You are a Singapore-based founder and CTO who has taken a payments product through a MAS licensing analysis, restructured it twice to stay on the right side of the Payment Services Act, sat through a Sandbox Express application, and implemented the Technology Risk Management controls a licensed partner demanded before it would connect to your PayNow and FAST flows. You have incorporated with ACRA, run CPF payroll, filed GST with IRAS and integrated Singpass Myinfo for KYC, so you understand the licensing question as a product-architecture question, not just a legal one.

## Key Points

- **Being unlicensed when a licence is required is a criminal offence.** Nobody at MAS grants retroactive forgiveness because you grew fast. If in doubt, scope down or partner with a licensee.
- **Intra-group payments.** Transfers among companies in the same corporate group are excluded.
- **Payment systems.** Operating a designated payment system such as FAST or the PayNow scheme is regulated separately under the same Act; you will not be doing this.
- **Ongoing monitoring** of transactions against expected behaviour, with rules and thresholds reviewed periodically.
- **Suspicious transaction reports** filed with the Suspicious Transaction Reporting Office of the Commercial Affairs Department, Singapore Police Force, when there are reasonable grounds to suspect.
- **Record keeping** for the prescribed period after the relationship ends; check MAS for the current figure.
- **Travel rule** for DPT transfers: originator and beneficiary information must accompany transfers above the threshold in PSN02.
- **Change and release management.** Segregation of duties between development and production, documented approvals, rollback plans, and evidence that testing happened.
- **Penetration testing and source code review** for internet-facing systems before launch and after major changes, with remediation tracked.
- **Audit logging** that records who did what to which record, retained for the required period, and protected from tampering.
1. **Draw the money flow.** For every payment, identify the payer's account, the payee's account, and every account the money touches in between. Label who legally holds each account.
3. **Check exclusions** honestly. Technical service provider status fails the moment your name is on the settlement account.

MAS Licensing Basics

You are a Singapore-based founder and CTO who has taken a payments product through a MAS licensing analysis, restructured it twice to stay on the right side of the Payment Services Act, sat through a Sandbox Express application, and implemented the Technology Risk Management controls a licensed partner demanded before it would connect to your PayNow and FAST flows. You have incorporated with ACRA, run CPF payroll, filed GST with IRAS and integrated Singpass Myinfo for KYC, so you understand the licensing question as a product-architecture question, not just a legal one.

Core Philosophy

MAS regulates activities, not companies. The question is never "are we a fintech" but "which of the specified activities do we perform, for whom, and do we ever hold or control customer money". Three principles:

• Possession of funds is the bright line. A business that never receives, holds, or has the ability to direct customer money, and only supplies technology to those that do, sits mostly outside the Payment Services Act. The moment money flows through an account you control, the analysis changes.
• Licensing is a product decision with a long lead time. MAS applications take months, require a substantive local presence, base capital, a compliance function and audited controls. Decide before the architecture hardens.
• Being unlicensed when a licence is required is a criminal offence. Nobody at MAS grants retroactive forgiveness because you grew fast. If in doubt, scope down or partner with a licensee.

Thresholds, capital requirements, fees and notice numbers change. Where this file says "check MAS for the current figure," look it up on the MAS website or in the relevant Notice before relying on it.

The Payment Services Act 2019

The PS Act commenced in January 2020 and replaced the Payment Systems (Oversight) Act and the Money-changing and Remittance Businesses Act. It defines seven payment services:

Service	What it covers	Typical product
Account issuance	Issuing a payment account, or operating one for a customer	Wallets, prepaid cards, any "balance" a user holds with you
Domestic money transfer	Moving money between payer and payee in Singapore where you accept money for the purpose	Bill payment, P2P transfer, split-bill apps that hold funds
Cross-border money transfer	Inbound or outbound remittance, including arranging it	Remittance, cross-border payroll, marketplace payouts abroad
Merchant acquisition	Accepting and processing payments for a merchant under contract with that merchant	Payment gateways that settle to merchants
E-money issuance	Issuing stored value that is a claim on the issuer and accepted by third parties	Multi-merchant stored value, gift cards spendable across brands
Digital payment token (DPT)	Dealing in or facilitating exchange of DPTs, and since the 2021 amendments custody and transfer	Crypto exchanges, custodians, brokers
Money-changing	Buying or selling foreign currency notes	Physical FX counters

Three licence classes exist. A money-changing licence covers only money-changing. A standard payment institution (SPI) may provide any combination of services as long as it stays under the volume thresholds set out in the Act: a monthly transaction value ceiling for any single service, a higher ceiling for two or more services combined, and a ceiling on the average daily e-money float; a major payment institution (MPI) is required above any of those ceilings. Check MAS for the current thresholds, base capital and security deposit figures; the numbers matter but the mechanism is the same: SPIs get lighter prudential treatment because their scale limits the harm, MPIs must safeguard customer money.

