The Payment Services Act explained for Singapore readers

The Payment Services Act 2019 is the statute most retail readers mean when they say a crypto firm is “MAS licensed”. It is also the statute most marketing pages flatten into a logo. The Act is not a crypto law. It is a payments law that happens to include digital payment tokens as one of several regulated services, alongside the unglamorous work of moving Singapore dollars, issuing e-money and changing banknotes at a counter.

This explainer is for people who live here and would like the licence categories in plain English. It is not a recommendation to use any institution or treat a licence number as a substitute for the customer agreement. For how MAS treats the tokens themselves, see how MAS regulates digital payment tokens. For the rest of the stack, start at the regulation hub.

Why Parliament passed a payments statute, not a “crypto Act”

Before 28 January 2020, Singapore’s payments rulebook was split. The Payment Systems (Oversight) Act 2006 covered designated systems and stored-value facilities. The Money-Changing and Remittance Businesses Act 2005 covered the shops that still occupy the shophouses around the old financial district. Neither statute had been written for businesses that matched bitcoin buyers and sellers on a phone.

The PSA replaced both. It created a single activity-based regime: if you carry on a specified payment service as a business in Singapore, you generally need a licence, unless an exclusion applies. Digital payment token (DPT) service was listed from the start. MAS put DPT dealing and exchange inside a payments statute on day one, then spent the next several years widening the activity list and tightening the consumer-access rules. A DPT platform here is therefore regulated as a payments business, not as a securities exchange, unless the tokens it lists are also capital-markets products. That second fight, when it happens, lives next door in the Securities and Futures Act.

The payment services, in the order a customer meets them

The Act specifies several payment services. You do not need to memorise the schedule. You do need to know that “payments” and “DPT services” are siblings, not synonyms.

Account issuance is the service of issuing a payment account — the wallet, stored-value account or similar facility that a customer uses to make payments. Domestic money transfer is moving money between persons in Singapore. Cross-border money transfer is the remittance business, inbound or outbound. Merchant acquisition is the acquiring business that lets a shop take card or QR payments. E-money issuance is issuing a stored electronic value that is denominated in a currency. Money-changing is the physical exchange of currency notes. Digital payment token service is the dealing, exchange, transfer and custody work described more fully in our DPT briefing.

A single firm can hold permission for more than one of these. A licensed institution that lets you hold Singapore dollars, send them to a friend, and also buy bitcoin is not “a bank plus an exchange”. It is a payment institution with several activity permissions. The customer-facing app may hide that. The licence does not.

E-money and DPTs are the pair that retail readers most often confuse. E-money is denominated in a currency: a SGD-labelled balance you can spend at merchants. A DPT is not denominated in a currency and is not pegged by its issuer to a currency, and it is used or intended to be used as a medium of exchange. A single-currency stablecoin sits awkwardly between those ideas, which is why MAS built a dedicated stablecoin framework rather than forcing every pegged coin into the e-money box. Until a coin is issued under that framework, the platform that deals in it is still, in most cases, providing a DPT service.

Standard payment institutions and major payment institutions

The PSA does not have one licence for small firms and a different statute for large ones. It has two licence classes inside the same Act, split by scale.

A standard payment institution (SPI) may provide payment services only below prescribed thresholds. In broad terms those thresholds are an average monthly transaction value of S$3 million for any one payment service (other than e-money issuance or money-changing), S$6 million where the firm provides two or more payment services, and a daily average e-money float of S$5 million. The precise arithmetic lives in the Act and the regulations; the idea is that a smaller payments business can be licensed without being treated as systemically important.

A major payment institution (MPI) is the class above those thresholds. MPIs carry heavier obligations, particularly around the safeguarding of customer money. If you are sending meaningful value through a firm, or leaving a float with it, the MPI rules are the ones that were written with you in mind. They are still not a guarantee.

Both classes must satisfy fit-and-proper tests, base capital requirements, antimoney-laundering duties, and the conduct rules that attach to the services they provide. An SPI is not an unlicensed firm. It is a licensed firm that is not allowed to grow past the threshold without becoming an MPI. Firms sometimes talk about an SPI licence as if it were a learner permit. That is not how the statute is built.

There is also a money-changing licence for businesses that only change physical currency. It is not a DPT permission.

