An overview of the regulation of virtual assets in Singapore

Virtual asset laws and regulations in Singapore

Regulation of virtual assets and offerings of virtual assets in Singapore

Regulation of VASPs in Singapore

Regulation of other crypto-related activities in Singapore

Other relevant regulatory information

Pending litigation and judgments related to virtual assets in Singapore (if any)

Government outlook on virtual assets and crypto-related activities in Singapore

Advantages of setting up a VASP in Singapore

1. Virtual asset laws and regulations in Singapore

Singapore’s regulatory approach to virtual assets promotes innovation while ensuring compliance. The Monetary Authority of Singapore (MAS) has implemented measures to create a balanced regulatory framework for investor protection. Specific legislations have been introduced to oversee virtual asset service providers, highlighting regulatory clarity and investor safeguarding.

The regulatory framework, primarily governed by the Payment Services Act 2019 (PSA), encompasses a wide spectrum of payment service providers, including those engaged in digital payment token services.

In Singapore, virtual asset service providers are mandated to obtain a license from MAS to operate lawfully. The licensing regime is structured to ensure that service providers comply with stringent regulatory obligations, including anti-money laundering and counter-terrorism financing measures.

What is considered a virtual asset in Singapore?

In Singapore, virtual assets typically refer to digital payment tokens (DPTs) and other forms of digital assets that are used for transactions or investments. In other words, a virtual asset is essentially a digital representation of value that can be used for payments or investments, and is not pegged to any currency. It’s like a digital cash that isn’t tied to a specific government-issued currency.  These assets are subject to regulatory oversight by the MAS.

The PSA in Singapore governs DPTs, categorised as a type of virtual asset. MAS employs a “risk-based approach” to assess various digital tokens for potential regulatory inclusion.

What are the relevant laws and regulations?

Timeline of key regulations and guidelines for Digital Payment Token Service Providers (DPTSPs) in Singapore:

Who do such laws and regulations apply to?

The laws and regulations regarding virtual assets in Singapore apply to various entities involved in virtual asset activities. These include:

1. DPTSPs: Any business that provides services related to the transfer, exchange, or custody of DPTs is required to be licensed and regulated as a Major Payment Institution under the PSA. DPTs refer to cryptocurrencies like Bitcoin and Ether.
2. Initial Coin Offerings (ICOs) and Security Token Offerings (STOs): If the digital tokens issued constitute securities under the Securities and Futures Act (SFA), the issuer must lodge and register a prospectus with MAS, unless exempted. The issuer and any intermediaries involved may also require licensing under the SFA.
3. Financial Advisers: Those providing advice on investment products involving virtual assets are subject to the Financial Advisers Act (FAA). They must be licensed and comply with conduct and disclosure requirements.
4. Companies under the PSA: The PSA governs a wide range of payment service companies in Singapore, including those involved in account issuance, local and international money transfer services, e-money issuance, merchant acquisition, digital payment token services, and foreign exchange services. These companies must comply with PSA’s compliance requirements such as Suspicious Activity Reports (SARs), transaction monitoring, screening, and Customer Due Diligence (CDD).

Who are the relevant regulatory authorities in relation to virtual assets in Singapore?

The key regulatory authorities overseeing virtual assets in Singapore are:

1. MAS: The MAS serves as the central bank and the main financial regulator in Singapore. It is responsible for overseeing virtual asset activities under the PSA. MAS issues various regulatory guidelines, consultation papers, and notices related to virtual assets. Additionally, MAS is actively working to enhance the regulatory framework to address AML/CFT risks.
2. Financial Action Task Force (FATF): Although FATF is not a Singaporean regulatory body, it plays a crucial role by setting global standards for combating money laundering and terrorism financing. Singapore adheres to FATF’s recommendations on virtual assets, aligning its regulations with international best practices to ensure comprehensive oversight and security.
3. Accounting and Corporate Regulatory Authority (ACRA): ACRA is the national regulator of business entities and public accountants in Singapore. It works closely with MAS to ensure that virtual asset service providers comply with AML/CFT requirements.

What are the penalties for breaches of virtual asset laws and regulations in Singapore?

