Crypto Exchange Licensing Requirements in Singapore 2025

Before June 30, 2025, some crypto exchanges operated in Singapore while serving only overseas customers - and didn’t need a license. That loophole is gone. Now, if you’re running a crypto exchange from Singapore, no matter who your customers are, you need a license from the Monetary Authority of Singapore (MAS). The rules changed fast, with no grace period. Companies had to adapt overnight or shut down. This isn’t a slow rollout. It’s a hard reset.

Who Needs a License Now?

Under the new Financial Services and Markets Act (FSMA), all Digital Token Service Providers (DTSPs) must be licensed. That includes exchanges, custodians, and platforms that trade, hold, or transfer digital tokens like Bitcoin or Ethereum. Even if you don’t have a single customer in Singapore, if your company is based here, you’re covered. MAS made it clear: Singapore won’t be a haven for offshore crypto operators. The goal isn’t to ban crypto - it’s to make sure anyone using Singapore as a base plays by the same rules as banks.

The Two Main License Types

There are two main licenses under the Payment Services Act (PSA), which still applies alongside FSMA. Which one you need depends on how much money you handle each month.

• Standard Payment Institution License: For businesses processing up to SGD 3 million in monthly transaction volume. Requires a minimum capital of SGD 100,000. You’ll need basic KYC/AML systems, transaction monitoring, and regular reporting to MAS.
• Major Payment Institution License: For operators handling more than SGD 3 million monthly. Minimum capital jumps to SGD 250,000. You’ll face stricter audits, deeper risk controls, enhanced customer due diligence, and ongoing surveillance of all transactions.

There’s also an Exempt Payment Service Provider category, but it’s only for very limited activities - like small peer-to-peer transfers or tokenized gift cards. Most exchanges won’t qualify.

What MAS Actually Demands

Getting licensed isn’t about filling out a form. It’s about proving you can run a secure, transparent, and compliant business. MAS requires detailed documentation across seven key areas:

1. Business Plan: You must explain your entire operation - how you’ll make money, who your users are, how you’ll grow, and what your long-term strategy is. Vague answers get rejected.
2. KYC and AML Policies: Your customer verification system must match international standards. That means collecting government-issued ID, proof of address, and performing ongoing screening against global sanctions lists. No exceptions.
3. Internal Controls: You need written policies for everything: how funds are stored, how trades are settled, how customer data is protected, and how staff are trained.
4. Risk Management Framework: You must identify every possible threat - cyberattacks, market manipulation, liquidity crunches - and show how you’ll prevent or respond to them.
5. Financial Proof: You must prove you have enough capital to cover at least six months of operating costs. Bank statements or letters from investors won’t cut it unless they’re legally binding and verified.
6. Audit Reports: Every year, you need both an internal audit (done by your team) and an external audit (by a MAS-approved firm). These aren’t optional checklists - they’re forensic reviews.
7. Compliance Team: You need at least one full-time compliance officer based in Singapore who understands MAS rules inside and out.

MAS Notice PSN02 is the backbone of this. It’s not a suggestion. It’s the rulebook for anti-money laundering. If your platform fails to detect a suspicious transaction and report it, you’re in violation - even if you didn’t know it was illegal.

How Long Does It Take?

There’s no quick path. Most Standard License applications take 3 to 6 months with expert help. Major License applications often stretch to 6 to 12 months. Why so long? Because MAS doesn’t just review documents - they test your systems. They ask for screenshots of your KYC flow. They simulate a hack to see how you respond. They interview your compliance staff.

Many applicants get rejected on the first try. Common reasons: incomplete AML policies, unclear business models, or weak financial backing. Some companies spend over SGD 100,000 on legal and consulting fees just to get to the submission stage.

How Singapore Compares to Other Countries

Singapore’s rules aren’t the strictest - but they’re among the most consistent.

Singapore’s capital requirements are lower than Switzerland’s and Hong Kong’s, making it more accessible for mid-sized firms. But unlike the EU, there’s no transition period. You don’t get time to adjust. You either comply or leave.

Why the Sudden Change?

The push for stricter rules didn’t come out of nowhere. In 2022, the collapse of Three Arrows Capital and Terraform Labs sent shockwaves through global markets. Both firms had ties to Singapore - not as registered entities, but as operational hubs. MAS realized that even unlicensed firms using Singapore as a base could trigger financial instability abroad - and damage Singapore’s reputation.

Chengyi Ong from Chainalysis put it bluntly: “MAS is reinforcing that financial integrity is a red line.” The message is clear: Singapore wants to be a leader in crypto innovation - but only if it’s done safely. No more shell companies. No more offshore loopholes. No more pretending you’re not in the game.

What Happens If You Don’t Apply?

Operating without a license after June 30, 2025, is illegal. MAS can shut down your website, freeze your bank accounts, and pursue criminal charges against directors. Even if you’re not in Singapore, if your servers are hosted here or your team is based here, you’re in scope.

Several exchanges quietly shut down operations in July 2025. Others restructured - moving their headquarters to jurisdictions like Dubai or Malta. Those that stayed had to hire compliance officers, upgrade their tech, and submit to audits they never expected.

Who’s Winning Under the New Rules?

Large, well-funded exchanges with existing compliance teams are adapting smoothly. They see the new rules as a competitive advantage - they can now market themselves as “MAS-licensed,” which builds trust with institutional investors and enterprise clients.

Smaller retail-focused platforms are struggling. Many can’t afford the legal fees or the ongoing compliance costs. One operator on Reddit said they spent 11 months and over SGD 150,000 just to get their application approved. Another said they gave up after MAS asked for 17 revisions to their AML policy.

The result? The market is thinning out. Fewer players. More transparency. More accountability.

What’s Next?

MAS has signaled this is just the beginning. They’ve said they’ll “generally not issue a license” to firms that serve only overseas clients - meaning even if you’re licensed, if your business model is purely offshore, you’re on thin ice.

Expect more rules around token listings, staking services, and DeFi integrations. MAS is watching how other countries regulate these areas and will likely match or exceed those standards. The message is consistent: If you want to operate in Singapore, you play by our rules - no exceptions.

For operators who can meet the bar, Singapore remains one of the most attractive crypto hubs in Asia. The regulatory clarity attracts institutional capital. The legal system is stable. The infrastructure is world-class. But the cost of entry has gone up - and so has the expectation.