Centralized exchange in Singapore

MAS — All DPT service regulation, PSA licensing, AML/CFT, stablecoin framework, TRM guidelines

Payment Services Act 2019 (2019) — DPT service licensing — MPI/SPI licenses

Securities and Futures Act (2001) — Security tokens, CMS licensing

MAS AML/CFT Notices (PSN01, PSN02) — AML/CFT requirements for DPT service providers; amendments effective July 2025

MAS Technology Risk Management Guidelines (2021) — Cybersecurity, data protection, operational resilience

VASP: Major Payment Institution (MPI) license for DPT services. SGD 250,000 base capital (~$185K USD). 170+ applications received, only ~20-30 full MPI licenses granted. SPI option: SGD 100,000 base capital with transaction limits (SGD 3M single/SGD 6M aggregate). Must have Singapore entity, resident director, local compliance officer, physical office.

CUSTODY: Included under DPT MPI license. Customer asset segregation mandatory (statutory trust since 2024). Security deposits (SGD 100K-200K) required.

EXCHANGE: MPI license. MAS explicitly discourages retail crypto speculation — marketing to general public prohibited (Jan 2022), no incentive programs, no ATMs in public areas. Stablecoin issuers must maintain 100%+ reserves in cash/equivalents at SG-licensed institutions.

DPT issuance (e.g., initial coin offerings where the token functions as a payment token).

This act applies to digital tokens that qualify as "capital markets products" (i.e., security tokens). If a digital token represents an equity, a debt instrument, a collective investment scheme, or a derivative, it falls under the SFA.

Travel Rule adopted — threshold: SGD 1,500

Requirements: DPT service providers are required to obtain and transmit certain originator and beneficiary information for DPT transfers.

Thresholds: This applies to DPT transfers involving a value of S$1,500 or more (or its equivalent in other currencies/DPTs).

Information to be Transmitted:

Originator Information: Name, account number used for the transaction, physical address, national identity number (or customer identification number if national ID is unavailable), and date and place of birth (if available).

Beneficiary Information: Name and account number used for the transaction.

Timing: This information must be obtained and transmitted immediately and securely with the DPT transfer itself. Where this is not technically feasible, the information must be sent by other means within a reasonable time.

MAS Notice PSN02 on Prevention of Money Laundering and Countering the Financing of Terrorism – DPT Service Providers (Paragraphs 6.4, 6.5, 6.6)

Adopted and Enforcement Status: The rule is mandatory for all regulated payment service providers, including VASPs offering digital payment token (DPT) services under the Payment Services Act (PSA) 2019. Compliance became a legal requirement on January 28, 2020.

Effective Date: January 28, 2020.

Threshold Amounts: Applies to virtual asset transfers ≥ S$1,500 (approximately US$1,000 equivalent), requiring VASPs to collect and share sender/recipient personally identifiable information (PII).

Covered VASPs: All licensed DPT service providers under the PSA, such as centralized crypto exchanges like Crypto.com and Gemini, which must handle incoming/outgoing transfers compliantly. Non-custodial wallets may require verification (e.g., Satoshi Test) for withdrawals exceeding S$20,000 monthly from custodied wallets.

Penalties for Non-Compliance: Not explicitly detailed in sources, but non-compliance violates MAS regulations under the PSA, subjecting providers to enforcement actions by MAS (e.g., fines, license revocation).