A Mauritius company proposes to safeguard digital assets for funds represented by Singapore fund managers. This composite hypothetical concerns private-key control, transaction approvals and reconciliation; it describes no actual licensed business. The decision is whether to seek Singapore permission, supply a Singapore custodian, or restrict the initial service to infrastructure. The proposed custody service accepts only customers that qualify as institutional investors and tokens classified as digital payment tokens (DPTs), without capital-markets-product features. It excludes retail customers, trading, lending, staking, leverage and reuse of assets.
Executive Summary
- Launch infrastructure only until the customer, permission and control conditions are satisfied. Develop a Singapore-led custody service as the next stage: the Singapore provider contracts with the fund and retains responsibility for the service. Mauritius supplies disclosed functions under a separate agreement. This recommendation depends on genuine allocation of authority, not a subcontracting label. (MAS, Guidelines on Outsourcing (Financial Institutions other than Banks), 24 January 2025, paras. 1.1, 5.2, 5.5.)
- A granted Mauritius Class R permission is the relevant starting point for virtual-asset custody performed in or from Mauritius. An application does not establish permission to start. The FSC category is VA-1.3, Virtual Asset Custodian. (Virtual Asset and Initial Token Offering Services Act 2021, ss. 3(1), 7–9 and Second Schedule; FSC, Codified List, VA-1.3.)
- Retaining direct custody contracts makes the provider’s own Singapore licensing assessment central. MAS’s payment-service guidance requires an appropriate licence for payment-service business in Singapore unless exempt. Institutional clientele alone does not establish an exemption. (MAS, Guidelines on Licensing for Payment Service Providers, PS-G01, revised 8 October 2025, paras. 2.1–2.3.)
- Shared signing authority can constitute custody. MAS expressly treats non-exclusive control as relevant and distinguishes a non-custodial software supplier that never controls keys or participates in transactions. A Mauritius approval share cannot be presented as infrastructure only. (MAS, Frequently Asked Questions on the Payment Services Act, 19 April 2024, question 26, case studies 3–4.)
- Singapore-based personnel must retain the control expected by MAS for the proposed Singapore-led service. Offshore key shares can fit that expectation when Singapore authorisation remains necessary. The fund manager must separately approve the custodian under the fund’s mandate and applicable custody duties. (MAS, PS-G03, para. 3.4.8 and Annex 1, illustration 3; MAS, SFA 04-G05, revised 3 September 2025, para. 4.1.1.)
- MAS’s June 2025 restriction concerns the overseas-only digital-token-provider model. MAS expressly distinguished providers serving Singapore customers. That statement neither bars this Singapore-facing proposal nor grants it permission. Tokenised securities require a separate capital-markets assessment. (MAS, “MAS Clarifies Regulatory Regime for Digital Token Service Providers”, 6 June 2025, paras. 2–3; MAS, Guide on the Tokenisation of Capital Markets Products, 14 November 2025, paras. 2.1–2.3.)
The proposed service and the initial launch boundary
The immediate recommendation is an infrastructure-only launch. The proposed later service is institutional DPT custody led by a Singapore provider with the requisite permission. This separates a service the Mauritius team can design without controlling assets from a custody arrangement that requires additional authority. The initial vendor supplies software to the custodian, with no private keys, approval shares or recovery power. The proposed Singapore digital payment token custody service begins only after the parties satisfy the launch conditions below.
For the later model, assume a non-retail fund is the custody customer and independently qualifies as an institutional investor. Its Singapore manager is a licensed fund management company outside the venture-capital-manager regime and acts under documented authority. The Singapore principal is a non-bank payment institution authorised for the relevant DPT service. The Mauritius company holds a granted Class R licence whose conditions accommodate its proposed functions. These are conditions of the recommended structure, rather than statements about an existing applicant.
MAS’s administrative guidance supplies the service-design expectations used here. Its guidelines and FAQs explain supervisory practice; they do not replace legislation or create an exemption. Binding notices impose separate duties on their addressees. The proposed arrangement therefore requires a written perimeter assessment for each entity before either accepts custody obligations. (MAS, PS-G01, paras. 1.1–1.3, 4.1.1; MAS, PS-G03, paras. 1.1.5, 1.3.2.)
Permission for a Mauritius virtual asset custodian
The Virtual Asset and Initial Token Offering Services Act 2021 (VAITOS Act) applies to business conducted in or from Mauritius. Keeping customers abroad does not remove that territorial connection. Sections 8 and 9 separate application, determination and issue of a licence. The contract should not describe an applicant as an authorised custodian. Before onboarding, obtain the grant, its conditions and the corresponding FSC record. (VAITOS Act, ss. 3(1), 7–9, 11.)
Class R covers safekeeping or administration of virtual assets or instruments enabling control. The FSC lists that permission as VA-1.3. Transaction transmission can raise a separate Class O question, so the activity map must distinguish safekeeping from transfer services. A custody grant should be matched to the complete withdrawal workflow. (VAITOS Act, Second Schedule, Classes O and R; FSC, Codified List, VA-1.2 and VA-1.3.)
The Mauritius company must preserve its own local substance. Section 10 requires a physical office and business directed and managed from Mauritius. A separately managed Singapore principal is therefore preferable to a description in which every Mauritius business decision occurs in Singapore. Each company’s board, staff and delegated powers must match its actual responsibilities. The Singapore movement-control expectation concerns the Singapore service; it does not displace the Mauritius company’s home obligations. (VAITOS Act, s. 10; MAS, PS-G03, para. 3.4.8.)
Client protection survives delegation. Section 17 addresses sufficient assets of each relevant type and client ownership; section 21 requires separate accounts. The binding custody rules require protection of client rights, segregation and records. Rule 5(4) preserves the custodian’s responsibility to its client and the FSC when a third party holds assets. Neither company should promise that outsourcing removes its own accountability. (VAITOS Act, ss. 17, 21; Virtual Asset and Initial Token Offerings Services (Custody of Client Assets) Rules 2022, GN 175 of 2022, rr. 4–5.)
The FSC’s application criteria request outsourcing agreements, the delegate’s identity and the management control retained by the applicant. When a Mauritius custodian itself places assets with another custodian, the custody rules add suitability review and written-agreement requirements. The required equivalence assessment must be notified to the FSC before the relevant deposit. That notification should not be described as an automatic FSC approval. (FSC, Licensing Criteria, Virtual Asset Custodian, VA-1.3, item 22; Custody of Client Assets Rules, rr. 10–11.)
A material business change can require prior written FSC approval. The returns rules separately require immediate notice of specified developments, including material outsourcing changes and threatened client-data failures. Client disclosures must address third-party holding, liens and foreign-law recovery risks where applicable. The Mauritius company needs its own escalation and disclosure process even when the Singapore principal manages the fund relationship. (VAITOS Act, s. 13; Virtual Asset and Initial Token Offerings Services (Statutory Returns) Rules 2022, GN 179 of 2022, rr. 4–5; Virtual Asset and Initial Token Offerings Services (Client Disclosure) Rules 2022, GN 174 of 2022, r. 10.)
Mauritius investor solicitation also requires attention. Section 34A addresses direct and indirect solicitation for virtual-asset transactions or initial token offerings. Its public-access presumption makes a globally accessible promotion relevant even when a campaign describes an overseas audience. The infrastructure launch should promote software supplied to custodians, without offering to hold investor assets or inviting virtual-asset transactions. (Economic and Financial Measures (Miscellaneous Provisions) Act 2026, Act 13 of 2026, s. 56(c), inserting VAITOS Act, s. 34A.)
Token rights and the identity of the custody customer
The approved token list should separate DPTs from instruments carrying capital-markets rights. MAS examines the token’s economic substance and legal entitlements, including the complete contractual arrangement. Tokenised shares and fund units therefore require a securities or collective-investment-scheme analysis. Calling an instrument a payment token does not settle that question. (MAS, Guide on the Tokenisation of Capital Markets Products, paras. 1.5–1.7, 2.1–2.3.)
