What Is MAS?
The Monetary Authority of Singapore (MAS) is Singapore’s central bank and integrated financial regulator. Unlike most countries where financial regulation is split across multiple agencies, MAS has a single mandate covering monetary policy, banking supervision, insurance regulation, securities regulation, and — critically for fintech founders — the licensing and supervision of payment services and financial technology companies.
For a fintech founder building in Singapore, MAS is the regulatory authority that will determine whether your product can operate, on what terms, and under what ongoing compliance obligations. Understanding MAS is not optional. It is the prerequisite to everything else you build.
The Regulatory Frameworks You Need to Know
The Payment Services Act (PSA)
The Payment Services Act, which came into force in January 2020 and was significantly expanded in April 2023, is the primary regulatory framework for fintech companies operating in Singapore’s payments space. If your product involves account issuance, domestic or cross-border money transfer, merchant acquisition, e-money issuance, digital payment token services, or money changing — you are likely regulated under the PSA.
The PSA establishes three licence tiers: the Money-Changing Licence (narrowest scope), the Standard Payment Institution (SPI) Licence, and the Major Payment Institution (MPI) Licence. An SPI applies when business activity thresholds are below $3 million per month in payment transactions or $6 million per month in e-money float. Above these thresholds, an MPI licence is required. Capital requirements and ongoing reporting differ significantly between the two.
The Securities and Futures Act (SFA)
If your fintech product involves investment products, fund management, securities trading, or capital markets services, the SFA applies. For lending-adjacent fintechs, the relevant question is whether your product constitutes a collective investment scheme, a securities-based crowdfunding platform, or an investment advisory service. P2P lending in Singapore sits at the intersection of PSA and SFA regulation — early regulatory clarity is essential.
The Financial Advisers Act (FAA)
Companies providing financial advisory services — robo-advisors, personal finance platforms making investment recommendations, insurance-linked products — are regulated under the FAA. If your product’s core functionality involves recommending financial products to users, FAA compliance is likely in scope.
MAS does not penalise ambition. It penalises poor preparation. The founders who engage MAS early, with clear documentation of their product logic, get faster responses and more useful guidance. |
The MAS Licensing Process: What to Expect
Pre-Application: LEAP and Regulatory Sandbox
Before submitting a formal application, MAS offers two valuable entry points. The Licensing and Entity Assessment Programme (LEAP) is a structured pre-application consultation where you discuss your business model with MAS staff and get clarity on which licence class applies. This is not optional — it is the fastest way to avoid a formal application rejected on scope grounds.
The MAS Regulatory Sandbox allows fintech companies to test innovative products under relaxed regulatory requirements for a defined period. If your product is genuinely novel — operating in a grey area of existing regulation — the sandbox is a path to market that larger incumbents cannot access. Applications are assessed on whether the product is innovative, offers genuine benefit to Singapore’s financial sector, and has a credible post-sandbox compliance plan.
The Formal Application
A formal MAS licence application requires:
- A comprehensive business plan including financial projections, revenue model, and risk management framework
- Detailed product documentation — user flows, data handling procedures, business rules — reviewed for regulatory compliance
- Fit and proper assessments for all directors and substantial shareholders
- AML/CFT policy framework
- Technology risk management framework aligned with MAS guidelines
- Minimum paid-up capital ($100K for SPI, $5M for MPI in relevant payment service categories)
- Audited financial statements or management accounts
MAS targets 6 months for complete applications, but complex or novel business models can take longer. The most common cause of delay is an incomplete application. Preparation quality directly determines processing speed.
What They Mean for Your Product
- Cyber Risk Management
- System Availability
- Outsourcing and Third-Party Risk
- Data Protection
MAS Technology Risk Management Guidelines: What They Mean for Your Product
Beyond licensing, MAS publishes Technology Risk Management (TRM) Guidelines that apply to all regulated financial institutions. For licensed entities, these represent the expected standard of technology governance.
Cyber Risk Management: You need a documented cybersecurity framework covering threat monitoring, incident response, and regular penetration testing — designed into your security architecture from day one.
System Availability: MAS expects regulated entities to maintain high availability with documented recovery time objectives (RTOs) and recovery point objectives (RPOs). For critical payment systems, the expectations are stringent.
Outsourcing and Third-Party Risk: If you use third-party providers — cloud infrastructure, KYC vendors, payment processors — you are responsible for ensuring their security standards meet MAS expectations. Vendor due diligence is a compliance obligation.
Data Protection: Customer financial data must comply with both the PDPA and MAS data management requirements. Data residency, encryption standards, and retention periods are all specified.
AML/CFT: The Compliance Area That Trips Founders Most Often
AML/CFT compliance is the area where early-stage fintech founders most consistently underestimate complexity. It is not a checkbox — it is an ongoing operational programme that must be embedded into your product at the architectural level.
- Customer Due Diligence (CDD) is a mandatory gate in your onboarding — not an optional verification step
- Enhanced Due Diligence (EDD) triggers for higher-risk customers must be defined, documented, and automated
- Politically Exposed Person (PEP) screening must be integrated into onboarding and ongoing monitoring
- Suspicious Transaction Reporting to STRO is a legal obligation — your product needs a documented escalation pathway
- Transaction monitoring rules must be configured and reviewed regularly — not set once and forgotten
MAS has issued multiple enforcement actions against regulated entities for AML/CFT failures. The fines are significant. More importantly, the reputational damage in Singapore’s financial community is lasting. Building AML/CFT compliance into your architecture from day one is not a regulatory burden — it is risk management.
The MAS Fintech Office: Your Ally, Not Your Adversary
One of the things that distinguishes Singapore’s regulatory environment is MAS’s deliberate posture toward fintech innovation. The MAS Fintech Office runs the FSTI scheme providing grants for fintech projects, and actively participates in the annual Singapore Fintech Festival. MAS wants Singapore to be a fintech hub. It is not trying to obstruct innovation. It is trying to ensure innovation happens within a framework that protects consumers and maintains the integrity of Singapore’s financial system.
Founders who approach MAS as a partner — engaging early, being transparent about their business model, and seeking regulatory clarity before launch — consistently have better outcomes than those who treat regulation as an obstacle to work around.
What to Do Before You Build
If you are building a fintech product that will operate in Singapore, here is the minimum preparation before sprint one:
- Map your product against PSA, SFA, and FAA to determine which frameworks apply. If uncertain, engage a Singapore-qualified financial regulatory lawyer for a scoping opinion — a $3,000–$8,000 investment that will save you significantly more.
- Engage MAS through LEAP before your formal application. Get clarity on which licence class applies before building your compliance architecture.
- Design your AML/CFT framework as a product architecture document, not a policy document. Every CDD, EDD, PEP screening, and transaction monitoring rule should be expressed as a configurable business rule in your product.
- Build your data model to support regulatory reporting from day one. The data you need to report must be captured and stored in a format that makes reporting straightforward, not reconstructed from logs.
- Document your technology risk management framework before your licence application. Read the TRM guidelines. Design your architecture against them.
MAS compliance is not a barrier to building in Singapore. It is the standard of excellence that makes Singapore’s financial sector trusted globally. Founders who build to that standard do not just satisfy regulators — they build products that institutional partners, sophisticated investors, and enterprise clients trust. That trust is a competitive advantage.
Vikram Parikh is a Fractional CPO at Parikh Advisory, with direct experience designing MAS-compliant product architectures for B2B lending platforms and financial technology companies operating in Singapore.
