Building a Bitcoin Treasury Company in Singapore

Building a corporate Bitcoin treasury in Singapore involves navigating the country’s business regulations, financial laws, and best practices for managing crypto-assets. This guide covers the end-to-end process – from incorporating a company to strategic treasury management – with a focus on recent (2024–2025) rules and guidelines. Each section provides key considerations and references to official sources (e.g. MAS, IRAS, ACRA).

1. Legal Incorporation in Singapore

Business Structure: Most businesses in Singapore choose to register as a private limited company (“Pte Ltd”) for liability protection and professionalism. ACRA (Accounting and Corporate Regulatory Authority) governs the incorporation process. Key requirements include:

Incorporation Steps:

  1. Name Reservation: Choose a unique company name and reserve it via ACRA’s BizFile portal (a S$15 fee). Names that are identical to existing businesses or contain prohibited terms (e.g. “Temasek”) will be rejected or need approval.
  2. Prepare Incorporation Documents: These include the company Constitution (you can adopt ACRA’s Model Constitution), consent forms for directors and secretary, and identification documents of shareholders and officers.
  3. File with ACRA: Submit the incorporation application on BizFile. You will need to provide details of business activities (using Singapore’s SSIC codes), company officers, shareholders, and share capital. The government fee is S$315 (S$15 for name application + S$300 incorporation fee) . Payment is made online during filing.
  4. Approval and Business Profile: If all is in order, ACRA typically approves a straightforward application within minutes (complex cases or referrals to other authorities can take up to 14–60 days) . Upon approval, ACRA issues a Business Profile and Unique Entity Number (UEN) for the company. You can download the BizFile report as proof of incorporation.
  5. Post-Incorporation: Open a corporate bank account, obtain any necessary business licenses (discussed in the next section), and attend to annual requirements (like holding Annual General Meetings and filing annual returns). Notably, Singapore companies must file annual returns and keep proper financial records, and non-exempt companies must file financial statements .

2. Regulatory & Licensing Requirements (MAS and Others)

Regulatory Framework: In Singapore, cryptocurrencies like Bitcoin are legal to own and use, but they are not legal tender (only the Singapore Dollar has legal tender status) . Instead, Bitcoin and similar cryptocurrencies are classified as Digital Payment Tokens (DPTs) under Singapore law . The primary law regulating crypto activities is the Payment Services Act 2019 (PSA) , overseen by the Monetary Authority of Singapore (MAS).

When is a License Required? Holding Bitcoin as a treasury asset for your own company generally does not require a MAS license – simply investing corporate funds in Bitcoin or using Bitcoin to pay vendors is not a regulated activity in itself. Licensing is required, however, if your company carries out certain crypto-related services as a business. Under the PSA, regulated DPT services include :

If your company intends to engage in any of the above (for example, offering Bitcoin trading services, or custodying assets for customers), it must obtain a PSA license from MAS or qualify for an exemption. There are two tiers of licenses: a Standard Payment Institution (for smaller-scale operations) and a Major Payment Institution (for larger businesses exceeding transaction volume thresholds). Major institutions undergo more stringent requirements. As of late 2024, MAS had issued 29 DPT licenses in total , including to several well-known exchanges.

MAS Guidelines and Updates: MAS has continually tightened crypto regulations in 2024–2025 to enhance consumer protection and risk management. Key points include:

Summary: For a pure Bitcoin treasury operation (internal investment), no special crypto license is required. Bitcoin is legal for companies to hold, and you can freely convert between SGD and BTC via regulated exchanges (see Section 6 on banking). Just ensure your company’s activities don’t inadvertently cross into the realm of “providing payment services” to others. If you expand into any regulated services, be prepared to apply for the relevant MAS license and comply with capital, audit, and governance requirements that MAS imposes on DPT service providers .

3. Taxation of Bitcoin Treasury Assets

Singapore’s tax treatment of Bitcoin is relatively straightforward, with distinctions based on the nature of use (capital investment vs. trading or payments). Key points to consider:

In summary, holding Bitcoin as a capital asset is tax-efficient in Singapore – no capital gains tax on appreciation . But the moment Bitcoin is part of your trading inventory or a medium of exchange in revenue, normal income tax applies. Always convert the value to SGD for reporting, using a reasonable exchange rate source on the transaction date. When in doubt, consult the IRAS e-Tax Guide on Digital Tokens or seek professional tax advice, as this is a developing area. (Fortunately, IRAS’s positions have been consistent in recent years, providing certainty in tax planning.)