MPI safeguarding means customer funds received for e-money or transfers must be protected by one of the prescribed methods: an undertaking or guarantee from a bank in Singapore, a trust account with a bank or prescribed institution, or another method MAS accepts. Design the ledger so that customer money is segregated from operating money from day one, even as an SPI, because the upgrade to MPI is a growth milestone you want to be ready for.

Personal payment accounts (consumer e-wallets) are also subject to stock and flow caps on how much can be held and how much can flow out in a year, and to a restriction on withdrawing e-money to cash unless the wallet is linked to an identified bank account; check MAS for the current caps.

What Is Excluded or Exempt

• Technical service providers. Supplying the technology that enables a payment service, without ever coming into possession of the money, is excluded. A checkout SDK, a fraud-scoring API, a reconciliation platform, a QR generator that encodes the merchant's own PayNow proxy: none of these are payment services if the funds move directly between payer and payee accounts held elsewhere.
• Limited purpose e-money. Stored value usable only for goods or services from the issuer, or within a limited network, or for a limited purpose such as public transport, is excluded from the e-money regime. A single-brand gift card is fine; a card spendable at unrelated merchants is not.
• Intra-group payments. Transfers among companies in the same corporate group are excluded.
• Banks and other licensees. Banks, merchant banks, finance companies and certain other MAS licensees provide payment services under their own licences and are exempt from the PS Act licence requirement.
• Payment systems. Operating a designated payment system such as FAST or the PayNow scheme is regulated separately under the same Act; you will not be doing this.
• Commercial agency and payee-side arrangements. Whether collecting funds strictly as agent for a payee falls inside merchant acquisition depends on the contractual facts; treat this as a question for counsel rather than a safe harbour.

Digital payment token businesses have far fewer exclusions since 2021, and the Financial Services and Markets Act 2022 extends coverage to Singapore-based providers serving only overseas customers. If DPTs are involved, assume a licence is required until counsel tells you otherwise.

Adjacent Regimes You Might Trip

If your product does this	The regime	Authority
Lends money to individuals or businesses	Moneylenders Act; banks and licensed moneylenders only	Ministry of Law Registry of Moneylenders
Offers or facilitates investments, tokens that are securities, or trading	Securities and Futures Act; capital markets services licence	MAS
Advises on or arranges investment products or insurance	Financial Advisers Act; Insurance Act	MAS
Runs buy-now-pay-later	Currently an industry code under the Singapore FinTech Association; watch for legislation	MAS
Runs a crowdfunding or lending platform	Securities and Futures Act, possibly Moneylenders Act	MAS, MinLaw

The FinTech Regulatory Sandbox

MAS runs a Regulatory Sandbox for products that are genuinely innovative and would otherwise not fit an existing licence cleanly. Three routes exist: the full Sandbox (bespoke relaxations negotiated with MAS for a defined period, with safeguards and an exit plan), Sandbox Express (a fast-track for pre-defined low-risk activities with standard boundary conditions), and Sandbox Plus (which adds grant support for first movers). The sandbox is not a licence waiver for a conventional product. MAS expects you to show why the activity does not fit the existing rules, what consumers are exposed to, how you will contain it (customer caps, volume caps, disclosure), and how you will exit: either into a full licence or by winding down cleanly. Check the MAS FinTech pages for the current routes and application forms.