In Singapore, penalties for breaching virtual asset laws and regulations can be severe and include fines, imprisonment, and license revocation. Here is an explanation under different regulations:

1. SFA: Breaching prospectus or licensing requirements for offering virtual assets considered securities under the SFA can lead to fines of up to SGD 200,000 and/or imprisonment for up to 2 years. Intermediaries involved in the sale of security tokens must be licensed under the SFA, and violations can result in legal actions and penalties.
2. PSA: Violating licensing or AML/CFT requirements for providing DPT services under the PSA may lead to fines of up to SGD 100,000 and/or imprisonment for up to 2 years. MAS has the authority to revoke or suspend licenses of DPT service providers who breach regulatory requirements.
3. The MAS has the power to impose financial penalties of up to SGD 1 million (USD 734,000) for breaches of the PSA. However, the provisions do not specify this penalty amount for breaching DPT service licensing or AML/CFT requirements.
4. In addition to the above, the MAS has the power to take enforcement action against any person or company that breaches the laws and regulations related to virtual assets. This may include issuing warnings, directions, and prohibition orders, as well as pursuing civil or criminal proceedings.

2. Regulation of virtual assets and offerings of virtual assets in Singapore

Are virtual assets classified as ‘securities’ or other regulated financial instruments in Singapore?

In Singapore, virtual assets like cryptocurrencies are not automatically considered securities or other regulated financial instruments. Instead, their classification depends on their specific characteristics and features. Here’s a simple breakdown:

1. DPTs: Cryptocurrencies like Bitcoin and Ether fall into this category. They are regulated under the PSA. Businesses dealing with these tokens, such as transferring, exchanging, or storing them, need a license from the MAS.
2. Security Tokens: If a virtual asset acts like a security, such as representing shares in a company, debt, or derivatives, it is regulated under the SFA. Issuers of these tokens may need to comply with certain requirements, like getting approval from MAS and providing a prospectus.
3. Utility Tokens: These tokens provide access to a specific application or service. Generally, they are not regulated as securities or financial instruments in Singapore.
4. ICOs and STOs: The regulation depends on whether the tokens are considered securities under the SFA. If they are, the issuer must comply with the relevant regulations, which might include lodging a prospectus with MAS.

In essence, whether a virtual asset is regulated and how it is regulated in Singapore depends on what it does and how it functions. Each virtual asset requires careful examination to determine the applicable regulations.

Are stablecoins and NFTs regulated in Singapore?

In Singapore, stablecoins are subject to regulatory oversight by MAS under the PSA of 2019. Specifically, if a stablecoin’s value in circulation exceeds SGD 5 million, the issuer is required to be licensed and regulated under the PSA as a Major Payment Institution.

(In Singapore, companies offering payment services like digital wallets, money transfers, or merchant acquiring need a license from the MAS. There are two main types of licenses: the Money-changing and Remittance license, and the Payment Services license.

The Payment Services license has three categories:

1. Standard Payment Institution
2. Major Payment Institution
3. Money Services Business

A company must apply for a Major Payment Institution license if it exceeds certain thresholds, such as processing over SGD 3 million in monthly transactions. This license allows the company to provide a broader range of services with fewer restrictions compared to a Standard Payment Institution.)

Under the PSA, stablecoin issuers are subject to various regulatory requirements, including:

1. Maintaining sufficient reserves: Stablecoin issuers are required to hold reserves in the form of cash or cash equivalents, such as government securities, to ensure that they can redeem the stablecoins in circulation at any time.
2. Risk management: Stablecoin issuers are required to have in place extensive risk management frameworks to address the risks associated with their business, including operational, credit, and liquidity risks.
3. AML/CFT regulations: Stablecoin issuers are subject to the same AML/CFT regulations as other MAS-regulated entities. They are required to put in place measures to detect and prevent money laundering and terrorism financing activities, including those that may involve virtual assets.
4. Consumer protection: Stablecoin issuers are required to disclose to their customers the terms and conditions of their services, including the fees and charges, and to provide them with timely and accurate information about their transactions.

Furthermore, In November 2022, MAS issued guidelines requiring all stablecoin issuers to be licensed and meet requirements related to reserve assets, valuation, custody, and disclosure. These guidelines, known as the “Response to Public Consultation on Proposed Regulatory Approach for Stablecoin-related Activities,” aim to manage potential monetary and financial stability risks associated with stablecoins. The guidelines focus on key aspects such as the maintenance of reserve assets, prudential limitations, redemption standards, and disclosure to users.

Whereas, Non-Fungible Tokens (NFTs) are seen as assets that can be legally protected in Singapore. A court decision in the case of “Janesh s/o Rajkumar v Unknown Person (“CHEFPIERRE”) [2002] SGHC 264 recognised NFTs as assets, meaning they are covered by laws safeguarding assets.