4. Corporate Governance and Internal Controls for Crypto

Holding Bitcoin on a corporate balance sheet introduces unique governance and internal control challenges. Traditional financial controls must be adapted to manage private keys, irreversible transactions, and volatile assets. Strong internal processes will protect the company’s crypto assets and ensure accountability. Key considerations include:

By establishing robust governance and internal controls, your company will mitigate risks like theft, loss of access, or financial misstatement. Many high-profile crypto losses have occurred due to basic control failures (e.g. a single employee with full access losing a laptop with the keys). Thus, corporate crypto governance should be treated with the same seriousness as traditional treasury controls, if not more.

5. Bitcoin Custody Solutions (Self-Custody vs. Third-Party)

Custody of Bitcoin refers to how and where your company’s Bitcoins are stored and secured. There are two primary approaches: self-custody (managing the crypto wallets and private keys in-house) and third-party custody (using an external custodian or service). Each has implications for security, control, compliance, and cost. Below is a comparison:

AspectSelf-Custody (In-House)Third-Party Custodian (External)
ControlFull control over private keys and transactions. Company has sole access to the crypto wallets, giving flexibility in movement of funds.Keys and assets are held by a custodian on your behalf. You rely on the custodian to authorize transactions (often with your approval). Less direct control, but also less burden on your team.
SecurityResponsibility on the company to implement strong security: e.g. use hardware wallets, multi-signature setups, cold storage (offline wallets) for long-term holdings. Security is only as good as your internal practices.Reputable custodians provide institutional-grade security (segregated cold storage, advanced encryption, physical vaults) and often carry insurance coverage for theft or hacks. They also must follow MAS regulations for custody (e.g. segregating client assets, 90% cold storage requirement) .
ComplexityRequires in-house expertise in wallet management, key storage, and transaction handling. Your IT/finance team must handle backups, key ceremonies, and stay updated on cyber threats. More operational effort day-to-day.Simpler operationally: the custodian handles most technical aspects of storage and safeguarding. They may offer user-friendly dashboards for your treasury team. This can be helpful if your team lacks deep crypto tech knowledge.
ComplianceCompany must ensure its own compliance (e.g. tracking addresses for any suspicious activity). No external oversight by default, though not offering services to others means fewer regulatory requirements. Internal controls (as in Section 4) are crucial.MAS-Licensed custodians have compliance programs (KYC/AML on their clients, audit trails, etc.) and must meet regulatory standards. Using a regulated custodian can lend credibility – MAS now requires custodians to segregate and strictly manage client assets , which reduces risk. However, you still need internal processes to oversee the custodian (reconciliations, reviewing their SOC reports, etc.).
Access & AvailabilityImmediate access to your funds at any time, since you hold the keys. But you also bear the risk of lost access if keys are mishandled. Disaster recovery (like backing up seed phrases securely) is essential.Access is mediated by the custodian – usually you use their platform to initiate transfers. Good custodians operate 24/7, but there might be procedural delays for large withdrawals (for security). The custodian likely has robust disaster recovery and can help if you lose account credentials (since they have their own key copies, with proper authentication processes).
CostLow direct costs. Aside from initial hardware (wallet devices, perhaps a safe or secure server) and staffing, there’s no custody fee. However, indirect costs include training staff and potentially higher risk if not done expertly.Custodians charge fees (could be a percentage of assets under custody or per-transaction fees). Large holdings might justify the cost for peace of mind. The custodian may also charge onboarding fees. Evaluate the fee against the cost of building equal security in-house.
InsuranceYou would need to procure insurance if desired (a challenging process – crypto crime insurance is available but can be expensive and requires demonstrating strong internal controls). Many small firms forego insurance and just rely on security measures.Many custodians include some level of insurance for client assets, especially against hot-wallet hacks or employee theft. For example, a custodian might insure the first USD $X million of loss. MAS does not mandate insurance for DPT custodians yet , but obtaining it is becoming industry norm. This means if you use a custodian, ask about their insurance coverage and what it covers (e.g. does it cover external hacks vs. insider fraud, etc.).

