TRW & Co · Corporate, Capital & Tax
Fintech Regulatory Advice in Singapore
Fintech regulation in Singapore turns on what a product does, not what it is called. MAS regulates activities across payments, capital markets, lending and insurance, then expects robust technology risk, AML/CFT and conduct controls. This guide explains how to map the regulatory perimeter, choose between partnership, licence and sandbox, and build a compliance programme that keeps pace with the product.
Key pointThe perimeter analysis is a living document: each new feature that changes who holds customer money or assets can move a fintech into a new licence class, so legal review belongs in the product release cycle.
At a glance
Activity-based regulation
MAS regulates activities, not technology. The same app can fall under the PS Act, SFA, Financial Advisers Act or Moneylenders Act depending on its money and asset flows.
Three sandbox routes
MAS offers the bespoke Regulatory Sandbox, Sandbox Express for low-risk activities and Sandbox Plus, which includes a grant for first movers of up to S$400,000.
FSMA cross-sector powers
The Financial Services and Markets Act 2022 gives MAS cross-sector powers, including technology risk requirements, prohibition orders and Part 9 on digital token service providers.
Technology risk expectations
MAS Technology Risk Management Guidelines and binding cyber hygiene notices cover access controls, patching, multi-factor authentication, resilience and rapid incident notification.
Outsourcing flows down
MAS outsourcing expectations require regulated firms to secure audit rights, MAS access and exit plans, so unregulated vendors inherit these obligations through contract.
Swipe or scroll →
What fintech regulation in Singapore covers
Fintech regulation in Singapore is the set of rules that decides whether a technology-led financial business needs MAS authorisation, and what it must do once it operates. It covers the regulatory perimeter, the conduct and technology standards MAS expects, anti-money laundering controls, data protection and the way products are marketed. It applies to start-ups, scale-ups, banks launching digital products and overseas platforms serving Singapore users.
The question is rarely "is fintech regulated?" MAS regulates activities, not technology, so the same app can be unregulated software, a payment service, a capital markets service or a lending business depending on exactly what it does with customer money, assets and data. A feature added in a product sprint can move a business across the line.
This page focuses on that perimeter and on the compliance programme that follows. If you already know which licence you need and want to prepare the application, our page on fintech licensing in Singapore covers applications, admission criteria and licence conditions.
The regulatory framework: activity-based rules
The Monetary Authority of Singapore (MAS) is the single regulator for banking, insurance, capital markets and payments. Its approach is technology-neutral: a regulated activity carried out through an app is treated the same as one carried out over a counter. The analysis therefore starts with a list of the activities the business performs, not with its label.
The main statutes are the Payment Services Act 2019 (PS Act), the Securities and Futures Act 2001 (SFA), the Financial Advisers Act 2001, the Banking Act 1970, the Insurance Act 1966 and the Financial Services and Markets Act 2022 (FSMA). FSMA is an omnibus Act that gives MAS cross-sector powers, including on technology risk management, prohibition orders and the regulation of digital token service providers operating from Singapore.
| Activity | Main statute | Typical authorisation | Perimeter question to answer |
|---|---|---|---|
| E-wallets, payment gateways, remittance, merchant acquiring | PS Act | Standard or Major Payment Institution licence | Do we accept, hold or transmit customer money, and at what monthly volume? |
| Crypto exchange, custody, transfers | PS Act; FSMA Part 9 for overseas-only services | MPI licence with DPT service | Are the tokens payment tokens or capital markets products? |
| Investment platforms, robo-advice, tokenised securities | SFA; Financial Advisers Act | Capital markets services licence; financial adviser licence or exemption | Are we dealing, managing, advising or operating a market? |
| Equity or debt crowdfunding | SFA | CMS licence and offer exemptions | Are we offering securities to the public, and under which exemption? |
| Consumer lending, buy now pay later | Moneylenders Act 2008; Banking Act; industry codes | Moneylender licence, exclusion or bank partnership | Whose balance sheet funds the credit, and who are the borrowers? |
| Insurtech distribution | Insurance Act; Financial Advisers Act | Insurer, broker or adviser status | Are we arranging or advising on insurance contracts? |
| Regtech, data and SaaS vendors | Usually none directly | Contractual outsourcing obligations | Will regulated clients treat us as a material outsourcing provider? |
Perimeter analysis: the key decisions
A perimeter analysis maps each product flow against these statutes and records why a licence is or is not required. Done properly, it is the most valuable document a fintech holds: it supports fundraising due diligence, bank onboarding, MAS engagement and later audits. Fintech regulation in Singapore is detailed enough that a short email opinion rarely survives contact with an investor's counsel.
Who touches the money?
If funds pass through your accounts, even briefly, you may be providing a payment service. Models where a licensed partner holds funds and you supply only technology can sit outside the PS Act, but only if the contracts and flows actually work that way.