Virtual marketplaces that help trade NFTs likely have to follow the same rules as other financial service providers in Singapore, such as AML/CFT regulations.

Are decentralised finance (DeFi) activities (e.g. lending virtual assets) regulated in Singapore?

DeFi activities in Singapore are regulated by the MAS under the PSA and SFA, depending on the specific characteristics of the DeFi service.

If a DeFi activity involves a payment service that falls under one of the seven payment services defined in the PSA, such as DPT services, money-changing services, or cross-border money transfer services, it must be regulated under the PSA. DPT service providers are required to obtain a license from MAS and comply with AML/CFT regulations.

DeFi activities that involve the issuance or trading of digital tokens that constitute securities under the SFA may also be regulated. MAS has stated that DeFi platform operators providing marketplaces for trading such security tokens may be subject to licensing requirements under the SFA.

Other DeFi activities that do not fall under the PSA or SFA could still be subject to regulation under common law principles related to contracts and compliance with AML/CFT requirements.

Are there any restrictions on issuing or publicly offering virtual assets in Singapore?

The issuance and offering of virtual assets in Singapore are subject to regulations by the MAS under the SFA and the PSA. Here’s a more comprehensive overview of the regulations:

1. SFA: If a virtual asset has characteristics of a security, such as representing ownership in a company or providing rights like dividends, it is regulated under the SFA. Issuers offering such security tokens must comply with the SFA’s prospectus requirements, which involve registering a prospectus with MAS that discloses key information about the offering. Intermediaries involved in the offer or sale of security tokens, such as digital asset exchanges, must also be licensed under the SFA to conduct regulated activities.

   In November 2019, MAS issued guidelines clarifying when digital tokens fall under the SFA and the regulatory requirements issuers and intermediaries must meet.

2. PSA: Virtual assets that function as a medium of exchange and are not considered securities are regulated as DPTs under the PSA. Entities providing services related to the transfer, exchange, or custody of DPTs, such as cryptocurrency exchanges and wallet providers, must be licensed as Major Payment Institutions under the PSA. Licensed DPT service providers must comply with AML/CFT regulations, such as conducting customer due diligence, monitoring transactions, and reporting suspicious activities.In October 2020, MAS proposed a new regulatory framework for stablecoin issuers, requiring them to be licensed and meet requirements related to reserve assets, valuation, and disclosure.
3. Stablecoins: In November 2022, MAS issued guidelines requiring all stablecoin issuers to be licensed and meet requirements related to reserve assets, valuation, custody, and disclosure. The guidelines aim to manage potential monetary and financial stability risks associated with stablecoins and ensure their stability and reliability.
4. NFTs: While not explicitly regulated, a recent Singapore High Court decision recognised NFTs as a form of digital asset that can be legally protected. NFT marketplaces facilitating trading may be subject to regulations such as AML/CFT requirements, depending on their specific activities.

Are there any exemptions to the restrictions on issuing or publicly offering of virtual assets in Singapore?

Yes, there are exemptions to the restrictions on issuing or publicly offering virtual assets in Singapore under the SFA and the PSA:

1. SFA Exemptions:
   • Small offers: Offers of virtual assets worth SGD 5 million (USD 3.67 million) or less in a 12-month period are exempt from the prospectus requirement.
   • Private placements: Offers to no more than 50 investors in a 12-month period, where the investors are accredited investors or institutional investors, are exempt from the prospectus requirement.
   • Offers to accredited investors: Offers made only to accredited investors are exempt from the prospectus requirement.
   • Exempt issuers: Certain issuers, such as government agencies and companies listed on approved stock exchanges, are exempt from the prospectus requirement.
2. PSA Exemptions:

• • Small DPT service providers: Those with an average monthly transaction value of SGD 3 million (USD 2.2 million) or less are exempt from the licensing requirement.
  • Limited DPT service providers: Those providing only certain DPT services, such as exchange or transfer, with an average monthly transaction value of SGD 5 million (USD 3.67 million) or less, are exempt from the licensing requirement.
  • Exempt DPT service providers: Certain providers, such as those serving only other licensed DPT service providers, are exempt from the licensing requirement.

Even with these exemptions, virtual asset service providers must still comply with AML/CFT requirements.

3. Regulation of VASPs in Singapore

Are VASPs operating in Singapore subject to regulation?