In practice, many companies use a hybrid approach: keep a portion of Bitcoin in-house and the rest with a third-party custodian. For instance, you might self-custody a working amount for day-to-day liquidity and entrust the bulk of holdings to a professional custodian for long-term storage (similar to how a company might keep some cash in a safe and the rest in a bank).

Choosing a Custodian: If you opt for third-party custody, choose a reputable, MAS-regulated custodian. Singapore has several, such as DBS Digital Custody (by DBS Bank), Sygnum Singapore (a crypto-focused bank), Coinhako or Crypto.com (exchanges with DPT licenses), and global players like Coinbase Custody, BitGo, and Gemini which serve Singapore clients (some have MAS in-principle approvals or partnerships). Verify their license status (MAS publishes a list of licensed payment service providers) and their security track record. Key questions include: how they store keys (deep cold storage vs. warm), how to withdraw (process and speed), fees, insurance coverage, and whether they support multi-signature or multi-approval setups for client accounts.

MAS’s 2024 rules require custodians to hold customer assets on trust and largely in cold storage, which boosts safety . It also means any custodian you use will separate your Bitcoins from their own assets (protecting you if the custodian faces issues). Nonetheless, perform due diligence: a custodian is effectively your bank for crypto, so assess its financial stability, internal controls, audit reports, and incident history.

Self-Custody Best Practices: If self-managing wallets, use hardware wallets (devices like Ledger or Trezor) rather than software on internet-connected machines, for better security. Implement multi-sig with hardware wallets stored in different locations (e.g. one in office safe, one with a director, one with a professional vault service). Keep backup seed phrases on paper or engraved metal in secure vaults – and never digitize them or email them. For additional safety, some firms use a Shamir’s Secret Sharing scheme to split a seed phrase into parts held by different people (so no single person has the full key). Regularly test that backups can restore the wallet (without actually moving funds). You may also engage a crypto security consultant to audit your setup.

Ultimately, the decision between self vs. third-party custody boils down to trust and expertise. Many Singapore businesses choose to trust regulated custodians for large holdings to leverage their security and insurance, while still keeping some control internally for agility. Whichever route, document the custody arrangement in your Crypto Treasury Policy, and ensure the Board is aware and comfortable with how the digital assets are being held.

6. Banking Relationships and Fiat On/Off-Ramps

Converting between fiat currency (SGD) and Bitcoin – and managing the fiat proceeds of Bitcoin sales – requires careful navigation of banking and payment channels in Singapore. While Singapore is a crypto-friendly fintech hub, banks worldwide have historically been cautious with crypto-related funds. Here’s how to establish and maintain the needed relationships:

As of 2025, Singapore’s banking sector, guided by MAS, is gradually harmonizing with the crypto industry. MAS has even urged banks not to practice blanket “de-risking” but to take a nuanced approach to crypto clients (apply risk management rather than outright avoidance). We see increasing integration – e.g., banks participating in Project Guardian for digital asset networks, and stablecoin regulatory frameworks being introduced . This trajectory is positive for crypto treasury operations. Still, be prepared to demonstrate strong governance and transparency to any financial partners when dealing with Bitcoin in your corporate treasury.

7. Accounting and Financial Reporting for Bitcoin Holdings

Accounting for Bitcoin on the balance sheet presents some challenges, as traditional accounting standards did not originally contemplate cryptocurrencies. In Singapore, companies apply Singapore Financial Reporting Standards (SFRS), which are largely aligned with International Financial Reporting Standards (IFRS). Here’s how to handle Bitcoin in your financial books:

In summary, accounting for Bitcoin under SFRS/IFRS currently leads to a conservative balance sheet value (often significantly below market value in a rising market) and recognition of losses when prices drop. This does not necessarily reflect true economic value but adheres to the principle of not overstating assets. Communicate this to stakeholders – e.g. via pro-forma metrics or notes – so that management’s discussion can supplement the financial statements. Always align your accounting treatment with the official IRAS tax stance as well, which fortunately is aligned (they look at whether it’s trading vs capital, etc., which your accounting classification will support) .

