Crypto & Virtual Assets Compliance in Singapore

Singapore is open to crypto businesses, but only through licensing. Services involving DPTs, the legal term for cryptocurrencies such as bitcoin, are regulated activities under the Payment Services Act 2019, and the anti-money laundering rules for licensees sit in a binding MAS Notice backed by criminal penalties.

MAS is the single regulator for licensing, conduct and anti-money laundering supervision. The Suspicious Transaction Reporting Office of the Singapore Police Force receives suspicious transaction reports, and the Personal Data Protection Commission oversees the handling of customer data.

The biggest obstacle for a new entrant is the licence itself: local incorporation or a local branch, minimum capital, resident directors, a penetration-tested platform and a working compliance programme are all assessed before MAS grants it, and MAS has revoked a licence for false information supplied during the process.

1. Who regulates this sector

Tokens that are capital markets products, such as tokenised securities, fall under the Securities and Futures Act 2001 rather than the Payment Services Act. MAS classifies tokens by economic substance, and an exchange that lists such tokens will likely need approval as a market operator (MAS Guide on the Tokenisation of Capital Markets Products, 14 November 2025, paragraph 2.1 and case study 12). The Inland Revenue Authority of Singapore (IRAS) administers crypto tax reporting (section 7).

2. Licensing and authorisation

A "digital payment token service" is a payment service under the Payment Services Act 2019 (PS Act), which defines a DPT as a digital unit of value, not denominated in or pegged to any currency, intended as a medium of exchange (section 2). Since 4 April 2024 the regulated scope also covers DPT custody and the facilitation of DPT transmission or exchange even where the provider never holds the customer's money or tokens [In force] (MAS media release, 2 April 2024).

Which licence

Sources: MAS, Licensing for Payment Service Providers; MAS Guidelines PS-G01 (last revised 8 October 2025), which summarise the thresholds in section 6(5) of the PS Act. DPT applicants must also file a legal opinion and a recent external auditor's assessment of their AML/CFT and consumer protection controls; a technology and cybersecurity assessment follows in-principle approval, and online services need a remediated penetration test before licensing (PS-G01 3.1.8, 4.1). Licensees must meet the Technology Risk Management Notice FSM-N13 (PS-G01 5.5).

Carrying on a payment service business without a licence is an offence under section 5(3) of the PS Act: individuals face up to S$125,000, three years’ imprisonment or both (plus S$12,500 a day if continuing); entities up to S$250,000 plus S$25,000 a day.

Serving only overseas customers

From 30 June 2025, a person in Singapore providing DPT or tokenised capital markets services solely to customers outside Singapore needs a digital token service provider (DTSP) licence under the Financial Services and Markets Act 2022 [In force]. MAS has stated that it has set the bar high and will generally not issue such a licence; unlicensed providers had to cease, with no transition period (MAS, 6 June 2025). Services relating only to utility or governance tokens are outside the regime.

3. AML, KYC and customer due diligence

Licensed DPT service providers are obliged entities under MAS Notice PSN02, issued under section 16 of the Financial Services and Markets Act 2022, in force from 4 April 2024 and last amended with effect from 1 July 2025. The Notice is legally binding; the accompanying Guidelines to Notice PSN02 (last revised 1 July 2025) set supervisory expectations, and MAS states that the degree of observance may affect its risk assessment of the firm (Guidelines paragraph 1-3).

When CDD applies

On establishing business relations, on any transaction for a non-account holder, on any value transfer for a non-account holder, on suspicion of money laundering or terrorism financing, and on doubts about earlier information (Notice 6.3). Anonymous accounts are prohibited (6.1).

Data to collect

For individuals: full name and aliases, unique identification number, residential address, date of birth and nationality (6.6).

Beneficial owners

Firms must ask whether beneficial owners exist and identify and verify them in a cascade: ownership, then control, then executive authority (6.13 to 6.14B). The Guidelines cite more than 25% ownership as an example (6-8-2).

Simplified and enhanced CDD

Simplified CDD is barred where a customer's transactions exceed S$20,000 cumulatively in any one year, and for FATF high-risk countries (7.4). Politically exposed persons trigger senior management approval and source of wealth and funds checks (8.3).

Screening, monitoring and reporting

Customers, connected parties, beneficial owners and every originator and beneficiary of a value transfer must be screened against MAS and other Singapore authority lists (Notice 6.49 to 6.51); the Guidelines expect transaction screening in real time, before execution (6-15-10). Terrorist designations by the Inter-Ministry Committee on Terrorist Designation freeze funds and prohibit dealings with immediate effect (Ministry of Home Affairs). A positive sanctions hit requires freezing without delay and a suspicious transaction report (STR) no later than one business day after suspicion is established (Guidelines 6-15-2). MAS expects distributed ledger analytics proportionate to the business (Guidelines 6-11-12).

