MAS Digital Token Service Provider Regime: The Technology Evidence Singapore Now Expects

Singapore has quietly redrawn the line on who it will let operate a digital token business from its territory, and the deciding factor is no longer a policy document but whether your systems can produce evidence on demand.

Two shifts landed close together. The Monetary Authority of Singapore brought the Digital Token Service Provider regime into force on 30 June 2025 under Part 9 of the Financial Services and Markets Act 2022, and it finalised its single-currency stablecoin framework back in 2023. Neither is a light-touch registration. Both assume that a firm holding customer assets or issuing a token can show its controls working, not merely describe them in a submission. For anyone running a crypto business out of Singapore, and especially anyone serving customers abroad, the practical question is no longer “are we in scope” but “can our estate stand up to inspection”.

The DTSP line is harder than most people read it

The part of the DTSP regime that has caught firms out is territorial. Section 137 of the FSM Act captures a Singapore-incorporated company, partnership or individual that provides digital token services from Singapore to customers outside Singapore. A structure that many builders assumed was safely offshore — incorporate in Singapore for the stability and the banking, serve everyone else from there — is precisely the structure MAS now treats as in scope.

What makes this bite is MAS’s stated position on licensing. It has said it will grant DTSP licences only in extremely limited circumstances, on the reasoning that a business serving solely overseas customers carries higher money-laundering risk and is harder for MAS to supervise meaningfully. There was no transitional runway: unlicensed firms in scope were expected to stop the regulated activity by the effective date rather than continue while an application sat in a queue. So the decision facing a foreign-facing firm is binary and unpleasant — secure one of a small number of licences, restructure so the regulated activity genuinely sits elsewhere, or cease. Reported baseline conditions for the licence include minimum base capital in the region of S$250,000 and an annual fee near S$10,000, alongside a Singapore-based compliance officer; verify the current figures against the MAS notices before you plan around them.

The technology consequence is that “where the activity happens” stops being a slide in a corporate structure chart and becomes a claim your systems have to support. If you assert the regulated service runs from another jurisdiction, your infrastructure, your signing keys, your operational tooling and your staff access all have to tell the same story. A supervisor who finds the production custody console being driven from a Singapore desk will not be persuaded by the org chart.

Reserve management as an examinable system

The stablecoin framework moves in the same direction from a different angle. For a single-currency stablecoin pegged to the Singapore dollar or a major currency, MAS set requirements on the reserve’s composition, valuation, custody and audit, on minimum capital, and on redemption: holders must be able to get par value back within five business days of a redemption request. Only issuers meeting the full set may present a token as an “MAS-regulated stablecoin”, and misusing that label carries penalties. The legislative amendments giving the framework full statutory force have been working through the pipeline, so treat the precise commencement and any final drafting as provisional and confirm against the enacted instrument.

Read those requirements as engineering obligations and the shape of the work appears. A five-business-day redemption guarantee is a claim about your reconciliation and settlement pipeline under load, not a line in a whitepaper. Reserve composition and valuation rules mean your system of record has to reconcile on-chain supply against off-chain reserve holdings continuously, price them on a defensible basis, and produce that reconciliation as an artefact an auditor can pull. “The reserve is fully backed” is an assertion; a timestamped, independently verifiable reconciliation between tokens in circulation and assets held is evidence. MAS is asking for the second thing.

Custody and AML are where the inspection actually happens

Underneath both regimes sits the same expectation, and it is one worth stating plainly: MAS wants demonstrable systems, not attestations. That mirrors what other regulators have started to demand of firms seeking authorisation, a pattern I have written about in the context of the technology evidence CASP applicants actually have to show. The controls that matter most are custody and anti-money-laundering, because those are the ones a supervisor can test directly.

On custody, the questions are concrete. How are private keys generated, stored and used, and can you prove no single person can move assets alone? What is your segregation model between customer and firm holdings, and does the ledger enforce it rather than merely record it? Can you reconstruct who authorised a given withdrawal, when, and against which policy? These are the same questions insurers ask before they will write a policy, which is why the custody technology evidence underwriters demand maps closely onto what a MAS examiner will want to see.

On AML, the FATF-aligned obligations — customer due diligence, sanctions screening, transaction monitoring and the travel-rule handling of originator and beneficiary data — are only as good as the logs behind them. A firm that screens but cannot produce the screening decision for a specific transaction eighteen months later has a control that exists in principle and fails in evidence. The retention, integrity and reconstructability of those records is a technology design decision, and it belongs in the same conversation as your broader operational-resilience obligations under Singapore’s Cybersecurity Act framework.

What to do before an examiner asks

The firms that will struggle are not the ones with weak intentions. They are the ones whose controls live in a compliance manual and a set of good habits, never wired into systems that emit inspectable evidence as a by-product of normal operation. Closing that gap is unglamorous work: instrument the custody path, make reserve reconciliation a continuous machine-produced record, ensure AML decisions are logged with the reasoning intact, and make sure your infrastructure geography matches the jurisdictional story you are telling MAS.

Singapore has not made crypto unwelcome. It has made unexaminable crypto unwelcome, and for foreign-facing firms it has drawn a line most cannot sidestep. The licence decision is the headline. The systems that would survive the licence are the real work.