Yes, VASPs in Singapore are regulated by the MAS. Under the PSA, VASPs, also known as DPTSPs, must register for a trading license from the MAS to provide any of the seven types of regulated payment services, which include:

1. Account issuance service: Providing services related to the operation of a payment account in Singapore, such as e-wallets or credit cards.
2. Domestic money transfer service: Offering local money transfer services within Singapore.
3. Cross-border money transfer service: Providing inbound and/or outbound remittance services in Singapore.
4. Merchant acquisition service: Contracting with merchants to process payment transactions and transfer money.
5. E-money issuance service: Issuing e-money in Singapore for payments or transfers.
6. DPT service: Buying or selling DPTs as a business or providing a platform for DPT transactions.
7. Money-changing service: Exchanging one currency for another.

Are VASPs providing virtual asset services from offshore to persons in Singapore subject to regulation in Singapore?

Yes, VASPs providing virtual asset services from offshore to persons in Singapore are subject to regulation in Singapore. The MAS has extended its regulatory framework to cover VASPs operating outside Singapore but providing digital token services to individuals in Singapore.

These VASPs are required to obtain licensing and supervision to ensure compliance with AML/CFT rules. The MAS has implemented regulations under the PSA to oversee and regulate VASPs, ensuring that they adhere to AML/CFT measures and maintain adequate oversight.

Additionally, the new Financial Services and Markets Act has been introduced to regulate VASPs offering virtual asset services outside of Singapore, ensuring they align with the FATF standards and enhancing regulatory oversight in the virtual asset sector.

What are the main requirements for obtaining licensing / registration as a VASP in Singapore?

To obtain licensing or registration as a VASP in Singapore, the following are the main requirements:

1. Company registration: The VASP must be registered with the ACRA as a business entity before applying for a payment services license with the MAS.
2. Local presence: The VASP must have a permanent place of business in Singapore and appoint at least one executive director who is a Singapore citizen or Permanent Resident.
3. Financial requirements: The VASP must satisfy financial requirements prescribed by MAS, such as minimum base capital and ongoing capital adequacy requirements.
4. AML/CFT measures: The VASP must have AML/CFT measures in place, including conducting customer due diligence, monitoring transactions, and reporting suspicious activities to the authorities. The VASP must also assess the risks of the jurisdictions in which they operate and take a risk-based approach, including performing enhanced customer due diligence in higher-risk cases.
5. Risk management framework: The VASP must have a risk management framework to identify, assess, and mitigate operational, cybersecurity, and financial risks. The VASP must also have a technology infrastructure with cybersecurity measures to protect against hacking and other cyber threats.
6. Compliance arrangements: The VASP must have adequate compliance arrangements commensurate with the scale, nature, and complexity of their operations. The VASP must retain thorough records of users for AML/CFT inspections and have proper internal mechanisms to transmit suspicious activity reports (SARs) to MAS.
7. Disclosure requirements: The VASP must disclose essential information to customers and issue receipts for transactions.
8. Licensing/Registration: The VASP must obtain a license from MAS to DPT services. There are three types of licenses: Money-changing License, Standard Payment Institution License, and Major Payment Institution License. The requirements for each license may vary, and MAS will assess each application on a case-by-case basis.

Here is a more detailed classification of the three types of licenses or registrations:

1. Money-changing License: Allows the VASP to provide DPT exchange services, where customers can exchange DPTs for fiat currencies or vice versa. The VASP is not permitted to provide any other type of DPT service under this license.Key requirements include:
   • Minimum base capital of SGD 100,000 (approximately USD 74,000);
   • AML/CFT measures, including customer due diligence, transaction monitoring, and suspicious activity reporting;
   • risk management framework, including operational, cybersecurity, and financial risk controls;
   • compliance arrangements, including record-keeping and internal SAR reporting mechanisms; and
   • disclosure requirements, such as providing essential information to customers and issuing receipts for transactions
2. Standard Payment Institution License: Allows the VASP to provide DPT transfer services, where customers can transfer DPTs to other customers or merchants, and DPT custody services, where the VASP holds and safeguards customers’ DPTs.The VASP is not permitted to provide DPT exchange services under this license.Key requirements include:
   • Minimum base capital of SGD 250,000 (approximately USD 185,000);
   • AML/CFT measures, including customer due diligence, transaction monitoring, and suspicious activity reporting;
   • risk management framework, including operational, cybersecurity, and financial risk controls;
   • compliance arrangements, including record-keeping and internal SAR reporting mechanisms;
   • disclosure requirements, such as providing essential information to customers and issuing receipts for transactions; and
   • the VASP must ensure that customers’ DPTs are held in segregated accounts and are insured or otherwise protected against loss or theft.
3. Major Payment Institution License: Allows the VASP to provide all types of DPT services, including DPT exchange services, DPT transfer services, and DPT custody services.Key requirements include:
   • Minimum base capital of SGD 5 million (approximately USD 3.7 million);
   • AML/CFT measures, including customer due diligence, transaction monitoring, and suspicious activity reporting;
   • risk management framework, including operational, cybersecurity, and financial risk controls;
   • compliance arrangements, including record-keeping and internal SAR reporting mechanisms;
   • disclosure requirements, such as providing essential information to customers and issuing receipts for transactions;
   • the VASP must ensure that customers’ DPTs are held in segregated accounts and are insured or otherwise protected against loss or theft; and
   • the VASP must have a business continuity plan in place to ensure that it can continue to provide services in the event of a disruption or disaster.