STRs, including attempted transactions, must be filed promptly with STRO regardless of amount (Notice 16.2). The underlying duty is section 45 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992, and failure to file may be an offence; reports are filed electronically through SONAR (Singapore Police Force). Cash payouts of S$20,000 or more are banned (10.2). CDD and transaction records must be kept for at least five years (14.3).

4. Identity verification and onboarding

Identity must be verified "using reliable, independent source data, documents or information" (Notice 6.9). The Guidelines name government-issued identity cards and passports as the best documents because they are hardest to obtain illicitly or falsify digitally, and expect an identity document with a clear photograph for individuals; residential address may be evidenced by identity card, recent utility or phone bill, bank statement or government correspondence (6-3-1, 6-6-1, 6-6-2). Firms should also collect occupation, employer, income range and contact details (6-3-2, 6-4-2).

Timing

Verification must be completed before business relations begin or before any transaction for a non-account holder (Notice 6.42). Deferral is allowed only where it is essential to normal business and the risk is managed (6.43). The Guidelines set the outer limits: verification within 30 business days, after which the account is suspended, and termination at 120 business days (6-14-2).

Reliance and outsourcing

A firm may rely on certain regulated third parties for CDD but remains responsible (Notice 11.5). Holders of a payment services licence, and foreign payment or DPT providers holding only an equivalent licence, are not eligible third parties (Notice 11.1; Guidelines 11-4). Outsourcing to an identity verification vendor is different: the vendor applies the firm's own policies (Guidelines 11-3).

5. Digital channels: what's different

Bottom line: remote onboarding is permitted and the core CDD rules are channel-neutral, but non-face-to-face business carries its own written policies, anti-impersonation checks and a mandatory independent assessment reported to MAS.

The independent assessment

When a provider conducts its first non-face-to-face business contact, it must appoint, at its own expense, an external auditor or independent qualified consultant to assess its non-face-to-face policies, including any technology used to manage impersonation risk, and submit the report to MAS within one year (Notice 6.37, 6.38). A substantial change, such as a new technology solution, triggers a fresh assessment (6.39).

Accepted anti-impersonation methods

MAS gives non-exhaustive examples (Guidelines 6-12-3): independently verifiable phone contact, address confirmation, an initial deposit from the customer's account with a bank in Singapore, proof of control of the DPT wallet making the first deposit, device identifiers and IP addresses with time stamps and geolocation, real-time video conferencing comparable to face-to-face contact, secure digital signatures, and biometric technologies such as facial recognition, which "should be linked incontrovertibly to the customer".

Location signals

The Guidelines treat customers' use of IP anonymisers as a risk factor (4-6), and STRO lists access through a virtual private network or Tor as a red flag. Notice PSN02 does not prescribe geo-blocking of particular jurisdictions; the obligation is to assess and mitigate country risk, and customers from countries subject to a FATF call for countermeasures must be treated as higher risk (8.6).

Pending: the [Proposed, comments closed 16 Oct 2026] stablecoin amendments to the PS Act would add a licensed stablecoin issuer category but would not change the onboarding rules above.

6. Data protection and biometrics

The Personal Data Protection Act 2012 governs customer data generally. Notice PSN02 lets a provider collect, use and disclose personal data of customers, representatives, connected parties and beneficial owners without consent to comply with the Notice, and limits access and correction rights to core identification data (Notice 15.2 to 15.4). The PDPC's advisory guidelines restrict collecting NRIC (national identity card) numbers to cases required by law or where identity must be verified to a high degree of fidelity, which covers AML verification; the PDPC advises against using NRIC numbers to authenticate identity (PDPC, updated 14 December 2024).

MAS prescribes no biometric standard; biometrics are one accepted anti-impersonation technique, tested in the independent assessment. CDD evidence, including images and liveness results, falls under the five-year minimum retention in Notice 14.3.

7. Sector-specific obligations

Travel Rule

At or below S$1,500, the ordering provider must send both parties' names and account numbers (or a unique transaction reference). Above S$1,500 it must also verify the originator and add an address, identification number, or date and place of birth (Notice 13.4, 13.6). Data must travel immediately and securely; if it cannot, the transfer must not be executed (13.9, 13.11).

Self-hosted wallets

The Travel Rule applies only between financial institutions. Transfers to or from an entity that is not a regulated financial institution, which includes a customer's own unhosted wallet, require enhanced risk mitigation (Notice 6.27). For the customer's own wallet, the Guidelines suggest requiring proof of control by sending an amount specified by the provider (13-7).

Custody and retail safeguards

Since 4 October 2024, DPT providers must segregate customer assets and hold them on trust [In force] (MAS, 2 April 2024). From 19 June 2025, MAS Guidelines PS-G03 (revised 19 September 2024) expect providers to give retail customers a Risk Awareness Assessment and refuse DPT services to those who fail it, offer no incentives for sign-ups, referrals or trading, provide no credit, leverage or DPT derivatives, and refuse payment by credit or charge cards issued in Singapore (PS-G03 1.2.1, 4.2 to 4.4) [In force].