For capital-markets tokens that are specified products, select a custodian with the appropriate Securities and Futures Act (SFA) permission or applicable exemption. MAS identifies providing custodial services as a regulated capital-markets activity. Its tokenisation guide identifies securities, specified securities-based derivatives contracts and units in a collective investment scheme as specified products. A co-authorising key or shard can constitute control for this custody assessment, even without exclusive authority. Its current FAQs distinguish direct custody from assistance in depositing assets with another custodian. The DPT partner route should exclude those instruments until their particular product and activity scope has been resolved. Derivatives should not be treated as identical to shares for that assessment. (MAS, “Capital Markets Services (CMS) Licence”, 19 March 2026; MAS, FAQs on Licensing and Business Conduct (Other than for Fund Management Companies), 11 December 2025, questions 1, 53–54; MAS, Guide on the Tokenisation of Capital Markets Products, paras. 4.5–4.6 and footnote 25.)
Mauritius classification requires care too. Although section 3(2) excludes specified financial representations, section 3(4) expressly permits a Class R holder to provide custody for securities tokens or other instruments approved by the FSC. That domestic provision cannot determine Singapore classification or the receiving fund’s eligibility requirements. A securities-token mandate therefore needs a separate scope decision in each jurisdiction. (VAITOS Act, s. 3(2), (4); Finance (Miscellaneous Provisions) Act 2023, Act 12 of 2023, s. 88(a).)
The actual customer must be identified before the provider applies institutional treatment. A manager signing as agent does not necessarily become the custody customer. Record the fund’s legal personality, the account holder and the manager’s authority. Assess the customer against the institutional-investor definition or, in a different model, the accredited-investor opt-in requirements. A professional manager’s involvement alone does not classify every fund it manages. (MAS, PS-G03, paras. 2.1–2.2.)
Retail custody falls outside the proposed service. Admitting retail customers would require a new review of customer-access controls, credit restrictions, asset use and disclosures. A fund offered to retail investors also requires separate fund-level analysis, even where an intermediary signs the custody agreement. Institutional onboarding should never be used to bypass the fund’s own product or investor restrictions. (MAS, PS-G03, paras. 3.7, 4.1–4.4; MAS, Guide on the Tokenisation of Capital Markets Products, paras. 3.1–3.4.)
Singapore-facing activity and the overseas-only statement
A Singapore crypto custody licence is a search description, rather than a separate licence category identified by MAS. Its payment-service licensing guidance distinguishes Standard Payment Institution and Major Payment Institution licences. The appropriate type depends on the proposed activities and applicable thresholds. The custody provider should not derive that choice from assets under custody alone. The application must map the actual services and financial flows. (MAS, PS-G01, paras. 2.2–2.3 and Appendix 3.)
The cross-border assessment must cover business location, employees, solicitation and the complete service workflow. MAS’s PSA FAQ treats the location assessment as fact-dependent and discusses solicitation separately. A Mauritius governing-law clause does not establish that Singapore activity falls outside the perimeter. Equally, the customer’s Singapore address alone is insufficient to establish every element of the foreign provider’s licensing position. (MAS, Frequently Asked Questions on the Payment Services Act, question 13.)
Use separate activity maps for the Singapore principal and the Mauritius subcontractor. Identify who markets the custody service, accepts instructions, changes wallet policies and supports withdrawals. Singapore staff performing those tasks for the Mauritius company create a different model from offshore staff supporting the Singapore principal. A business-to-business subcontract must not be treated as an exemption from the subcontractor’s own perimeter assessment. (MAS, PS-G01, paras. 2.1–2.2; MAS, Frequently Asked Questions on the Payment Services Act, questions 13, 26.)
MAS’s 6 June 2025 statement concerned digital-token providers serving only overseas customers under the Financial Services and Markets Act (FSMA) regime. MAS said the licensing bar was high and it would generally not issue licences for that model. It expressly distinguished providers serving customers in Singapore under the existing sectoral regimes. The proposed Singapore-facing service therefore should not be rejected merely by quoting the overseas-only statement. (MAS, “MAS Clarifies Regulatory Regime for Digital Token Service Providers”, paras. 2–3.)
The FSMA branch becomes relevant if the group establishes a Singapore entity or business serving overseas customers within the statutory categories. MAS’s DTSP licensing guidance distinguishes Singapore corporations from the individual and partnership categories. A Mauritius company does not become a Singapore overseas-only provider merely because it seeks Singapore funds as customers. Any later international service must be mapped separately to the appropriate sectoral or DTSP route. (MAS, Guidelines on Licensing for Digital Token Service Providers, May 2025, paras. 1.1, 2.2–2.3, 3.1.)
The manager’s independent-custody decision
The licensed fund manager in this model must make its own custody decision. MAS’s fund-management guidance expects independent custody with suitable custodians authorised in their respective jurisdictions. The guidance does not impose a universal Singapore-only location rule. The manager must assess the proposed foreign custodian rather than assume that any FSC permission makes the appointment acceptable. (MAS, Guidelines on Licensing and Conduct of Business for Fund Management Companies, SFA 04-G05, revised 3 September 2025, para. 4.1.1.) The DPT-only restriction concerns the custody allocation, not the manager’s entire investment business. MAS states that a company ultimately investing in non-capital-markets products would not qualify for a fund-management licence. That different business requires its own activity and exemption assessment. (MAS, SFA 04-G05, paras. 3.3.5, 3.5.)
The fund’s constitution, offering document, investment-management agreement and custody mandate may impose narrower conditions. For the proposed model, the manager should confirm authority to hold the selected DPTs and appoint the Singapore principal with a Mauritius delegate. A mandate requiring a bank, named institution or particular location defeats the proposed appointment unless validly changed. The recommendation assumes that this document review permits the selected structure.
MAS also expects fund managers to address digital-asset risks and disclose the custody jurisdiction and associated legal risks. Independent valuation and reporting remain separate from custody. The manager should reconcile the custodian’s statements with the fund administrator’s records and preserve an independent route for investigating discrepancies. These are continuing manager responsibilities after appointment. (MAS, SFA 04-G05, paras. 4.1.2–4.1.4(i).)
A separately authorised Singapore service
The direct-service route fits a group that wants its own Singapore custody relationship. Under the proposed version, a Singapore subsidiary contracts with the fund through its authorised manager. The subsidiary holds the relevant payment-service permission and bears the customer-facing custody obligations. The fund remains the beneficial owner under the intended trust and custody arrangements; the provider’s Singapore personnel control authorised movements. Mauritius participates only under a separately assessed contract. (MAS, PS-G01, paras. 2.1–2.3; MAS, PS-G03, paras. 3.2–3.4.)
The Singapore entity would require substantive operations, competent management, compliance resources and financial capacity. MAS’s application guidance calls for a legal opinion and an independent assessment for new DPT applications. Its process also addresses technology and cybersecurity assessment before grant. A local incorporation and an overseas group licence do not establish operational readiness. (MAS, PS-G01, paras. 3.1.1–3.1.10, 4.1.1, 4.1.5–4.1.14.)
In this design, the Singapore entity owns the customer incident and MAS reporting process. Named Singapore signers and any authorised Mauritius co-signers hold the relevant keys or shares. Customer terms identify the contracting entity, custody arrangements, foreign functions, fees, loss allocation and recovery process. The group should take this route if it retains the direct custody proposition and can staff the responsibilities that accompany it. (MAS, PS-G03, paras. 3.3–3.5; MAS Notice FSM-N13, paras. 7–9.)
A Singapore principal with a Mauritius subcontractor
The preferred later structure places a properly authorised Singapore custodian between the fund and the Mauritius service provider. The fund contracts with that principal; Mauritius contracts with the principal for specified custody operations. Singapore owns customer acceptance, instruction validation, movement approval and the customer incident process. Mauritius may provide an expressly disclosed co-signing function and reconciliation. This is a proposed allocation of work, not a conclusion that the Mauritius entity needs no Singapore permission.
Where Mauritius holds a key share or approves withdrawals, describe its function as sub-custody or custodial operations. MAS’s control analysis includes shared authority. The subcontract must therefore identify the actual powers held by Mauritius rather than describe them as software support. The Singapore principal must retain the ability to supervise the function and return assets through the agreed controls. (MAS, Frequently Asked Questions on the Payment Services Act, question 26, case study 3; MAS, PS-G03, para. 3.4.8.)
The parties must distinguish operational outsourcing from a separate custody-account placement. MAS lists custody operations among outsourcing examples, but generally excludes maintaining specified custody accounts under the SFA conduct regulations. The substance of the chosen relationship determines which requirements apply. The proposed DPT arrangement requires a safeguarding analysis in addition to the outsourcing assessment. (MAS, Guidelines on Outsourcing (Financial Institutions other than Banks), Annex 2, paras. 1(c), 2(a)(i); MAS, PS-G03, paras. 3.2–3.3.)
The subcontract should specify audit access, regulator access, restrictions on further delegation, incident escalation and exit assistance. The fund’s disclosures should name the foreign custody role and explain the agreed recourse if that provider fails. They should distinguish ownership of assets from operational control of keys. A structure in which Singapore merely invoices while Mauritius controls the entire service fails the recommended allocation of responsibility. (MAS, Guidelines on Outsourcing (Financial Institutions other than Banks), paras. 5.5, 5.9–5.10; MAS, PS-G03, paras. 3.3.4, 3.4.8–3.4.9.)
Infrastructure without custody or transaction authority
The infrastructure route requires the narrowest operational scope. The Mauritius vendor contracts with the custodian to supply deployable software, maintenance and read-only reconciliation tools. The custodian holds every production key, share and recovery credential. Its personnel control transactions and customer assets. The vendor does not receive customer withdrawal instructions or operate a transaction-approval service.
MAS’s non-custodial wallet illustration excludes a supplier that never holds or controls the keys and has no role in the transaction process. Mauritius separately excludes specified ancillary products and services supplied to virtual-asset providers. These sources support the proposed narrow design; they do not establish that every product marketed as software falls outside financial regulation. (MAS, Frequently Asked Questions on the Payment Services Act, question 26, case study 4; VAITOS Act, s. 3(2)(e) and Third Schedule.)
Remove vendor-controlled recovery paths, emergency signing privileges and unilateral authority to change withdrawal rules. The custodian must approve and deploy software updates that affect those controls. A read-only reconciliation exception may be escalated for investigation, but Mauritius must not authorise the corrective transfer. Arranging transfers can raise a separate DPT-service question even without possession of assets. (MAS, Frequently Asked Questions on the Payment Services Act, questions 24, 26.)
The custodian remains the owner of customer incidents and regulatory reporting. The vendor owns remediation of its software defects and promptly informs the custodian of vulnerabilities. Customer-facing descriptions should identify an infrastructure supplier, without suggesting that it safeguards assets or carries Singapore custody permission. The vendor’s support agreement should grant the custodian access to logs and an orderly migration path. These are recommended contractual controls for the infrastructure phase.
Signing control, safeguarding and incident response
The Singapore-led design must make Singapore authorisation necessary for movement. MAS permits offshore key storage under its published expectations, but expects effective control by Singapore-resident personnel. Its illustration does not require those personnel to transact alone. Where the provider uses a safeguarding person for the trust account, MAS expects it to assess that person against the same resident-control expectation. The proposed architecture should preserve that necessary authorisation during normal operation, disaster recovery and staff replacement. (MAS, PS-G03, paras. 3.4.8–3.4.9, footnote 8 and Annex 1, illustration 3.)
Consider three shares held in Singapore, Mauritius and a third overseas location, with any two sufficient to sign. The two overseas holders can transact together, so that design does not make Singapore approval necessary. A design requiring Singapore participation avoids that particular defect, but still needs resilience and segregation-of-duty tests. An administrator or recovery process able to bypass the requirement would defeat the same control objective. This is an application of the proposed signing rule, not certification of a cryptographic implementation.
MAS’s safeguarding guidance addresses trust segregation, suitability of foreign safeguarding persons and disclosure of foreign-law recovery risks. It also expects the DPT instruments associated with at least 90% of customers’ assets deposited in trust accounts to remain, at all times, in systems without Internet or wireless connectivity. That percentage is a supervisory guideline, rather than a statutory percentage quoted here. The institutional service should document its storage policy and customer entitlements before its first deposit. (MAS, PS-G03, paras. 3.2–3.4.4.)
The Mauritius provider also needs a separate cybersecurity and continuity programme. Binding FSC rules require attention to outsourcing dependencies, external testing and business continuity. The custody rules require an annual independent technology audit. The parties should test whether a failure in either country prevents recovery or access to the records needed for withdrawals. (Virtual Assets and Initial Token Offerings Services (Cybersecurity) Rules 2022, GN 176 of 2022, rr. 4–8; Custody of Client Assets Rules, r. 7.)
The parties should test legal segregation separately from wallet separation. The proposed records must identify the fund’s entitlement through the Singapore principal and any Mauritius holding arrangement. Daily reconciliation, exception ageing and withdrawal checks are recommended operating standards for this service. Mauritius’s binding rules separately require reconciliation, record retention and action on shortfalls. A wallet address alone does not document the intended rights through both contracts. (Custody of Client Assets Rules, rr. 13–21.)
Delegation does not remove the Singapore custodian’s anti-money-laundering responsibilities. MAS Notice PSN02 governs customer due diligence, monitoring and value-transfer information for its addressees. Reliance on another institution is conditional; the notice prohibits reliance on a third party for ongoing monitoring. A Mauritius virtual-asset licence alone does not establish eligibility for the notice’s third-party reliance route. Outsourced performance under the Singapore provider’s controls must be distinguished from reliance on the delegate’s independent checks. (MAS Notice PSN02, revised 30 June 2025, paras. 6–8, 11–13.)
Name a Singapore incident commander and a Mauritius technical escalation owner. For an incident within FSM-N13’s definition, the Singapore addressee must notify MAS as soon as possible and within one hour of discovery. Its root-cause and impact report is due within 14 days of discovery unless MAS allows longer. The Mauritius provider separately makes the notices required by its home rules. Its senior executive must forthwith give written notice to the FSC if the executive has reason to believe that a cyber-reporting event is likely or has occurred. The executive must report all information in their possession within seven days of that notice. The subcontract must escalate fast enough for each company to meet its own clock. (MAS Notice FSM-N13, paras. 2, 7–8; Statutory Returns Rules, r. 4; VAITOS Act, ss. 2, 15(2).)
Launch evidence and the facts that change the route
The first legal deliverable should be an entity-by-entity activity memorandum with a token-rights schedule and customer-status record. Attach the fund mandate, draft custody agreement, subcontract and control diagram. Counsel should decide the Singapore perimeter for the Mauritius company as well as the principal. The FSC grant and any material-change approval must correspond to the proposed work. Licentium’s Web3 legal due diligence guide provides a broader checklist for reviewing token rights, permissions and custody records.
Before selecting the partner, compare its actual licence and conditions with the intended custody service. An MAS directory entry for DPT activity is a starting record, not evidence that every proposed product or delegation has been accepted. Obtain the partner’s written approval of the architecture, the manager’s custody appointment decision and advice on the intended trust and insolvency treatment. The board should make these documents conditions precedent to production custody. (MAS, Financial Institutions Directory, Digital Payment Token Service activity; MAS, PS-G01, para. 2.2; MAS, SFA 04-G05, para. 4.1.1.)
The first technical deliverable should enumerate every signing coalition, recovery credential and policy-administration right. Conduct a documented key ceremony, simulate an unavailable signer and attempt an unauthorised policy change. Test reconciliation against a deliberately introduced discrepancy and exercise the incident escalation process. For the infrastructure phase, use test assets and prove that vendor access cannot reach production signing authority. These acceptance tests implement the proposed control boundary. (MAS, PS-G03, paras. 3.4.2–3.4.5; MAS, PS-G01, para. 3.1.8.)
The route changes when the Mauritius business takes direct custody obligations, gains transaction authority, or operates its own Singapore-facing service. A key share ends the proposed infrastructure-only model. Direct fund contracts require the group to revisit its own Singapore permission rather than rely on the principal’s licence. Replacing DPTs with capital-markets instruments requires a fresh product and custody assessment. (MAS, PS-G01, paras. 2.1–2.3; MAS, Frequently Asked Questions on the Payment Services Act, question 26; MAS, Guide on the Tokenisation of Capital Markets Products, paras. 2.1–2.3.)
Other changes require the same production stop and approval process: retail admission, lending or staking, a fund mandate requiring another custodian, and recovery powers moving outside the approved control model. A loss of the necessary Singapore authorisation should suspend affected movements until control is restored. If the fund cannot accept the foreign custody chain, select a different eligible custodian rather than alter the description of the Mauritius role. (MAS, PS-G03, paras. 3.4.8–3.4.9, 3.7; MAS, SFA 04-G05, para. 4.1.1.)