MAS Notice PSN02
• Capital meeting the Standard Payment Institution (SPI) or Major Payment Institution (MPI) threshold
• Legal opinion on the regulatory status of each token your business supports

What is the legal basis for an MAS crypto licence?

The statutory authority for DTSP licensing sits in the Financial Services and Markets Act (FSM Act), which brought digital token services within a dedicated regulatory perimeter. MAS administers this framework and has published the Guidelines on Licensing for Digital Token Service Providers to translate the FSM Act's requirements into concrete application and ongoing compliance obligations, including Form 1 (application) and Form 3 (annual auditor reporting).

Alongside the FSM Act, the Payment Services Act (PS Act) remains relevant for firms providing Digital Payment Token (DPT) services such as exchange or transfer. MAS has progressively expanded the scope of the Payment Services Act, setting transitional timelines and attestation requirements for firms caught by scope changes. Applicants must confirm which instrument governs their specific activity set, as some firms require authorisation under both frameworks.

MAS's supervisory stance is unambiguous: it prioritises ML/TF risk mitigation and consumer protection over market growth. The regulator has stated publicly that DTSP licences will be granted in extremely limited circumstances. That is not a deterrent for well-prepared applicants; it is a signal that preparation quality determines outcomes.

Key regulatory instruments to have on your desk: The FSM Act and its subsidiary regulations; the MAS Guidelines on Licensing for Digital Token Service Providers (including Appendix 1 on ownership and governance); MAS Notice PSN02 on AML/CFT for DPT service providers; the PS Act and MAS Notices PSN01 and PSN08; and any MAS consultation responses or scope-expansion notifications relevant to your activity set.

Which services require a Singapore DPT licence?

The FSM Act and PS Act together define the licensable perimeter. Understanding precisely where your business model sits determines both the applicable licence and the depth of compliance build-out required.

1. Dealing in digital tokens — buying or selling digital tokens as principal or agent, including OTC desks and proprietary market-making on behalf of clients.
2. Operating a digital token exchange — running a platform that facilitates the exchange of digital tokens between buyers and sellers, including order-book and automated market-maker models.
3. Providing custodial services for digital tokens — holding, storing, or safeguarding digital tokens or private keys on behalf of customers (custodial wallet providers fall squarely here).
4. Digital token transfer services — transmitting digital tokens on behalf of customers, including payment processors and cross-border remittance models using crypto rails.
5. Providing a digital token platform — operating infrastructure that facilitates the above services for third parties, even where the platform operator does not itself deal or exchange.
6. ICO facilitation and token distribution services — where the firm arranges or facilitates the issuance or distribution of digital tokens to the public in a structured manner.

Common business model mapping:

• A custodial exchange (Coinbase-style) triggers dealing, exchange, and custody concurrently.
• A non-custodial wallet provider that never holds keys or transmits tokens on behalf of users may fall outside the perimeter, but confirmation from Singapore counsel is advisable.
• Proprietary trading for a firm's own account, with no customer-facing service, is generally excluded. Software development without any customer-facing financial service is similarly outside scope.

If your model sits at the boundary, do not assume exclusion. MAS applies a substance-over-form analysis, and operating without a licence carries criminal exposure.

What local substance does MAS expect from applicants?

MAS will not accept a letterbox Singapore entity managed entirely from the United States. The substance requirement is genuine, and the regulator scrutinises it closely during application review.

Corporate form

Applicants must be either a Singapore-incorporated company or a foreign company registered under the Companies Act with a permanent place of business in Singapore. A US parent cannot apply directly; the licensed entity must be the Singapore vehicle.

Resident management

MAS requires a resident chief executive who is ordinarily resident in Singapore and who has day-to-day management responsibility for the licensed business. At least one executive director must be a Singapore citizen or permanent resident. These are not nominal appointments; MAS expects these individuals to be actively involved and physically present.

Operational substance

Beyond the corporate form, MAS assesses whether the Singapore entity has genuine operational depth: local employees performing core functions (compliance, operations, technology), a physical office under a real lease, local payroll and bank accounts, and financial flows that reflect actual business activity in Singapore. A Singapore entity that routes all decisions to a US parent and employs no local staff will not satisfy this test.

Pro Tip: Prepare a substance pack at the outset: employment contracts for Singapore-based staff, an executed office lease, local payroll records, and an organisational chart showing reporting lines. Presenting this proactively in your application reduces the likelihood of MAS issuing a request for further information, which is the single most common cause of timeline extension.

Industry commentary consistently places the realistic timeline for a complete, well-prepared application at 9–15 months from submission. Substance gaps are the most frequent reason that timeline extends beyond 15 months.

How does MAS assess board governance and senior management fitness?

MAS applies a fit and proper framework to every director, substantial shareholder, and senior officer of the applicant. The standard covers integrity, competence, financial soundness, and the absence of disqualifying regulatory or criminal history.

MAS's fit and proper standard in practice: The regulator expects applicants to demonstrate not only that key individuals have no adverse history, but that they possess the specific competence and experience relevant to their role in a regulated digital token business. A CEO with a strong traditional finance background but no digital asset experience may require supplementary appointments or advisory arrangements to satisfy MAS.

Key roles MAS expects to see

• Chief Executive Officer (CEO): Resident in Singapore; responsible for day-to-day management; must demonstrate relevant financial services or digital asset experience.
• Chief Compliance Officer / MLRO: Independent from revenue-generating functions; responsible for AML/CFT programme ownership and suspicious transaction reporting.
• Chief Technology Officer (CTO): Accountable for technology risk, custody architecture, and cybersecurity controls.
• Chief Financial Officer (CFO): Responsible for capital adequacy monitoring, prudential reporting, and financial controls.
• Board of Directors: Must include independent directors where the firm's scale warrants it; the board approves risk appetite, oversees compliance, and reviews management information.

Documentary proof

Each key individual must submit a personal declaration, curriculum vitae, criminal background check, and references. Prior regulatory actions, insolvencies, or adverse court findings in any jurisdiction must be disclosed. MAS cross-references disclosures with international regulatory databases.

The governance framework itself must be documented: board charters, risk committee terms of reference, compliance reporting lines to the board, and a policy library covering conflicts of interest, outsourcing, and business continuity.

What AML/CFT and Travel Rule obligations apply under MAS?

MAS Notice PSN02 sets the AML/CFT baseline for DPT service providers, and it is demanding. The controls MAS expects to see in an application are not aspirational policies; they must be operationally ready before the licence is granted.

Core AML/CFT requirements:

• Customer due diligence (CDD/KYC): Identity verification for all customers at onboarding, enhanced due diligence for higher-risk customers and politically exposed persons, and ongoing monitoring of customer profiles.
• Transaction monitoring: Automated systems capable of detecting unusual patterns, with defined thresholds and escalation procedures; manual review capacity for flagged transactions.
• Suspicious transaction reporting (STR): Documented procedures for filing STRs with the Suspicious Transaction Reporting Office (STRO) in Singapore; staff training on recognition and reporting obligations.
• Recordkeeping: Customer identity records and transaction records retained for a minimum of five years.
• Sanctions screening: Real-time screening against MAS-designated lists, OFAC, UN Security Council lists, and other applicable sanctions regimes; US entities must also maintain OFAC compliance independently.
• Independent AML testing: Periodic internal audit or external review of the AML/CFT programme; MAS expects evidence of testing and remediation.
• Staff training: Documented annual AML/CFT training for all relevant staff, with records of completion.

Travel Rule obligations require that originator and beneficiary information travels with every qualifying digital token transfer. Technically, this means your platform must integrate with a Travel Rule messaging protocol (such as TRUST, VerifyVASP, or Notabene) and must be able to send, receive, and screen counterparty information before processing transfers. For US entities, this intersects with FinCEN's own Travel Rule requirements under the Bank Secrecy Act, so the compliance architecture must satisfy both regimes simultaneously. Firms using machine-learning tools for transaction monitoring should also consider how EU AI Act obligations may apply to their global compliance stack.

How should you structure custody and technology controls?

MAS expects customer assets to be protected from the outset. The custody model you choose shapes both your technology architecture and your ongoing compliance obligations.

1. In-house custodial wallets: The firm holds private keys directly. MAS requires robust key management procedures, hardware security module (HSM) use for key generation and storage, multi-signature authorisation for material transactions, and cold storage for the majority of customer assets. Daily reconciliation between on-chain balances and internal ledgers is mandatory.
2. Third-party qualified custodians: Outsourcing custody to a regulated custodian (itself licensed or authorised in a recognised jurisdiction) transfers operational key management risk but does not transfer regulatory responsibility. The firm must conduct due diligence on the custodian, maintain contractual rights to audit, and ensure segregation of customer assets from the custodian's own assets.
3. Multi-sig and cold-storage hybrid: A common architecture for exchanges combines hot wallets (multi-sig, limited float) for operational liquidity with cold storage (air-gapped, HSM-protected) for the majority of customer assets. MAS views this positively where the cold-storage proportion is material and the governance around hot-wallet limits is documented.