Tax reporting (CARF)

The Income Tax (International Tax Compliance Agreements) (Crypto-Asset Reporting Framework) Regulations 2026 [Adopted, effective 1 Jan 2027] require Singaporean reporting crypto-asset service providers to obtain a valid self-certification of each user's tax residence on or before establishing the relationship, collect self-certifications from existing users by 31 December 2027 (no transactions for them from 1 January 2028 without one), register with IRAS by 31 March 2028 and file an annual return by 31 May (regulations 7, 11 and 12).

Scam account orders

The Scams (Countermeasures) and Other Matters Act 2026 (Act 21 of 2026) [Adopted, commencement date not yet set] will let the Police order providers of DPT accounts to disable accounts for up to 30 days, restrict services to identified persons for up to three years and disclose account information; non-compliance by a firm carries a fine of up to S$1 million.

Stablecoins

Under the proposed MAS Single-Currency Stablecoin framework, only licensed issuers of stablecoins pegged to the Singapore dollar or a G10 currency could call their tokens "MAS-regulated stablecoins"; other stablecoins would be treated as DPTs and carry the same consumer safeguards [Proposed, comments closed 16 Oct 2026]. The consultation also proposes prohibiting interest on MAS-regulated stablecoins.

8. Risk indicators and red flags

STRO red flag indicators for DPT service providers (selection)

• Anonymised access: logging in through a virtual private network or Tor.
• Throwaway contact details: registering with an encrypted, anonymous or temporary email service.
• Shifting identifiers: frequent changes of address, IP address, linked bank accounts or wallet addresses.
• Tainted sources: deposits from or withdrawals to addresses linked to darknet markets, mixers or ransomware.
• Pass-through activity: assets withdrawn immediately after deposit without a plausible business reason.
• Structuring: many small transactions in a short period that add up to a substantial total.
• Funnel accounts: many unrelated senders, often from different countries, paying one local account.
• Kiosk funding: frequent or large receipts from virtual asset kiosks.

Sources: STRO, Red Flag Indicators for DPT Service Providers; the same indicators appear in Appendix B of the Guidelines to Notice PSN02 (revised 1 July 2025).

9. Enforcement and penalties

Breach of an AML/CFT Notice is a criminal offence under section 16(4) of the Financial Services and Markets Act 2022: a fine of up to S$1 million for each offence and, for a continuing offence, a further S$100,000 for every day or part of a day it continues after conviction (FSMA section 16, current version; MAS, Anti-Money Laundering). MAS may compound offences rather than prosecute: on 27 June 2025 it imposed composition penalties of S$110,000 to S$280,000 (S$960,000 in total) on five remittance institutions for breaches of the parallel Notice PSN01, including screening failures and missing originator data (MAS enforcement action).

Licence revocation is the other main tool. MAS revoked the major payment institution licence of Bsquared Technology Pte Ltd, a DPT provider licensed on 1 January 2025, with effect from 14 May 2026 for weak risk management and conflict of interest controls, outsourcing failures and materially false or misleading information given to MAS (MAS, 20 May 2026).

10. Recent changes and what to watch

• 6 October 2026 [Passed, commencement not yet set] Financial Services and Markets (Amendment) Bill passed: section 16 powers extend to proliferation financing; penalties unchanged.
• 9 September 2026 [Adopted, commencement date not yet set] Scams (Countermeasures) Act passed (gazetted 29 September), covering DPT accounts.
• 1 September 2026 [Proposed, comments closed 16 Oct 2026] MAS consultation on stablecoin amendments to the PS Act; no bill yet.
• 11 August 2026 [Adopted, effective 1 Jan 2027] CARF Regulations gazetted. Onboarding needs a tax residence self-certification step.
• 20 May 2026 [Effective 14 May 2026] Bsquared Technology's DPT licence revoked.
• 1 July 2025 [In force] PSN02 amendments; existing customers reviewed on a risk basis (6.48A).
• 30 June 2025 [In force] DTSP regime for firms serving only overseas customers.

11. What this means for identity verification

• Verify before the first trade. No funding before verification, or limits and a 30 business day clock where deferral is justified.
• Layer impersonation checks. Combine photo ID with MAS-listed controls such as face match, video, a Singapore bank deposit or device signals.
• Plan for the audit. Document the remote flow and its performance; changing vendors may trigger a new assessment.
• Treat the NRIC number as data, not a password. Never use it to authenticate returning users.
• Add tax residence. Capture a CARF self-certification at onboarding from 2027 alongside CDD data.
• Extend identity to wallets. Exchange Travel Rule data, screen counterparties in real time and require proof of control for self-hosted wallets.
• Re-verify on triggers. Refresh CDD for higher-risk customers periodically and for all customers on trigger events; keep evidence for at least five years.