Exemptions and the things people call “exempt”

The Act contains exclusions and exemptions. Some are narrow — incidental services, limited-purpose instruments, certain intra-group arrangements. “Exempt” in a marketing sentence is not the same as “excluded from the Act”. An exemption is usually a time-limited or activity-limited permission that still comes with conditions. An exclusion means the activity is not a regulated payment service at all. If a firm’s about page says “exempt by MAS”, ask exempt from what, until when, and for which activity. Then check the Financial Institutions Directory.

A licence is not a quality stamp

This is the sentence MAS has had to repeat to the industry, and that this newsroom will keep repeating to readers.

Licensing means the Authority has authorised a person to carry on specified payment services, subject to conditions. It does not mean MAS has approved the firm’s tokens, ranked its app, insured its balances, or agreed to compensate customers if the business fails.

Licensed firms are not supposed to advertise the licence as an endorsement. A licence tells you the firm is inside a supervisory perimeter: it must file, keep books, apply the AML notices, and — if it provides DPT services to the public — apply the consumer-access measures. It does not tell you the firm is well run this quarter, or that a listed token has a future.

The inverse is also true. An unlicensed firm that serves Singapore customers is not a plucky start-up waiting for paperwork. Providing a specified payment service in Singapore without a licence, and without an applicable exclusion, is an offence. The fact that an app is popular, or that a friend has used it for years, is not a defence.

What the licence does require

Strip away the marketing and a payment-institution licence is a bundle of duties. The exact mix depends on the services and the class, but a retail reader can usefully expect the following.

Antimoney-laundering and counter-financing of terrorism. Payment institutions are subject to MAS notices that require customer due diligence, ongoing monitoring, screening, and the filing of suspicious-transaction reports. This is why a licensed exchange asks for papers — identity documents, source-of-wealth explanations, wallet-address ownership, sometimes the identity of the person on the other side of a transfer. The travel-rule briefing explains the transfer-information piece. The short version is that “why do they need my NRIC?” is a statute question, not a customer-service question.

Safeguarding of relevant money. MPIs, and some other arrangements, must safeguard customer money in prescribed ways — typically an undertaking from a safeguarding institution, a guarantee, or segregation in a trust account. DPT safeguarding is a sibling idea with a different asset. Neither arrangement is a compensation scheme on the model of the deposit-insurance framework that applies to bank deposits.

Conduct and disclosure. Firms must be accurate about what they are licensed to do. They must handle complaints. DPT service providers must also apply the risk-awareness, no-incentive, no-credit-card and no-leverage rules described in the DPT and consumer-safeguards pieces. Advertising that presents tokens as a safe path to wealth is the behaviour the 2022 public-provision guidelines were written to stop.

Technology, control and key appointments. A payments licence brings technology-risk expectations; an outage is an operational incident at a payment institution, not “just a crypto thing”. Shareholders and senior managers are not anonymous. Fit-and-proper assessments apply. Licensed firms cannot swap a beneficial owner over a weekend.

What the licence does not do

It does not make a DPT a currency. Singapore’s currency is the Singapore dollar. A token can be a medium of exchange in the PSA sense without being legal tender. It does not make a DPT a capital-markets product, or prevent it from being one: the Securities and Futures Act still applies where the economic substance is a security, a fund unit or a derivative. It does not authorise personalised investment advice — that is the Financial Advisers Act. It does not bind MAS to a rescue. Segregation and safeguarding change the insolvency analysis; they do not repeal it. And it does not travel automatically with a brand. A global exchange may have a licensed Singapore subsidiary and an unlicensed offshore entity. The app you downloaded from a foreign store may be talking to the offshore entity.

How a retail reader should use this statute

You do not need to read the Act cover to cover. Identify the legal entity on the customer agreement, look it up on the MAS Financial Institutions Directory, and match the licensed services to what the app actually lets you do. If any step is provided by a different company in a different country, treat that step as unlicensed-in-Singapore until proven otherwise. Read the insolvency and safeguarding language before you leave value overnight.

If the firm cannot explain, in writing, which PSA services it is licensed for, it is not ready for a customer’s money.

The PSA is the floor of Singapore’s retail crypto architecture, not the ceiling. The DPT consumer-access measures, the travel rule, the stablecoin framework and the 2025 digital token service provider regime all sit on or beside it. A licence is permission — granted, conditioned, and in a serious case revocable. It is not a recommendation. This desk does not recommend tokens or platforms. It will keep explaining the statute that decides who is allowed to offer them.