8. Risk Management Practices for a Bitcoin Treasury

Bitcoin can introduce several forms of risk to a corporate treasury – price volatility risk, liquidity risk, cyber risk, regulatory risk, and more. A sound risk management framework will help ensure that the benefits of holding Bitcoin are not overshadowed by unmanaged downsides. Below are important risk considerations and mitigations:

One overarching principle is to ensure that holding Bitcoin doesn’t endanger the company’s core operations. It should be an accretive treasury strategy, not a bet-the-company gambit. By quantifying the risks (e.g. using Value-at-Risk models for price risk, scenario analysis for liquidity needs, etc.), management can keep the exposure at a safe level. Always be prepared for worst-case scenarios. As BitGo (a custodian) aptly warns in its disclosures: “Digital asset holdings involve a high degree of risk, and can fluctuate greatly on any given day… your holdings may be subject to large swings in value and may even become worthless.” . Good risk management acknowledges this reality and plans accordingly, so that even if a severe downturn happens, the company survives and maintains its long-term strategy.

9. Cybersecurity and Insurance Considerations

Securing digital assets like Bitcoin requires a holistic cybersecurity approach. Unlike cash in a bank (protected by bank security) or in a safe (physical security), Bitcoin security is heavily dependent on protecting private cryptographic keys. A breach or mistake can lead to irretrievable loss. Additionally, due to the high value and pseudonymous nature, crypto assets are prime targets for hackers. Insurance can provide a backstop for certain losses, but it comes with its own conditions. Let’s break down both aspects:

Cybersecurity Best Practices for Crypto Treasury

  1. Secure Key Management: The private keys (or seed phrases) controlling your Bitcoin wallets must be safeguarded with the highest security. Use cold storage for the majority of funds – this means keeping the keys offline, on devices not connected to the internet. Hardware wallets (e.g. Ledger, Trezor) or dedicated air-gapped computers (ones never connected to a network) are common cold storage solutions. Store these in secure physical locations (a safe or vault). If using multi-signature, distribute the devices geographically (e.g. one in office safe, one in a bank’s safety deposit box, one with a trusted executive offsite). Never store private keys in plain text on any computer that is online, and never email or upload your seed phrases to cloud storage.
  2. Access Control and Authentication: Limit the number of people with access to crypto systems. Those who do have access should use strong authentication methods: complex unique passwords (stored in a password manager), and multi-factor authentication (MFA) for any exchange or custodian accounts. Prefer hardware MFA (like Yubikeys) over SMS-based 2FA to reduce SIM-swap attack risk. Ensure that if an employee with access leaves the company, you promptly revoke credentials, change passwords, and possibly rotate addresses/keys if they had significant knowledge.
  3. Secure Network Practices: The machines used to interact with crypto transactions (even just to prepare a transaction for signing) should be secure. Ideally, dedicate a specific laptop for crypto treasury operations and harden it (full disk encryption, no unrelated software installed, updated anti-malware, etc.). Use a VPN when connecting to exchanges from unsecured networks. For critical transactions, consider doing them on a wired, internal network instead of public Wi-Fi. Keep firmware of hardware wallets up to date (manufacturers like Ledger release updates to patch vulnerabilities).
  4. Segmentation and Least Privilege: In IT terms, treat crypto systems as high-security zone. Segment them from regular corporate IT. For instance, the computer used to interface with the hardware wallet could be kept off the corporate domain to reduce risk of internal threat vectors. Only install needed software (wallet software, etc.) on it. Enforce least privilege: if using a server or cloud for any crypto-related process (like running a Bitcoin node for monitoring), allow only specific IPs or users to access it. Consider using multi-user approval for logins (some identity providers allow a login to require a second admin approval).
  5. Monitoring and Alerts: Enable notifications for any activity on exchange accounts (e.g. email/SMS alerts for withdrawals above $X). If using a custodian that offers an API or dashboard, monitor it for any changes. On your own wallets, you can use blockchain explorers or notification services that will tell you if any of your cold addresses see movement (which should normally never happen unless you initiated it). Early detection of unauthorized activity is crucial to possibly intervene (though admittedly, on blockchain once a transaction is broadcast, it’s final – but you might catch internal misuse patterns early).
  6. Regular Audits and Drills: Periodically conduct a security audit of your crypto storage. This could involve an external consultant who tries to find weaknesses in your setup (penetration testing for exchange accounts, or reviewing key management process). Conduct drills, for example: simulate the scenario “Laptop with a hardware wallet was stolen” – can you use your backup seeds to restore funds to a new wallet successfully? Time these drills and document lessons. Another drill: “Key holder X is unavailable” – ensure your multi-sig still allows transaction with backups.
  7. Incident Response Plan: Despite best efforts, breaches can happen (e.g. an advanced attacker or an insider). Have a crypto incident response plan. It should include: who to alert (internal and possibly law enforcement/MAS if large theft), steps to contain (e.g. immediately move remaining funds to a new wallet if you suspect a key compromise; call custodian to freeze account, etc.), and how to communicate the incident to stakeholders. This plan should integrate with the company’s broader incident response.
  8. Employee Training and Background Checks: Humans are often the weakest link. Conduct comprehensive background checks on any employee or contractor who will handle crypto keys or sensitive crypto information – look for past fraud, financial red flags, etc. Provide specialized training to staff on social engineering risks: for instance, a common hack is phishing emails that trick users into entering wallet recovery phrases into a fake site. Make sure your team knows that no legitimate source will ever ask for the full private key or seed phrase. Train them to verify domain names of exchanges or custodian sites (to avoid phishing clones), and to be extremely skeptical of unsolicited communications. Establish clear protocols: e.g. if someone gets an email or LinkedIn message claiming to be from MAS or a bank about your crypto, they should not respond before verifying through official channels.
  9. Physical Security: Protect any physical devices (hardware wallets, backup seed phrase materials). Store backups in secure, access-controlled places. Only a very few trusted personnel should know where backups are. If using safety deposit boxes, use tamper-evident bags and dual access if possible (some companies require two people to go together to retrieve something from a vault). Likewise, in your office, keep devices in locked drawers or safes when not in use.
  10. Use of Professional Services: If managing significant value, consider services like multi-party computation (MPC) custodial solutions or key ceremony facilitators who can help generate keys in a secure way. There are also crypto security firms that offer managed custody with specialized hardware that you still partially control (giving a blend of self and third-party security). In Singapore, some firms (like Horangi, a cybersecurity firm) provide audits for smart contract and crypto-related systems – use these resources to strengthen your setup.