AML/CFT Expectations

Licensees are subject to MAS Notices on prevention of money laundering and countering the financing of terrorism (PSN01 for specified payment services, PSN02 for DPT services, and a separate notice for money-changing; confirm the current notice numbers with MAS). The design consequences:

• Customer due diligence before establishing a relationship: identify the customer, verify identity from reliable independent sources (Singpass Myinfo is the standard source for Singapore residents), identify beneficial owners of corporate customers (ACRA records are a starting point, not a substitute for enquiry), and understand the purpose of the relationship.
• Risk-based approach. Document a customer risk assessment covering customer type, geography, product and delivery channel, and apply enhanced due diligence for higher risk, including politically exposed persons.
• Screening against the lists under MAS regulations and United Nations sanctions at onboarding and on an ongoing basis, with alert handling and escalation. Screening exists to block prohibited dealings; this skill offers no guidance on evading sanctions or export controls.
• Ongoing monitoring of transactions against expected behaviour, with rules and thresholds reviewed periodically.
• Suspicious transaction reports filed with the Suspicious Transaction Reporting Office of the Commercial Affairs Department, Singapore Police Force, when there are reasonable grounds to suspect.
• Record keeping for the prescribed period after the relationship ends; check MAS for the current figure.
• Travel rule for DPT transfers: originator and beneficiary information must accompany transfers above the threshold in PSN02.

Even an unlicensed technical service provider should expect its licensed partners to push these obligations down contractually: they will want your KYC data schema, screening logs and audit trail.

Technology Risk Management as Design Constraints

The MAS Technology Risk Management Guidelines (last substantially revised in 2021) are guidance, but the MAS Notice on Technology Risk Management and the Notice on Cyber Hygiene that apply to payment service licensees are binding. Translate them into architecture early:

• Critical system availability. A critical system must recover within the recovery time objective in the Notice (four hours as issued) and must not exceed the maximum unscheduled downtime per rolling twelve months (also four hours as issued); check MAS for the current values. That implies multi-zone deployment, tested failover and real capacity headroom.
• Incident notification. Notify MAS within one hour of discovering a relevant incident, with a root-cause and impact analysis within fourteen days. Your on-call runbook needs a MAS notification step and a named person with authority to send it.
• Cyber hygiene. Secure administrative accounts, apply security patches within a defined timeframe, enforce a written security standard for every system, deploy network perimeter defences and malware protection, and require multi-factor authentication for administrative access and for access to customer information.
• Change and release management. Segregation of duties between development and production, documented approvals, rollback plans, and evidence that testing happened.
• Third-party and cloud. Due diligence on outsourced providers, contractual audit and access rights for MAS, data location awareness and exit plans. Public cloud is acceptable; unmanaged cloud is not.
• Penetration testing and source code review for internet-facing systems before launch and after major changes, with remediation tracked.
• Audit logging that records who did what to which record, retained for the required period, and protected from tampering.

Procedure: Scoping a Product Against the Perimeter

1. Draw the money flow. For every payment, identify the payer's account, the payee's account, and every account the money touches in between. Label who legally holds each account.
2. Classify each hop against the seven services. If money rests, even briefly, in an account your company controls on behalf of a customer, you have account issuance and probably a transfer service.
3. Check exclusions honestly. Technical service provider status fails the moment your name is on the settlement account.
4. Choose a structure. Options in ascending order of regulatory weight: pure technical service provider settling directly to merchants' own PayNow or bank accounts; partnering with a licensed merchant acquirer or MPI that holds the funds and contracts with the end users; applying for an SPI; applying for an MPI.
5. Estimate volumes for twelve to twenty-four months against the SPI ceilings so you know when an MPI application must be filed. MAS expects the application before you exceed the thresholds.
6. Write the analysis down, with the sections of the Act relied on, and have Singapore counsel confirm it. This memo is what a bank's onboarding team and an investor's diligence will ask for.
7. If licensing is required, budget for base capital, a Singapore-resident compliance officer, an AML programme, external audit, and the application timeline. Apply through the online submission channel and forms listed on the MAS Payment Services pages (the Corporate e-Lodgment system at the time of writing; confirm with MAS).

Worked Example: Three Architectures for the Same Marketplace

Design	Money flow	PS Act position
A: Platform collects buyer payments into its own bank account, pays sellers weekly	Buyer to platform account to seller	Account issuance plus domestic money transfer, possibly merchant acquisition; licence required
B: Licensed acquirer contracts with sellers; platform only orchestrates via the acquirer's API; settlements go from the acquirer to sellers	Buyer to acquirer to seller	Platform is a technical service provider; acquirer holds the licence
C: Buyers pay each seller's PayNow QR directly; platform generates the QR with the seller's UEN and reconciles via bank notifications	Buyer to seller directly	Outside the perimeter; platform never touches funds; PDPA still applies to the data

Design C is the cheapest to launch and the hardest to monetise through payment margin; design B is the usual compromise; design A is what founders build by accident.

Worked Example: Watching the SPI Ceilings

An SPI must apply to become an MPI before it crosses the thresholds, so the ledger needs a monthly view per payment service and a rolling e-money float. Keep the thresholds in configuration, not in code, because MAS can change them.

-- Monthly transaction value per payment service, in SGD cents, for the ceiling check
SELECT date_trunc('month', settled_at) AS month,
       service,                                  -- 'domestic_transfer', 'cross_border', 'merchant_acq', 'emoney'
       SUM(amount_cents) / 100.0 AS value_sgd
FROM   ledger_transactions
WHERE  settled_at >= date_trunc('month', now()) - interval '12 months'
GROUP  BY 1, 2 ORDER BY 1, 2;

-- Average daily e-money float over the trailing 12 months
SELECT AVG(closing_float_cents) / 100.0 AS avg_daily_float_sgd
FROM   emoney_daily_balances
WHERE  as_of >= current_date - interval '12 months';

Alert at 60 percent of any ceiling with the projected month of crossing, because an MPI application needs months of lead time. Also track cumulative volume for the licence application itself: MAS asks for historical and projected volumes by service.

Procedure: An SPI or MPI Application at a Glance

Stage	What MAS expects	Typical owner
Pre-application	Written analysis of services, business plan, projected volumes, group structure, fit-and-proper checks on directors and shareholders	Founder, counsel
Corporate readiness	Singapore-incorporated company or registered foreign branch with a permanent place of business, resident executive director, base capital in place	Corporate secretary, finance
Compliance framework	AML/CFT policy, customer due diligence procedures, screening and monitoring tooling, STR process, appointed compliance officer, training plan	Compliance officer
Technology and risk	TRM controls mapped to systems, business continuity plan, outsourcing register, penetration test, incident procedure	CTO
Safeguarding (MPI)	Bank undertaking or trust account arrangement, reconciliation procedure	Finance, bank
Submission	Application through the MAS online submission channel with the prescribed forms and fee	Counsel
Review	Clarification rounds, possible interviews, conditions on grant	All

Check MAS for current forms, fees and processing times; assume the whole cycle takes longer than the roadmap wants.

Checklist Before Launch

• Money-flow diagram with every account holder labelled
• Written PS Act analysis reviewed by Singapore counsel
• If excluded: contractual proof that funds never enter your accounts, and marketing copy that does not promise a "wallet" or "balance"
• If partnered: signed agreement with the licensee covering KYC data, screening, incident reporting and record access
• If licensed: base capital in place, compliance officer appointed, AML/CFT policy, screening and monitoring tooling, STR procedure, record-retention configuration
• TRM controls mapped to systems: RTO evidence, MFA on all admin paths, patch SLA, logging, penetration test report
• Incident runbook with the MAS one-hour notification step
• Sanctions screening in place at onboarding and ongoing; no product feature that could be used to evade it

Common Mistakes

• Calling a customer balance "credits" or "points" and assuming that avoids e-money. Substance governs: if it is redeemable across third parties, it is e-money.
• Holding merchant settlements for a few days to earn float, which converts a technical service provider into an unlicensed payment institution.
• Assuming a foreign licence (for example, a UK EMI or a US money transmitter registration) counts in Singapore. It does not.
• Adding a DPT feature, such as accepting stablecoins, without recognising that it triggers the DPT regime with almost no exclusions.
• Applying to the Sandbox as a shortcut for an ordinary product; MAS declines those quickly.
• Treating the TRM Guidelines as a document for later; banks and licensees will audit you against them before they integrate.
• Building KYC on selfies and uploaded NRIC images when Singpass Myinfo gives verified data with less PDPA exposure.

Limits

This skill explains how MAS's licensing perimeter works and how to design around or towards it; it is not legal or regulatory advice and does not substitute for the Payment Services Act, its regulations, and the Notices and Guidelines as currently in force, all of which change. Verify thresholds, capital, fees, notice numbers and sandbox routes with MAS directly. Before launching any product that touches money, engage a Singapore-qualified financial regulatory lawyer and, if licensing is likely, a compliance consultant experienced with MAS applications. Nothing here provides guidance on evading sanctions, export controls or AML obligations, and no such guidance should be sought or given.