What are the main ongoing requirements for VASPs regulated in Singapore?

Here are the main ongoing requirements for VASPs in Singapore based on the legislations on virtual assets:

1. Avoiding Prohibited Activities: VASPs must not engage in any prohibited activities as per the PSA 2019, including unauthorised disclosure of customer information or unlawful access to customer accounts.
2. AML/CFT compliance: VASPs must implement AML/CFT measures as per the MAS Notice on Prevention of Money Laundering and Countering the Financing of Terrorism – Digital Payment Token Service Providers, including conducting customer due diligence, monitoring transactions, and reporting suspicious activities to the authorities.
3. Risk management: VASPs must maintain a comprehensive risk management framework as per the MAS Guidelines on Risk Management Practices, to identify, assess, and mitigate operational, cybersecurity, and financial risks.VASPs must also establish secure technology infrastructure with cybersecurity measures as per the MAS Technology Risk Management Guidelines, to protect against hacking and cyber threats.VASPs must develop business continuity and disaster recovery plans as per the MAS Guidelines on Business Continuity Management, to ensure service continuity in disruptions.
4. Compliance arrangements: VASPs must maintain adequate compliance arrangements suitable for the scale, nature, and complexity of operations as per the MAS Notice on Compliance Arrangements for Digital Payment Token Service Providers.VASPs must retain thorough records of users for AML/CFT inspections and have mechanisms for transmitting SARs to MAS as per the MAS Notice on Suspicious Activity Reporting for Digital Payment Token Service Providers.VASPs must ensure policies and procedures are in place to comply with all applicable laws and regulations as per the MAS Notice on Legal and Regulatory Compliance for Digital Payment Token Service Providers.
5. Audit and Reporting: VASPs must conduct annual audits of accounts and financial statements by an independent auditor as per the MAS Notice on Audit and Reporting Requirements for DPT Service Providers. VASPs must submit annual reports and regulatory filings to MAS, detailing operations, financial performance, risk management, and compliance with AML/CFT and other regulatory requirements as per the MAS Notice on Annual Reporting and Regulatory Filings for Digital Payment Token Service Providers.
6. Disclosure and Transparency: VASPs must disclose essential information to customers and issue receipts for transactions as per the MAS Notice on Disclosure and Transparency Requirements for Digital Payment Token Service Providers. VASPs must maintain a clear fee structure, provide regular account activity statements, and disclose any conflicts of interest with corresponding management policies as per the MAS Notice on Fair Dealing and Customer Protection for Digital Payment Token Service Providers.
7. Cybersecurity: VASPs must establish a robust cybersecurity framework with dedicated teams, regular testing, and encryption to protect customer data as per the MAS Technology Risk Management Guidelines. VASPs must implement multi-factor authentication and conduct regular vulnerability assessments to safeguard against cyber threats as per the MAS Notice on Cybersecurity for Digital Payment Token Service Providers.
8. User protection measures: VASPs must take measures to safeguard customers’ money against insider fraud and external threats, and ensure that customers are informed of their rights and the risks of the services provided as per the MAS Notice on User Protection for Digital Payment Token Service Providers.
9. Safeguarding of customer money: VASPs must comply with regulations around safeguarding customer funds, maintaining financial safeguards like escrow accounts, insurance, or financial guarantees to protect customer funds as per the MAS Notice on Safeguarding of Customer Money for Digital Payment Token Service Providers.

4. Regulation of other crypto-related activities in Singapore