Insurance Considerations

Even with top-notch security, risks remain. That’s where insurance comes in as a risk transfer mechanism. In the crypto space, insurance is evolving:

In sum, cybersecurity is your first line of defense, and insurance is a last resort for when all defenses fail. Both need attention. MAS and Singapore’s tech governance culture emphasize strong technology risk management (see MAS’s Technology Risk Management guidelines, which, while written for financial institutions, contain good principles applicable here). By treating your crypto like a crown jewel asset – securing it thoroughly – and having insurance as a fallback, you create a robust safety net around your Bitcoin treasury.

10. Strategic Use Cases and Benefits of Bitcoin in Treasury Management

Incorporating Bitcoin into corporate treasury is a relatively new practice, but it can offer distinct strategic advantages. Companies like MicroStrategy, Tesla, and Block Inc. have taken the plunge, citing reasons from financial returns to hedging and operational utility. Here are the key use cases and benefits a Singapore company might realize by holding and using Bitcoin:

In conclusion, Bitcoin in a corporate treasury offers a mix of financial and strategic advantages: a potential high-return asset, a hedge against certain macro risks, improved payment flexibility, and an innovative image. MAS Deputy Chairman has noted the potential of digital assets in financial innovation (Singapore is advancing frameworks for stablecoins and tokenization ), indicating that judicious corporate adoption aligns with the country’s fintech vision. However, these benefits come with responsibilities – volatility management, stringent controls, and compliance (all the prior sections). If executed prudently, a Bitcoin treasury strategy can enhance a company’s resilience and growth in the digital era, providing both economic gains and operational optionality.

As always, it’s about balance: leveraging the upside and strategic uses of Bitcoin while controlling the risks. With Singapore’s clear regulations, supportive tax regime, and growing crypto infrastructure, the environment is well-suited for companies to responsibly integrate Bitcoin into their treasury management . By following the comprehensive approaches outlined in this guide, a company can position itself to reap the benefits of this new asset class while upholding strong governance and regulatory compliance in the Singapore context.

Sources: