Payment Services Act Crypto Provisions: Global Compliance Guide

You’re running a crypto exchange. You’ve got users, volume, and maybe even a few million in the bank. But if you’re operating across borders, you’re likely staring down a regulatory wall that’s getting higher every month. The term "Payment Services Act" (PSA) isn’t just one law; it’s a shorthand for a patchwork of strict rules hitting Singapore, Japan, the EU, and the US. If you miss a deadline or misclassify a token, you don’t just get a fine-you get shut down.

Why does this matter right now? Because the grace periods are ending. Singapore’s hard stop was June 30, 2025. The EU’s major authorization shift hits March 2, 2026. And the US is finally trying to clarify who owns what with the CLARITY Act. This guide breaks down exactly what these provisions require, so you can keep your lights on and your users happy without drowning in legal jargon.

Singapore’s Zero-Tolerance Approach

If you operate in Asia, Singapore is where things get real fast. The Monetary Authority of Singapore (MAS) doesn’t do "we’ll look into it." Under the Financial Services and Markets Act (FSMA), which houses their PSA-equivalent crypto provisions, the deadline for full compliance was June 30, 2025. That date has passed. There were no extensions. No grace periods. If you didn’t have your license by then, you had to cease operations immediately.

What did they actually demand? It wasn’t just paperwork. MAS focused heavily on consumer protection. They banned credit card purchases of cryptocurrencies to stop people from going into debt on volatile assets. They mandated strict risk disclosures. You couldn’t just slap a disclaimer at the bottom of the page; you had to assess customer suitability. Did this user understand what they were buying? Were they being sold high-risk products they couldn’t handle?

Then there’s the Travel Rule. This is a technical nightmare for many. When processing transfers above specific thresholds, both the sending and receiving platforms must share detailed customer information. It doesn’t matter if you’re using Bitcoin or Ethereum; the data requirement remains. For many startups, implementing this level of data sharing required significant tech overhauls. If you skipped it, you weren’t just non-compliant; you were invisible to regulators, which is worse than being visible and fined.

The EU’s PSD2 and MiCA Collision

Cross into Europe, and the rules change shape. Here, we aren’t looking at a single "PSA" but the interplay between the Payment Services Directive 2 (PSD2) and the new Markets in Crypto-Assets (MiCA) regulation. The European Banking Authority (EBA) stepped in to clear up the confusion, issuing guidance that changes how we view crypto transfers.

As of March 2, 2026, National Competent Authorities (NCAs) will start requiring PSD2 authorization for certain crypto services. Why? Because the EBA views the transfer of crypto assets as a payment service. If you hold custody of a user’s digital wallet, that might qualify as a payment account. This triggers Strong Customer Authentication (SCA). You need two-factor authentication not just for logging in, but for initiating Electronic Money Token (EMT) transfers.

However, there’s a catch. The framework explicitly excludes simple exchanges-like swapping Bitcoin for Euro or Bitcoin for Ethereum-from PSD2 licensing. Those fall under MiCA. But if you’re facilitating payments, you’re in PSD2 territory. This distinction saves many exchanges from double-licensing headaches, but it requires precise operational mapping. Do you offer a debit card linked to crypto balances? That’s a payment service. Do you just let people trade? That’s MiCA. Getting this wrong means applying for the wrong license.

Japan’s Evolution from Virtual Currency to Crypto Assets

Japan was one of the first countries to regulate crypto seriously, back in 2016. But they haven’t rested on their laurels. The Japanese Cabinet approved significant amendments to their Payment Services Act in March 2025. These updates address the gaps left by earlier laws, particularly around stablecoins and derivatives.

The core philosophy here is security through separation. Since the 2019 amendment, enforced in 2020, cold wallet storage has been mandatory for most user assets. You can’t keep all your eggs in the hot basket. The 2025 updates refine this further, introducing a three-tier licensing system (Type 1, 2, and 3) that scales requirements based on the complexity of your services. If you’re handling stablecoins, you face stricter capital adequacy rules. If you’re offering derivatives, you need advance reporting-not just telling regulators after the fact, but before you launch the product.

This proactive approach means Japanese exchanges spend more time on compliance infrastructure than marketing. Advertising rules are tight. You can’t promise profits. You can’t use misleading terms like "virtual currency" anymore; the legal term is now "crypto assets." This linguistic shift matters because it aligns Japan with global standards, making cross-border partnerships easier but raising the bar for local players who relied on vague terminology.

The US CLARITY Act: Dividing the Pie

Across the Pacific, the United States has been struggling with a "regulation by enforcement" model. The proposed CLARITY Act aims to fix this by drawing clear lines. Currently, the SEC claims jurisdiction over almost everything, while the CFTC handles commodities. This creates chaos for projects that fit neither category perfectly.

The CLARITY Act proposes dividing digital assets into three buckets: digital commodities, investment contract assets, and permitted payment stablecoins. This classification determines who regulates you. If your token is a commodity, the CFTC takes the lead. If it’s an investment contract, the SEC steps in. The goal is to allow broker-dealers and alternative trading systems (ATSs) to handle digital commodities without fear of sudden SEC lawsuits. It also modernizes recordkeeping, acknowledging that blockchain itself can serve as a book of record. For DeFi protocols, the Act offers potential exemptions, recognizing that decentralized entities shouldn’t always be treated like centralized banks.

While not yet fully enacted, the direction is clear: the US wants clarity, not crackdowns. But until the final text is signed, US-based providers are stuck in limbo, often complying with the strictest interpretation of both agencies to stay safe.

Navigating Cross-Border Complexity

So, what does this mean for a global operator? It means you can’t have a one-size-fits-all compliance strategy. A feature that works in the EU might be illegal in Singapore. A custodial model accepted in Japan might trigger different licensing needs in the US.

Consider the Travel Rule. In Singapore, it’s absolute. In the EU, it’s tied to PSD2 payment definitions. In the US, it’s part of broader BSA/AML frameworks. Your tech stack needs to be flexible enough to toggle these rules on and off per jurisdiction. You need robust KYC (Know Your Customer) processes that feed into automated compliance engines. Manual checks won’t cut it when you’re processing thousands of transactions daily across three continents.

Also, watch your cash flow. Compliance costs money. Implementing SCA in Europe, upgrading cold storage in Japan, and hiring legal counsel for US classification issues adds up. Many smaller firms are consolidating or exiting markets they can’t afford to police properly. If you’re a startup, budget for regulatory overhead from day one. Don’t wait until you’re profitable to think about licenses.

Practical Steps for Compliance

Don’t panic. Break it down. First, map your services against each jurisdiction’s definition of a "payment service." Are you moving value? Or just exchanging assets? Second, audit your current tech stack. Does it support the Travel Rule? Can it enforce SCA? Third, review your marketing materials. Remove any language that promises returns or uses outdated terms like "virtual currency." Fourth, engage with local regulators early. Most authorities prefer dialogue over surprise inspections.

Finally, keep an eye on the horizon. Regulations evolve. The EU’s MiCA implementation is still rolling out. The US CLARITY Act faces legislative hurdles. Japan’s 2025 amendments are awaiting detailed implementation guidelines. Staying compliant isn’t a one-time project; it’s an ongoing conversation with your government.