Custodial wallet / SaaS in Singapore
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Singapore with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- DPT service providers must comply with MAS AML/CFT Notices PSN01 and PSN02 (amendments effective July 2025)
- Customer due diligence (CDD) at onboarding and ongoing transaction monitoring required under PSN01/PSN02
- Suspicious transaction reporting (STR) to MAS and Commercial Affairs Department
- Travel Rule compliance for DPT transfers (receiving/sending DPTs)
- The white-label SaaS provider (as the licensed DPT service provider) bears primary AML/CFT responsibility, though client obligations may be contractually allocated
- No specific transaction thresholds stated in cited facts; standard MAS CDD thresholds likely apply (SGD 5,000 for occasional transactions under PSN01)
Key Restrictions
- Must hold a Major Payment Institution (MPI) license with SGD 250,000 base capital (~$185K USD), or an SPI license with SGD 100,000 base capital (subject to SGD 3M single/SGD 6M aggregate monthly transaction limits)
- Must have a Singapore-incorporated entity and resident presence
- Customer assets must be held in a statutory trust (mandatory since 2024) — segregation is mandatory
- Security deposits of SGD 100K–200K are required
- Two-year track record for major roles (CEO, directors) is typically required
- Marketing to the general public for crypto services is prohibited (MAS guidelines Jan 2022) — no incentive programs, no ATMs in public areas
- If the wallet holds security tokens (SFA-covered assets), a separate Capital Markets Services (CMS) license for custodial services may be required under the Securities and Futures Act
- MAS Technology Risk Management Guidelines (2021) apply — cybersecurity, data protection, operational resilience requirements
Key Risks
- Very low approval rate for MPI licenses (only ~20-30 out of 170+ applications granted) — high regulatory gatekeeping risk
- Regulatory ambiguity between PSA (DPT services) and SFA (custody of security tokens) — if underlying assets are security tokens, dual licensing may be required
- MAS actively discourages retail crypto speculation; enforcement risk for perceived retail-facing marketing
- No explicit proof-of-reserves or insurance requirements cited in the facts, but expectation management around asset safeguarding is high
- White-label SaaS model creates ambiguity: the SaaS provider is the licensed entity bearing full AML/CFT liability, but may have limited control over the white-label client's end-user KYC/AML practices
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
MAS licenses payment service providers, including DPT service providers, under the Payment Services Act 2019 (standard payment institution, major payment institution and money-changing licences), imposes AML/CFT requirements on DPT licensees through Notice PSN02, and requires DPT licensees to comply with Notice FSM-N13 on technology risk management from 6 November 2024.
The Payment Services Act 2019 (Act 2 of 2019) licenses digital payment token services through standard and major payment institution licences; it commenced on 28 January 2020, and Act 1 of 2021 widened its DPT scope with effect from 4 April 2024.
The Securities and Futures Act 2001 governs digital tokens that are capital markets products, and a person carrying on a regulated activity in such tokens must hold a capital markets services licence granted under section 86 unless exempt.
MAS Notice PSN02, issued 2 April 2024 under section 16 of the Financial Services and Markets Act 2022 and in force from 4 April 2024, sets the AML/CFT requirements for Payment Services Act licensees providing a digital payment token service; its latest amendment, dated 30 June 2025, took effect on 1 July 2025.
MAS published its Technology Risk Management Guidelines (now listed as Guidelines on Risk Management Practices – Technology Risk) on 18 January 2021; they set non-binding technology risk principles for financial institutions, including payment institutions, covering technology risk governance, IT resilience, data and infrastructure security and cyber security operations.
Crypto service providers in Singapore are licensed under the Payment Services Act 2019; as of 14 October 2026 the MAS directory lists 38 major payment institutions for DPT services and no standard payment institutions. Base capital is S$250,000 for an MPI and S$100,000 for an SPI, which is capped at S$3 million monthly for one service or S$6 million for two or more.
Providing custodial services for digital payment tokens became a regulated DPT service under the Payment Services Act from 4 April 2024; regulations requiring DPT service providers to segregate customer assets in a trust account took effect six months later. All 38 DPT licensees in the MAS Financial Institutions Directory hold major payment institution licences, which require S$100,000 or S$200,000 security.
The Payment Services Act 2019 is the main Singapore statute for cryptocurrency services; section 2(1) defines a digital payment token as a digital representation of value expressed as a unit, not denominated in or pegged by its issuer to any currency, and intended as a public medium of exchange.
Dealing in DPTs (e.g., buying and selling on behalf of customers).
Providing a platform that allows persons to exchange digital payment tokens is a regulated DPT service under the Payment Services Act 2019, and from 4 April 2024 facilitating the exchange of DPTs is regulated even where the provider does not come into possession of the moneys or DPTs.
Receiving or sending DPTs (e.g., cross-border DPT transfers).
The Securities and Futures Act 2001 regulates digital tokens that are capital markets products, which the Act defines as securities, units in a collective investment scheme, derivatives contracts, spot foreign exchange contracts for leveraged foreign exchange trading and other prescribed products.
Providing custodial services for security tokens.
Evidence fact sg.licensing.mas-amlcft-notices-eg-psn01 not found (may have been renamed).
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet / SaaS operators can serve Singapore residents under an MPI license (with SGD 250K capital, mandatory segregated statutory trust for customer assets, SGD 100K–200K security deposit, and full AML/CFT compliance under MAS Notices PSN01/PSN02), but the operator must be a Singapore-incorporated entity, faces a very low license approval rate, and must avoid marketing to the general public; if custody involves security tokens, additional CMS licensing under the SFA may apply.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?