Minimum technology controls MAS expects:

• Encryption of data at rest and in transit
• Role-based access controls with privileged access management
• Change management procedures with pre-deployment testing
• Incident response plan with defined escalation to MAS
• Penetration testing at least annually
• Business continuity and disaster recovery plans tested periodically

Customer asset segregation must be maintained at all times. Customer assets cannot be commingled with the firm's own assets, and the firm must be able to produce proof of reserves and reconciliation records on demand. MAS also expects periodic independent attestation of custody controls, which feeds into the annual auditor reporting obligation under Form 3.

What capital and prudential thresholds must you meet?

Capital requirements depend on which licence tier applies to your business. The MAS licensing pages set out the SPI and MPI tiers and the assessment criteria that determine which applies.

Source: Industry guidance on DPT licensing capital requirements

Security deposit requirements:

• MAS may require a security deposit or bank guarantee, particularly for higher-volume operators.
• Industry guidance indicates security deposits can reach S$200,000 for firms with significant transaction volumes.
• The deposit is held by MAS as a prudential buffer and is separate from base capital.

Prudential modelling and stress testing:

• Prepare a minimum 12-month cash flow forecast demonstrating the firm can meet its obligations under base, stress, and severe stress scenarios.
• Model the impact of a 30-day operational suspension on customer asset obligations.
• Maintain a liquidity buffer sufficient to cover at least three months of operating costs independently of customer assets.
• Board-level management information should include monthly capital adequacy reports, liquidity dashboards, and threshold breach alerts.

What does the MAS application process involve?

The application process is iterative and document-intensive. Incomplete submissions are the primary cause of delay.

Complete document checklist:

1. Form 1 (application form) completed in full
2. Detailed business plan covering services, target markets, revenue model, and risk assessment
3. Legal opinion on the regulatory status of each token the business proposes to support
4. AML/CFT policies and procedures manual, including CDD, transaction monitoring, STR, and Travel Rule procedures
5. Governance documents: board charter, committee terms of reference, organisational chart, and key personnel CVs with fit-and-proper declarations
6. Audited financial statements or, for new entities, a capitalisation plan with evidence of committed capital
7. Technology and custody architecture documentation, including key management procedures and security controls
8. Resident management evidence: employment contracts, Singapore residential addresses, and identity documents
9. Outsourcing agreements and third-party custodian due diligence (where applicable)
10. Business continuity and disaster recovery plans

Pro Tip: Structure your legal opinion on tokens to address each token individually. For major tokens such as Bitcoin and Ethereum, MAS may accept a standardised analysis, but niche or proprietary tokens require bespoke legal reasoning that maps the token's characteristics to the FSM Act's definitions. A weak or generic legal opinion is one of the most common reasons MAS issues a request for further information. See Cryptoverselawyers's step-by-step application guide for a detailed walkthrough of the submission process.

What enforcement risks and rejection reasons should you prepare for?

MAS has broad enforcement powers under the FSM Act and the PS Act. Operating a regulated digital token service without a licence is a criminal offence carrying fines and imprisonment. For licensed firms, MAS can issue directions, impose conditions, suspend or revoke a licence, and refer matters for prosecution.

Common reasons for refusal or revocation:

• Insufficient local substance: the Singapore entity is a shell with no genuine operational presence
• Weak AML/CFT framework: policies that are generic, untested, or not operationally implemented
• Unsuitable individuals: key personnel with undisclosed adverse regulatory history or insufficient relevant experience
• Misleading or incomplete disclosures in the application
• Inadequate legal opinions: tokens not properly analysed against the FSM Act perimeter
• Capital shortfall: inability to demonstrate that base capital is fully paid up and unencumbered

Practical remediation steps:

• If MAS issues a request for further information, respond comprehensively and within the stated deadline; partial responses extend the review cycle significantly.
• Where AML/CFT gaps are identified during review, engage an independent AML consultant to conduct a gap analysis and produce a remediation plan before resubmitting.
• Voluntary disclosure of issues identified after submission is viewed more favourably than MAS discovering them independently.

For a detailed analysis of why applications fail, Cryptoverselawyers's guide on crypto licence rejection reasons covers the most frequent MAS and global refusal grounds.

How should a US entity structure its Singapore operation?

US founders face a specific set of cross-border considerations that go beyond the MAS application itself.

1. Singapore subsidiary (preferred for most US groups): A wholly owned Singapore private limited company provides clean regulatory separation, limits liability to the Singapore entity, and is the structure MAS most readily accepts. The US parent can hold shares but must not exercise operational control in a way that undermines the Singapore entity's independence.
2. Registered foreign company: Technically permissible, but MAS scrutinises foreign company applicants more closely for substance. The US parent remains directly exposed to Singapore regulatory obligations, which creates complications for US securities and banking regulators.
3. Multi-entity operating model: Larger groups may separate the licensed Singapore entity from IP-holding, technology, and treasury entities. This is legitimate but requires careful transfer pricing documentation and must not result in the licensed entity being operationally hollow.

Interaction with US regulators:

• Assess whether the tokens your Singapore entity supports constitute securities under the Howey test; if so, SEC registration or an exemption is required for any US-person-facing activity.
• Maintain OFAC sanctions screening independently of MAS obligations; the two regimes overlap but are not identical.
• US persons with signature authority over foreign financial accounts must comply with FBAR and FATCA reporting; the Singapore entity's accounts will likely trigger these obligations for US-resident directors.
• Engage US tax counsel early to structure the Singapore subsidiary in a way that manages Subpart F income, GILTI exposure, and transfer pricing risk.

Operational checklist for US groups:

1. Engage Singapore corporate counsel to incorporate the subsidiary and advise on Companies Act compliance.
2. Identify and contract resident CEO and executive director candidates before filing.
3. Execute a Singapore office lease and establish local payroll.
4. Appoint a Singapore-based MLRO with relevant AML/CFT experience.
5. Engage US securities counsel to assess token classification and any US regulatory overlap.
6. Brief your US tax advisers on the Singapore structure before the entity is operational.

Pro Tip: Engage Singapore and US counsel concurrently, not sequentially. The most common structuring error US groups make is finalising the Singapore corporate structure before US tax and securities counsel have reviewed it. Restructuring after MAS submission is costly and can reset the review clock.

Cryptoverse's perspective on what MAS licensing actually demands

The firms that succeed with MAS DTSP applications are not necessarily the largest or best-funded. They are the ones that treat the application as a compliance demonstration, not a form-filling exercise.

The most consistent pattern in unsuccessful applications is a mismatch between the sophistication of the business model and the depth of the compliance infrastructure presented. A firm proposing to operate a multi-asset exchange with institutional clients but submitting a generic AML policy and a two-page technology description will not pass MAS review. The regulator reads applications with a forensic eye, and gaps in one section raise questions about the entire submission.

From Cryptoverselawyers's experience advising across MAS, VARA, DFSA, and FSRA frameworks, the firms that shorten review timelines share three characteristics: they engage pre-application, they invest in a bespoke token legal opinion rather than a templated one, and they appoint a resident MLRO with genuine AML/CFT credentials before submission. These are not expensive steps relative to the cost of a delayed or refused application.

One further point that US founders consistently underestimate: MAS's fit and proper assessment is not a background check. It is a competence review. The regulator expects the management team collectively to demonstrate that it can run a regulated financial institution in Singapore. If your team's experience is entirely in technology or trading, you will need to supplement it with individuals who have direct financial services regulatory experience.

Cryptoverselawyers can support your MAS licence application

Navigating an MAS DTSP application from the United States requires coordinated legal, compliance, and structuring work across two jurisdictions simultaneously. Cryptoverselawyers delivers that coordination as a single engagement, drawing on direct experience with MAS, VARA, DFSA, FSRA, and FINTRAC frameworks.

Our MAS licensing services cover: pre-application diagnostic and gap analysis; token legal opinions tailored to the FSM Act perimeter; AML/CFT programme design and policy drafting aligned with MAS Notice PSN02 and FATF standards; governance framework build-out including board charters, committee structures, and fit-and-proper documentation; resident management placement advisory; custody and technology controls review; and audit readiness support for Form 3 obligations.

A typical engagement begins with a scoping call, followed by a fixed-fee proposal structured in milestone phases aligned to the application timeline. For US groups, we coordinate with your US securities and tax counsel to ensure the Singapore structure is sound before submission.

To discuss your MAS licensing project, contact our digital asset legal consultancy team directly. We will assess your business model, identify the applicable licence tier, and outline the preparation steps specific to your situation.

Sources

The following primary and secondary sources should form the foundation of your research and application preparation:

• MAS Digital Payment Token (DPT) licensing — Eligibility…

This article provides general information on the MAS DTSP licensing framework and does not constitute legal advice. Regulatory requirements change; confirm current rules with MAS directly or with qualified Singapore legal counsel before making structuring or application decisions.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

Recommended

• Cross-border crypto licensing: A practical guide for startups
• MAS Singapore crypto laws: the 2026 compliance guide
• Bermuda Digital Asset License 2025: How to Launch a VASP Under BMA
• Bermuda Crypto Licence Guide 2026 | DABA Licensing Process