Singapore Major Payment Institution: Licence Scope and Operating Duties

Map each product to a permitted payment service

An MPI is a licence category, not a product description. The Payment Services Act 2019 identifies seven payment service categories. In plain language, these cover account issuance, domestic money transfer, cross-border money transfer, merchant acquisition, e-money issuance, digital payment token (DPT) services and money-changing. Their statutory definitions and exclusions determine the result; the names used in a sales deck do not.

Build the classification from who receives the customer’s money, who owes the customer, and who executes the transfer . Compare those facts with the Act’s service definitions and licensing provisions . Calling an arrangement “software only” does not settle the analysis if the contracts and money flows give the company a payment role.

This is a scoping worksheet, not a legal classification of every wallet or payment chain. A single feature can involve several services, while an exclusion may remove an activity from a definition. Record the reason for each inclusion or exclusion and have difficult boundaries reviewed before taking customer funds.

The proposed licensee must also exist in an eligible form: MAS permits a Singapore-incorporated company or a Singapore branch of a foreign corporation. For a local company, company formation in Singapore establishes the underlying entity; its incorporation record does not establish permission to conduct payment services. A local subsidiary is separate from its foreign shareholder, whereas a branch operates as part of the foreign corporation.

Keep the entity workstream aligned with the payment-service launch prerequisites and compliance dependencies , especially where group contracts or technology sit outside the proposed licensee. The operating company, customer terms and licence application should describe the same allocation of responsibility.

Decide whether the MPI thresholds apply

MAS describes three principal limits for the Standard Payment Institution route: S$3 million in monthly payment transactions for any one relevant service, S$6 million for two or more relevant services, and S$5 million of daily outstanding e-money. The statutory calculation matters more than the headline number. Section 6(5) uses calendar-year averages and distinguishes e-money account issuance from the transaction-volume services.

For the transaction test, the relevant services are non-e-money account issuance, domestic and cross-border money transfer, merchant acquisition and DPT services. The S$5 million tests address e-money account issuance and e-money issuance using their respective statutory populations. Residence, where e-money was issued and the meaning of specified e-money can affect what enters the calculation. Money-changing alone follows its own licence route.

Use a volume workbook rather than a revenue forecast

The following arithmetic illustrates the transaction test only. If the correctly classified calendar-year monthly averages are S$2.9 million for domestic transfers and S$2.9 million for cross-border transfers, neither service exceeds S$3 million and their S$5.8 million combined amount is below S$6 million. If the averages become S$2.8 million and S$3.3 million, both the single-service and combined tests are exceeded. These are payment values, not the company’s commission income.

Give finance a separate tab for every service and document currency conversion, source fields and any exclusions. Keep e-money stock calculations separate from monthly transaction totals. A dashboard that combines everything into one gross payment number can hide the relevant threshold and make an SPI-to-MPI transition hard to plan.

Review forecasts alongside actual statutory averages and begin the licence-change assessment before a planned expansion creates a breach. Do not interpret an MPI’s freedom from these SPI limits as unlimited permission to add services or ignore conditions attached to the licence.

Separate regulatory capital, security and customer protection

The Payment Services Regulations 2019 require an MPI to maintain at least S$250,000 in base capital if incorporated in Singapore, or net head office funds if it is a foreign company. This continuing floor is different from the cash needed to absorb operating losses. MAS also expects a capital buffer suited to the scale and scope of the business.

Security maintained with MAS is S$100,000 where the current-calendar-year average monthly payment value does not exceed S$6 million for each service; otherwise it is S$200,000. The Act allows cash or a compliant bank guarantee, among other forms MAS may allow. Do not confuse this security test with the separate S$6 million combined-services test for the licence category.

For relevant domestic-transfer, cross-border-transfer and merchant-acquisition money, section 23 generally requires safeguarding by the next business day after receipt. Applicable e-money money is also subject to safeguarding rules. Permitted methods include specified undertakings, guarantees or trust arrangements, subject to the Act, Regulations and any applicable exemptions. The precise liability and method must be established for the actual product.

A corporate bank account is not, by itself, proof of compliant safeguarding. Before receiving funds, obtain the relevant agreements and acknowledgements, define the customer-money ledger, and test how receipts, settlements and reversals change the protected amount. For DPT services, separately examine the customer-asset provisions in Regulations 18A–18J; do not assume the ordinary money arrangement answers token-custody questions.

Treat these as three funding and protection workstreams in the board paper. Showing one large bank balance without identifying its legal owner and purpose makes it impossible to tell whether capital, security and customer protection are all satisfied.

Turn customer-facing duties into operating controls

MAS’s ongoing requirements for payment providers include transaction records, applicable receipts, transmission periods, exchange-rate and charge displays, and accurate descriptions of licence scope. The detailed application varies by service. Use the following control-evidence matrix to translate those obligations into a launch review; its owners and evidence are planning recommendations, not a prescribed MAS form.

Run a small set of end-to-end test cases across successful payment, rejection, refund, delayed settlement and duplicate instruction. Give each case a transaction identifier that appears in the customer record, internal ledger, partner message and exception log. A mismatch identifies an operational gap even when the front-end screen looks correct.

Distinguish a contractual service promise from the legally applicable transmission requirement. If a payment is delayed, preserve the timestamps and reason, check the relevant rule, and route the exception to a person who can resolve it. Closing a support ticket without reconciling the underlying liability can leave finance and the customer with different views of the same payment.

Make the licence description consistent across the website, onboarding screens and merchant contracts. Describe the actual permitted services and the identity of the licensed entity. Group branding should not imply that every affiliated company is licensed or that MAS has approved an investment product.

A useful acceptance record contains the tested version, result, unresolved defect, named decision owner and release restriction. Where a partner performs a step, retain evidence of that step in the review rather than relying on a statement that the partner handles compliance.

Build AML and technology controls around actual risk

For specified non-DPT services, MAS Notice PSN01 sets the applicable anti-money laundering and countering the financing of terrorism (AML/CFT) requirements. They include risk assessment, customer and beneficial-owner identification, ongoing review, transaction monitoring, record keeping and suspicious-transaction reporting. Determine the notice’s precise application and exemptions for the services provided rather than applying a single onboarding checklist to every product.

A workable design links the risk assessment to decisions: what evidence is needed, when a case is escalated, who can approve higher risk and what monitoring follows approval. Test a corporate customer with layered ownership and a transaction pattern that differs from the declared business. The objective is to see whether staff can detect, investigate and document the inconsistency without losing the audit trail.

DPT providers use MAS Notice PSN02 for their applicable AML/CFT duties. Token-related risk assessment, customer checks, transfer information, monitoring and escalation need to fit the actual service and counterparties. Holding an MPI licence for remittance does not establish readiness to launch a DPT feature; both the permission and its operating controls need separate review.

Keep cyber hygiene distinct from DPT critical-system duties

Notice FSM-N14 on Cyber Hygiene applies to payment-services licensees. Its controls address administrative access, security patches, baseline standards, network defence, malware protection and specified multi-factor authentication. Maintain an inventory showing which systems and accounts each control covers, including systems used to access customer information through the internet.

For a licensed DPT service, Notice FSM-N13 on Technology Risk Management adds critical-system requirements. These include a maximum of four hours’ unscheduled downtime over any 12 months, a recovery-time objective of no more than four hours, and documented recovery testing at least every 12 months. Relevant incidents require notification as soon as possible and no later than one hour after discovery, followed by the required analysis within 14 days unless MAS allows longer.

Assign the incident clock to an on-call role and rehearse an event outside office hours. Record discovery time, decision authority, notification route and evidence preservation. These specific FSM-N13 requirements should not be presented as applying to every non-DPT MPI merely because its payments run online.

Keep returns, audits and business changes under control

Notice PSN04 on regulatory returns specifies service-dependent monthly, half-yearly and annual returns through MASNET. The applicable returns are generally due within 30 days after the corresponding period ends. The notice also requires monthly Form 8 for MPIs providing domestic transfer, cross-border transfer, merchant acquisition or e-money issuance, and annual Form 9 for licensees. These return numbers belong to PSN04; they are not the same numbering system as licence-application forms.

Use a returns register listing the licensed service, applicable form, reporting period, data source, preparer, authorised approver and submission evidence. PSN04 requires corporate returns to be approved by a director or a board-authorised executive officer, and monetary amounts reported in Singapore dollars. Reconcile the submitted totals to the transaction ledger and retain the conversion methodology.

Set internal preparation and approval dates ahead of the legal deadline. A missing partner file should trigger an escalation while there is still time to investigate. Keep a record of corrections and the reason for them so that the next reporting cycle does not repeat the same data problem.

MAS requires an annual audit of the licensee’s accounts, transactions and compliance with applicable requirements, with the auditor’s report submitted using Form 4. Arrange access to contracts, transaction data, reconciliations, customer due diligence and control exceptions before the audit begins. Ordinary company bookkeeping does not replace this payment-regulatory audit.

Product and ownership changes need a regulatory check before execution . MAS identifies Form 2 for licence variation or change, Form 3 for relevant officer approval, Form 3A for approval of a 20% controller and Form 7 for specified changes. Determine the actual approval or notification trigger and timing for the proposed event; an ACRA filing alone does not complete the MAS workstream.

Keep a board-level change register for new services, new customer groups, settlement partners, directors, controllers and material operational arrangements. Its purpose is to bring the relevant legal requirement into the commercial decision early. When an operating requirement is breached, assess the immediate notification duty under section 6(13) rather than waiting for the next periodic return.

Approve MPI operations against a tested service perimeter

The first priority is a defensible service map. Then confirm the correct licence tier and prove that capital, security and applicable customer protection arrangements can support that exact business. Only then should the release decision rely on transaction tests, customer controls, reporting ownership and audit access.

Stop the affected launch or expansion when the contracting entity differs from the proposed licensee, a feature has no supported permission analysis, protected balances cannot be reconciled, or an approval dependency remains unresolved. Escalate the specific gap to the responsible regulatory adviser or MAS process; a commercial deadline does not resolve it.

For an operating MPI, use each proposed product or ownership change to reopen the relevant part of this review. The practical completion standard is a traceable connection between permission, customer obligation, control owner and evidence—not simply possession of a licence document. Regulatory sources were checked on November 3, 2026.