What is the asset?
Tokens, fractional interests and yield products need classification. A token conferring rights like a share or debenture is a capital markets product under the SFA, not a digital payment token. MAS's guidance on digital token offerings is the starting point.
Who is the customer?
Retail, accredited and institutional customers attract different protections. Several MAS regimes relax requirements for accredited or institutional investors, which can change both licensing and conduct obligations.
Where is the service provided?
Serving Singapore users from overseas can still engage Singapore law, and serving only overseas users from Singapore can engage FSMA Part 9 for digital token services. Location of staff, servers and marketing all matter.
Partner, license or test in a sandbox
There are three practical routes once a regulated activity is identified. A business can partner with a licensed institution that carries the regulated activity, obtain its own licence, or test the model under MAS's sandbox arrangements. Partnering is fastest but cedes control and margin. A licence gives independence but brings capital, compliance staff and ongoing cost. The sandbox suits genuinely novel models that need relaxed requirements for a defined period.
MAS runs a bespoke FinTech Regulatory Sandbox, a faster Sandbox Express for low-risk activities whose risks are well understood, and Sandbox Plus, which since 1 January 2022 has offered one-stop assistance and, for first movers, a grant covering 50% of qualifying expenses up to S$400,000. MAS also warns the public about firms falsely claiming to be in the sandbox, so marketing references must be accurate.
MAS regulates what a product does, not what it is called. The perimeter moves every time the money flow changes.
Building the compliance programme
Once a business is regulated, or acts as a vendor to regulated firms, a defined set of MAS expectations applies. Many apply in whole or part to unregulated vendors through contract, because banks and licensed institutions must flow them down.
Technology and cyber risk
MAS's Technology Risk Management Guidelines set expectations on board oversight, software development, access control, resilience, cyber surveillance and incident response. Binding cyber hygiene notices add requirements on administrative accounts, security patching, security standards, network perimeter defence, malware protection and multi-factor authentication. Incident notification duties run to hours, not days, so the escalation path must be written down and tested.
AML/CFT
Each sector has its own MAS AML/CFT notice: Notice 626 for banks, PSN01 and PSN02 for payment services, and parallel notices for capital markets intermediaries. Each requires a risk assessment, customer due diligence, ongoing monitoring, suspicious transaction reporting and screening against targeted financial sanctions. MAS's AML/CFT pages collect the notices and guidance. The AML and CFT controls guide explains how to scale controls for a growing platform.
Outsourcing, data and conduct
MAS's Guidelines on Outsourcing apply to financial institutions other than banks, with a separate regime for banks. They require due diligence, contractual audit and access rights for MAS, and exit plans. The Personal Data Protection Act 2012 applies to all customer data. The E-payments User Protection Guidelines and the Shared Responsibility Framework for phishing scams allocate losses between institutions and customers. Advertising must be fair and balanced, and MAS has issued guidance on digital advertising and influencer marketing by financial institutions.
Data, models and AI
Fintechs increasingly use machine learning for credit scoring, fraud detection and personalised advice. MAS's FEAT principles on fairness, ethics, accountability and transparency set expectations for the use of AI and data analytics in financial services, and regulated firms are expected to govern models with the same discipline as other material risks. In practice that means an inventory of models, documented validation, human oversight of significant decisions and the ability to explain outcomes to customers. Personal data used to train or run models must also meet PDPA consent, purpose and transfer rules. Our AI governance page covers model governance in more detail.
A practical compliance roadmap
Fintech regulation in Singapore rewards businesses that sequence their compliance work. The steps below are typical for a company launching a new product or entering the market.
- Map the product flows. Document how money, assets and data move between customer, platform, partners and banks, using diagrams that engineering and compliance both sign off.
- Perimeter memo. Analyse each flow against the PS Act, SFA, Financial Advisers Act, Banking Act, Moneylenders Act and FSMA, with reasons and any assumptions that must stay true.
- Choose the route. Decide between partnership, licence, exemption or sandbox, and model the cost, timeline and control trade-offs of each.
- Gap analysis. Compare current policies, systems and people against the MAS notices and guidelines that will apply, including technology risk, AML/CFT and outsourcing.
- Policies and controls. Draft the compliance manual, risk assessments, onboarding and monitoring procedures, incident response and complaints handling.
- Governance. Appoint accountable senior managers, set up board reporting and define who owns each MAS obligation.
- Test before launch. Run controls testing, including an independent review of AML/CFT and technology controls where the business is licensed or about to be.
- Monitor change. Track MAS consultations and product changes, and re-run the perimeter memo before each significant feature release.
Documents and evidence to keep
MAS, banks and investors ask for the same core evidence. Keeping it current turns diligence and inspections from emergencies into routine.
- Perimeter memo with product flow diagrams and dated assumptions.
- Enterprise-wide AML/CFT risk assessment and the policies built on it.
- Technology risk framework, incident response plan and recent penetration test results.
- Register of outsourcing arrangements, with due diligence and exit plans for material ones.
- Customer terms, risk disclosures and the approval trail for marketing materials.
- Board and committee minutes showing oversight of compliance and technology risk.
- Complaints log and root-cause analysis.
- Regulatory correspondence, including any sandbox conditions or MAS feedback.
Write the perimeter memo before you raise money, not after. Investors' counsel will ask whether the business needs a licence. A reasoned, dated analysis that matches the live product answers the question; a promise to "look into it" can delay closing or lower the valuation.
Risks and common mistakes
Relying on a partner's licence that does not cover your role
Many fintechs launch under a bank or licensed payment institution's umbrella. That works only if the partner genuinely carries the regulated activity and the contracts, funds flow and customer communications reflect that. If the fintech in practice controls customer funds, sets terms or holds itself out as the provider, it may be carrying on the activity itself. Review the arrangement against the actual flows, and make sure marketing names the licensed party accurately. Our guide to fintech partnerships covers the contract points.
Feature creep across the perimeter
A payments app adds a savings feature; a software platform starts holding client float; an investment app adds token trading. Each change can trigger a new licence class or a new set of conduct rules. Build a regulatory checkpoint into the product release process, so legal review happens before code ships rather than after customers rely on the feature. Fintech regulation in Singapore expects firms to manage this themselves.
Treating offshore structures as a full answer
Booking a business offshore does not remove Singapore regulation if the service is actively provided to Singapore users, or if staff in Singapore carry out regulated activities. For digital token services, FSMA Part 9 catches Singapore entities serving only overseas customers, and MAS has said it will grant such licences only in extremely limited circumstances. Map where people, systems and marketing actually sit.
Under-investing in AML/CFT
AML/CFT failures are among the most common causes of MAS action against payment and digital asset firms. Weak points include generic risk assessments, onboarding that does not verify beneficial owners, transaction monitoring rules that never fire, and slow suspicious transaction reporting. Fix the risk assessment first, because every other control depends on it, and test that alerts are reviewed and documented.
Vendors ignoring flowed-down obligations
Regtech and SaaS providers often assume MAS rules do not affect them. Their regulated customers must, however, impose audit rights, data location controls, incident notification and termination assistance under MAS outsourcing expectations. Vendors who prepare a standard financial services addendum and evidence of controls win procurement faster and negotiate from a stronger position. Our cloud and outsourcing page explains the usual terms.
Supervision, inspections and enforcement
Fintech regulation in Singapore does not end at launch. MAS supervises licensed firms through regulatory returns, thematic reviews, on-site inspections and ad hoc information requests. Firms in the sandbox are monitored against the conditions MAS set when it approved the experiment, and must show they can meet full requirements before exiting.
MAS's enforcement toolkit includes reprimands, composition penalties, civil penalties, licence conditions, revocation and, under FSMA, prohibition orders that bar individuals from performing functions across the financial sector. Unlicensed activity is a criminal offence under the relevant Acts, and MAS publishes an Investor Alert List of entities that may have been wrongly perceived as licensed or authorised.
Handling an MAS request well
Supervisory letters usually set short deadlines. The response should be accurate, complete and consistent with what the firm has told MAS before. Before replying, assemble the facts, check them against the perimeter memo and policies, identify any breach honestly and propose remediation with dates. Where a matter could become an investigation, preserve documents and consider privilege at the outset. Our investigation and crisis response team coordinates that work.
Firms that self-identify problems, report them promptly and remediate convincingly are generally better placed than those whose problems MAS finds first. Senior managers should know which issues must be escalated to MAS, and who decides.
The cross-border angle
Singapore is often the regional hub for a fintech group that also operates in Bangladesh, Indonesia, Vietnam or the Gulf. Each market regulates differently. A remittance corridor between Singapore and Bangladesh, for example, needs Singapore licensing for the Singapore leg and Bangladesh Bank requirements for inbound remittance distribution, and the two compliance programmes must agree on customer due diligence.
UK and EU regulators expect similar perimeter discipline, and a business authorised in London will find many concepts familiar, but licences do not passport into Singapore. UAE groups using Singapore as an Asian base often coordinate between MAS and the Dubai or Abu Dhabi regulators. Chinese technology providers supplying Singapore institutions face outsourcing and data transfer scrutiny. We coordinate counsel across TRW & Co's network so that one product does not run on inconsistent legal analyses.
Where Singapore court or tribunal representation is required, for example in a regulatory dispute, we work alongside Singapore-qualified counsel.
How TRW & Co helps with fintech regulation in Singapore
We work with founders, product and compliance teams, and investors. Our role is advisory: we analyse the perimeter, design compliance programmes and prepare engagement with MAS, without promising regulatory outcomes.
Perimeter memos
We map product flows against Singapore financial legislation and produce a reasoned, dated analysis that can be shared with investors, banks and auditors.
Compliance frameworks
We draft compliance manuals, AML/CFT risk assessments and policies, technology risk documentation and outsourcing registers scaled to the size of the business.
MAS engagement
We prepare sandbox applications, consultation responses and queries to MAS, and help clients respond to supervisory requests and inspections.
Investor and partner diligence
We run regulatory due diligence on fintech targets for venture capital investors and negotiate bank and platform partnership agreements.
See our practices for related work, including payment services and data protection, or contact us to discuss a product.
Checklist for decision-makers
- Do we have a current, written perimeter analysis for every live product and planned feature?
- Does the money flow in practice match the flow described in our partner contracts?
- Have we classified every token or digital asset we touch, with reasons?
- Is there a regulatory checkpoint in the product release process?
- Is our AML/CFT risk assessment specific to our customers, products and corridors?
- Can we notify MAS of a serious technology incident within the required timeframe?
- Do our marketing materials, including influencer content, meet MAS advertising expectations?
- Does the board receive regular reporting on fintech regulation in Singapore and on our compliance status?
A business that can answer yes to each question is well placed to grow, raise capital and engage MAS with confidence.
Frequently asked questions
01How do we know whether our fintech product needs an MAS licence?
Map how money, assets and data move through the product, then test each activity against the Payment Services Act, Securities and Futures Act, Financial Advisers Act, Banking Act, Moneylenders Act and FSMA. Key questions are whether you hold or transmit customer funds, what kind of asset is involved, who the customers are and where the service is provided. Record the analysis and its assumptions in a dated memo, and revisit it whenever the product changes.
02Can we operate under a partner's licence instead of getting our own?
Often yes, if the licensed partner genuinely carries out the regulated activity. The contracts, funds flow and customer communications must all show the partner as the provider. Problems arise where the fintech in practice controls funds, sets customer terms or markets itself as the provider. Partnership is fast but limits control and margin, so many firms use it to launch and plan their own licence later.
03What is the difference between Sandbox, Sandbox Express and Sandbox Plus?
The Regulatory Sandbox is bespoke, for complex models needing tailored relaxations. Sandbox Express is a faster route for activities whose risks are low and well understood, using pre-defined rules. Sandbox Plus, effective from 1 January 2022, widened eligibility, streamlined applications and added a financial grant for first movers of 50% of qualifying expenses, capped at S$400,000. Sandbox participation is time-limited and conditional, and firms must plan to exit into full compliance.
04Do MAS technology risk rules apply to unregulated vendors?
Not directly, but regulated customers must impose them through contract. MAS expects banks and licensed institutions to manage outsourcing and technology risk, including audit rights, MAS access, incident notification, data controls and exit arrangements. Vendors serving Singapore financial institutions should expect these terms in procurement and benefit from preparing a standard financial services addendum and evidence of their controls.
05Does Singapore regulate buy now pay later?
Buy now pay later arrangements can engage the Moneylenders Act or Banking Act depending on who provides the credit and to whom, and providers have also operated under an industry code of conduct. The analysis depends on whether the provider lends its own money, whether it charges interest or fees, and whether borrowers are individuals. Check the current regulatory position and any applicable code before launching or partnering with a provider.
06We are an overseas fintech. Does serving Singapore customers trigger regulation?
It can. Actively providing a regulated service to Singapore users, or having Singapore-based staff perform regulated activities, can engage Singapore licensing even if the business is booked offshore. Marketing aimed at Singapore, local payment rails and local staff are all relevant. For digital token services, FSMA Part 9 also catches Singapore entities that serve only overseas customers. Take advice before targeting Singapore users or hiring locally.
07What are the most common MAS compliance failures for fintechs?
AML/CFT weaknesses are frequent: generic risk assessments, incomplete beneficial ownership checks, transaction monitoring that is not tuned to the business and slow suspicious transaction reporting. Other recurring issues include weak technology risk governance, undocumented outsourcing and marketing that overstates regulatory status. Most are fixable with a specific risk assessment, clear ownership of each obligation and regular testing.
Sources and official materials
- Payment Services Act 2019 — Licensing of payment and DPT services
- Financial Services and Markets Act 2022 — Cross-sector MAS powers, technology risk, DTSPs
- MAS: FinTech Regulatory Sandbox — Sandbox, Sandbox Express and Sandbox Plus options
- MAS: Sandbox Plus — Eligibility and first-mover grant
- MAS: Technology Risk Management Guidelines — Technology and cyber risk expectations
- MAS: Anti-money laundering — Sector AML/CFT notices and guidance
- Securities and Futures Act 2001 — Capital markets products and services
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
Talk it through
before you decide.
Share the decision, the jurisdictions and the timetable. A partner will tell you what matters, what can wait and what it will take.