Singapore: technology regulation at a glance

Framework: Payment Services Act 2019 (PSA) administered by the Monetary Authority of Singapore (MAS), with the Financial Services and Markets Act 2022 (FSMA) Part 9 regime for Digital Token Service Providers (in force 30 June 2025), the Securities and Futures Act 2001 (SFA) for tokenised capital markets products, and a dedicated single-currency stablecoin (SCS) framework

Crypto is legal in Singapore and is one of the more comprehensively regulated jurisdictions in Asia. MAS licenses digital payment token (DPT) services under the PSA, regulates Singapore-based providers that serve only overseas clients under the FSMA DTSP regime (effective 30 June 2025, with MAS stating it will grant such licences only in 'extremely limited circumstances'), treats security tokens under existing capital-markets law, and has finalised a tailored framework for single-currency stablecoins. Retail-facing rules tightened sharply in 2023–2024 (segregation, ≥90% cold storage, ban on lending/staking retail DPTs, no credit/leverage to retail).

Framework: Voluntary, non-binding governance frameworks led by IMDA/PDPC (Model AI Governance Framework family) and the AI Verify testing toolkit, underpinned by the National AI Strategy. No comprehensive horizontal AI statute.

Singapore has chosen a pro-innovation, framework-driven approach rather than a comprehensive binding AI law like the EU AI Act. Governance rests on voluntary guidance issued chiefly by the Infocomm Media Development Authority (IMDA) and the Personal Data Protection Commission (PDPC), the Model AI Governance Framework (2019/2020), its Generative AI edition (2024), and a new Agentic AI edition (January 2026), supplemented by the open-source AI Verify testing toolkit and the National AI Strategy. Binding obligations only arise indirectly through existing sectoral and data-protection law (e.g. the PDPA and MAS guidance for financial services).

Framework: Personal Data Protection Act 2012 (PDPA), administered by the Personal Data Protection Commission (PDPC); amended by the Personal Data Protection (Amendment) Act 2020.

Singapore has a comprehensive personal-data protection regime under the PDPA 2012, which governs the collection, use, disclosure and care of personal data by private-sector organisations. It is enforced by the PDPC and is supplemented by sector regulators (MAS, IMDA, MOH). The 2020 amendments introduced mandatory data-breach notification, mandatory financial penalties of up to 10% of annual turnover, and data portability provisions.

Framework: Payment Services Act 2019 (PS Act), administered by the Monetary Authority of Singapore (MAS); digital token services additionally regulated under the Financial Services and Markets Act 2022 (DTSP regime, effective 30 June 2025).

Singapore operates a comprehensive, single-window licensing regime for digital payments and fintech under the Payment Services Act 2019, supervised by MAS. Providers of seven regulated payment services (account issuance, domestic and cross-border money transfer, merchant acquisition, e-money issuance, digital payment token services, and money-changing) must hold one of three licence classes, Money-Changing, Standard Payment Institution, or Major Payment Institution, calibrated by transaction volume and e-money float. Singapore also runs mature instant-payment rails (FAST/PayNow, SGQR) and an open-finance data exchange (SGFinDex), while BNPL is governed by an industry Code of Conduct rather than statutory licensing.

Framework: Singapore Ministry of Manpower (MOM) work-pass regime (Employment Pass, EntrePass, ONE Pass, Tech.Pass, Work Holiday Pass) plus the EDB-administered Global Investor Programme for residency-by-investment; there is no dedicated digital-nomad/remote-work visa.

Singapore has no dedicated digital-nomad or remote-work visa, and no announced plans to create one. Foreigners who want to relocate must qualify under existing MOM work passes, all of which are tied to local employment, an incorporated Singapore business, or very high earnings/achievement, while permanent residency by investment is available through the Global Investor Programme. A person merely working remotely for an overseas employer has no purpose-built pathway and would typically be limited to a short-term visit pass.

Framework: Multi-statute regime led by IMDA under the Broadcasting Act 1994 (Online Safety provisions + Codes of Practice), the Online Criminal Harms Act 2023, POFMA 2019, and the Online Safety (Relief and Accountability) Act 2025 (Online Safety Commission, from 29 June 2026)

Singapore has a comprehensive, layered online-safety regime administered chiefly by the Info-communications Media Development Authority (IMDA), backed by several statutes covering harmful content, criminal online harms, online falsehoods, and a new victim-redress framework. The Broadcasting Act's Online Safety provisions (in force since 1 Feb 2023) empower IMDA to issue Codes of Practice and content directions to designated social media and app-distribution services, while age-assurance obligations on app stores take effect from 1 April 2026. The Online Safety (Relief and Accountability) Act 2025 establishes an Online Safety Commission and direct victim claims against platforms, commencing 29 June 2026.

Framework: Cybersecurity Act 2018 (amended by the Cybersecurity (Amendment) Act 2024), administered by the Cyber Security Agency of Singapore (CSA); complemented by PDPA breach-notification rules (PDPC) and sectoral regimes such as MAS Technology Risk Management requirements.

Singapore operates a comprehensive, cross-sector cybersecurity regime anchored in the Cybersecurity Act 2018, which the CSA enforces to protect Critical Information Infrastructure (CII) across 11 essential-service sectors. The Cybersecurity (Amendment) Act 2024 broadened the framework, key provisions came into force on 31 October 2025, expanding incident-reporting duties and creating new regulated categories. Mandatory breach notification also exists under the PDPA, and sector regulators like MAS impose stricter incident-reporting timelines on financial institutions.

Framework: Companies Act 1967, administered by the Accounting and Corporate Regulatory Authority (ACRA) via the Bizfile online portal; work passes for relocating founders administered by the Ministry of Manpower (MOM).

Singapore permits 100% foreign ownership of a locally incorporated private limited company with no minimum capital beyond S$1, and online incorporation via ACRA's Bizfile is typically completed within 15 minutes of fee payment. The main requirement specific to foreigners is appointing at least one locally resident director (or authorised representative); a foreign founder who wants to relocate and run the business must separately obtain a work pass (Employment Pass or EntrePass) from MOM.