MAS crypto regulation explained

Singapore regulates crypto as a payment activity, not as a currency and not as a casino. The Monetary Authority of Singapore licenses the firms that deal in digital payment tokens, tells them how to treat retail customers, and publishes the names of outfits that appear to be doing the same work without permission. The tokens themselves remain outside legal tender and outside SDIC. That is the whole architecture, and it is enough to explain most of the screens you now see when you open a local app: Singpass, a risk quiz, PayNow, no credit card, no “welcome bonus” in Bitcoin.

This is the hub explainer. The sister pieces take the parts in more depth: what a DPT is, what an MPI or SPI licence actually is, whether holding crypto is legal, and how IRAS looks at the tax. The regulation hub collects them. Nothing here is a recommendation to buy a token.

The Payment Services Act is the main statute

The Payment Services Act 2019 is the law that turned “crypto exchange” from a grey hobby into a listed activity. Among the payment services in the Act is Digital Payment Token service: buying or selling DPTs, providing a platform for people to exchange them, and — after the scope expanded — transmitting tokens, safeguarding them, and actively facilitating purchases even where the firm does not take possession.

A firm that wants to provide those services in Singapore applies for a Standard Payment Institution licence or a Major Payment Institution licence, with DPT service on the schedule. Banks and a few other institutions have their own routes. The public register of who got what is the Financial Institutions Directory. If a brand is not there, and is not a bank doing the activity under its own authorisation, it is not a Singapore DPT service you should be funding.

MAS has always been explicit about the limit of this project. The early notices said DPT firms were regulated primarily for money-laundering, terrorism-financing and technology risk, and that customers were not otherwise under a statutory compensation scheme for trading losses. Later rounds added user-protection rules — segregation, disclosures, retail-access measures — without turning the token into a deposit. The licence explainer is the place for MPI versus SPI thresholds and capital. The point for a reader is simpler: a licence is a permission, with conditions. It is not a product badge.

A second statute sits alongside for tokens that are actually securities or collective-investment units. The Securities and Futures Act does not disappear because someone put a share on a blockchain. Most of the spot BTC and ETH you will buy on a licensed book are DPTs, not SFA products. If the product looks like a fund, a note or a yield pool, ask which Act the firm is relying on.

Digital payment tokens, and the stablecoin fork in the road

A DPT is a digital representation of value used as a medium of exchange and not e-money. Bitcoin is the clean example. Ether and XRP are treated the same way when you buy them as tokens. The definition piece walks through e-money, utility tokens and the SFA borderline.

Stablecoins are the fork. They are DPTs today. MAS has also designed a single-currency stablecoin framework for tokens issued in Singapore and pegged to the Singapore dollar or a G10 currency, with reserve, capital, redemption and disclosure requirements. Only issuers that meet the finished rules will be allowed to say “MAS-regulated stablecoin”. A 2026 consultation put draft amendments to the Act in public. Until a token is designated, USDT is a DPT with a peg claim, and XSGD is a DPT with a local issuer and a closer relationship to that forthcoming regime. The stablecoin guide is the consumer version.

This split is why you should be wary of any advert that treats “regulated in Singapore” as a property of a foreign dollar token. The thing that is regulated is the Singapore intermediary. The token may still be someone else’s IOU.

Retail safeguards: the quiz, the missing card, the missing yield

From 2022 onwards MAS has been unusually blunt: DPT service providers should not promote crypto trading to the general public. No bus-stop adverts, no influencers hired to trivialise the risk, no ATMs in shopping malls as a marketing channel. Firms may talk about their services on their own sites and apps. They should not pretend this is a mass-market savings product.

The consumer-protection guidelines (PS-G03) then added a second layer. Retail customers — everyone who is not an accredited or institutional investor or another regulated DPT firm — should sit a risk-awareness assessment before receiving the service. The assessment is supposed to cover volatility, including a possible total loss, custody and platform failure, fraud, operational risk and the fact that overseas recovery is hard. If you cannot show that you understand those points, the firm may educate and retest, or it may refuse you. Passing is not a suitability tick. It is a gate.

The same guidelines tell firms not to offer retail customers incentives to trade, not to finance them, not to offer margin or leverage, and not to take locally issued credit cards for DPT purchases. They also tell firms not to lend, pledge or stake assets that belong to a retail customer. That last point is why a licensed Singapore app is a poor place to hunt for “8 per cent on ETH”. The staking explainer covers what remains possible in self-custody, and why that is not an MAS-supervised yield.

Segregation of customer assets, disclosures and risk-management expectations have been phased in as binding user-protection requirements. They make a licensed book safer than an anonymous overseas app. They do not make it a bank.

The travel rule, and why withdrawals ask nosy questions

Singapore applies the Financial Action Task Force “travel rule” to DPT transfers. In practice, when you withdraw above a platform’s threshold, the licensed firm must collect information about the originator (you) and the beneficiary (you again, or someone else). That is why the app suddenly wants to know whether the address is your own wallet and, if it is not, who sits behind it.

This is not the platform being theatrical. It is a condition of the permission. False answers are how ordinary customers create a file they will not enjoy. If you are moving tokens to your own hardware device, say so and be able to show it if asked. If you are paying someone, say so. The custody guide is the operational partner to this paragraph.

The same AML notices mean the PayNow must come from you. Third-party deposits are a classic freeze. They also mean a firm can ask questions that feel disproportionate to a S$800 purchase. The alternative — an unlicensed book that asks nothing — is how people fund thieves.

The Investor Alert List, and the brands that left

MAS publishes an Investor Alert List of entities that may be carrying on regulated activities without authorisation, or that the public should otherwise treat with caution. Crypto brands appear on it. Binance has been the name most readers ask about: MAS told it to stop soliciting payment services here, and the alert list is where that story still sits. Luno shut its Singapore book. Other global names have either licensed a local entity, applied, retreated, or carried on from overseas and hoped Singaporeans would not read the directory.

The method is dull and it works. Search the directory for the company that appears on the receipt. Search the alert list for the brand that appeared in the advert. If those two searches disagree, believe the lists, not the advert. Our exchange reviews start with that check and do not rank a platform we cannot place.

An alert-list listing is not a criminal conviction. It is a regulator telling you that the usual protections you assume when you send SGD do not apply. That is sufficient reason not to send SGD.

How to read this regime as a customer

Three habits follow from the architecture. First, treat every token as a DPT (or, if the features say so, as a security), never as cash. Second, treat every intermediary as a licensed payment institution or as someone you should not use; there is no respectable third category for a retail customer. Third, treat every Singapore-dollar movement as something you can explain later to a bank or, if it comes to it, to IRAS.

The regime is stricter than the 2018 internet, and looser than people who say “crypto is banned here”. It is legal to hold. It is regulated to buy through a local book. It is foolish to buy through a book MAS has already named. For the coin-level how-tos, use the coins hub. For the rest of the statute-level pieces, stay on regulation.