The problems every Web3 and fintech founder runs into, and why where you build matters

None of the five problems comes from a single bad rule. Each comes from a decision made after the product was built. Made early, they are design choices. Made late, they are rework, and sometimes an enforcement problem.

Most founders treat regulation as something to sort out once the product works. It rarely plays out that way. Whether you’re building a payments app, a stablecoin, an exchange or a token, the same few problems keep catching teams out, and they tend to do it at the point where they’re most expensive to fix.

Here are five we’d flag first. Each one is tied to a regulator or a statute. In Part one, Infinilex sets out the problems as they play out in the EU, the US, India and the UAE. In Part two, KGP Legal looks at how Singapore’s framework deals with each of them.

Part one: five problems founders run into

Written by Infinilex · EU, US, India, UAE and international standards

1. It isn’t always clear which rulebook applies

Regulators rarely care what you call your product. They look at what it does. The Financial Action Task Force (FATF), which sets the global anti-money laundering standard for crypto, applies its rules to virtual asset service providers according to the activities they carry out.¹ In the US, FinCEN treats the question of who counts as a money transmitter as one of facts and circumstances, and its 2019 guidance applies existing rules to new business models that look different on the surface but share the same underlying facts.²

A stablecoin payment product shows how quickly this gets blurry. Is it fintech or crypto? In the EU, MiCA calls a token that tracks the value of a single official currency an e-money token. Those tokens are treated as electronic money, and the issuer has to be authorised as a credit institution or an e-money institution.³ In the US, the GENIUS Act became law in July 2025,⁴ and Treasury says that from its expected effective date of 18 January 2027, issuing a payment stablecoin in the US will generally require a federal or state licence.⁵ So a product most people would file under crypto ends up under payments-style regulation on both sides of the Atlantic.

Supervisors are still working out the boundary too. FATF’s July 2026 update says significant gaps remain in identifying the people and entities that actually carry out VASP activities.⁶ If the regulators find the perimeter hard to draw, a founder reading the rules alone will find it hard too.

2. Building first, licensing later

The order matters more than most teams expect. The EU’s MiCA transitional period ended on 1 July 2026.⁷ ESMA said that after that date, anyone providing crypto-asset services to EU clients without a MiCA licence is in breach of EU law and must stop.⁸ A June statement went further and told unauthorised providers to stop onboarding new EU clients, stop marketing and wind down in an orderly way.⁹

Dubai works similarly in practice. In October 2025, VARA fined 19 firms between AED 100,000 and AED 600,000 each and issued cease-and-desist orders for carrying on virtual asset activity without a licence and for breaching its marketing rules.¹⁰ Marketing was part of the case, so promotion needs the same care as the product itself.

Regulators set these dates, and both came with enforcement or clear warnings attached. Teams that map the licensing path before launch get to choose what to build, where and when. Teams that do it last often end up choosing under pressure.

3. Classification keeps moving

Whether a token is a security, a commodity, e-money or something else decides which regulator you answer to and what you have to disclose. It can also change over time. In March 2026 the SEC, together with the CFTC, issued an interpretation that sorts crypto assets into digital commodities, digital collectibles, digital tools, stablecoins and digital securities¹¹. It also explains how a crypto asset that isn’t itself a security can become subject to an investment contract, and how it can stop being subject to one. It replaced the SEC staff’s 2019 framework, which has been withdrawn. The SEC’s chairman described the interpretation as a bridge while Congress works on market structure legislation¹².

In August 2026 the SEC followed with a proposed Regulation Crypto Assets, with tailored offering exemptions and a safe harbour from the investment-contract test; comments close on 20 October 2026¹³. Infinilex has filed a comment on the proposal.

Two things follow. The token and the way it’s offered can be treated separately, so a design that works today may need another look when the offering changes. And the sorting differs by market: the EU splits tokens into e-money tokens, asset-referenced tokens and other crypto-assets, each with its own obligations.¹⁴ It’s worth re-checking classification whenever the product changes, not only at launch.

4. Obligations stack up across markets

A product that works in one country does not carry its compliance with it. Each new market brings its own licence, its own regulator and, often, its own definitions.

Consider a team serving customers in several places at once. In the EU, ESMA has stressed that MiCA protections apply only to the specific authorised legal entity, not to other companies in the same group and not to non-EU entities, even when they share a brand⁸. In the UK, the new regime runs on its own timetable and application process: the FCA’s application window runs from 30 September 2026 to 28 February 2027, ahead of the regime starting on 25 October 2027¹⁵.

Even where the standard is global, the timing isn’t. The FATF Travel Rule is the same on paper everywhere, yet in FATF’s 2025 survey 85 of 117 responding jurisdictions had passed Travel Rule legislation; 32 had not yet done so, though 14 of those were in the process¹⁶. The July 2026 update puts the figure at 91 of 109 respondents, alongside significant gaps in implementation more broadly⁶. Operate in several markets and you meet the same rule at different stages of maturity.

India shows how many obligations can sit on one activity. In March 2023 the Ministry of Finance notified a set of activities under the anti-money laundering law’s “designated business or profession” provision: exchanging, transferring, safekeeping or administering virtual digital assets for others in the course of business, and providing financial services tied to an issuer’s offer and sale of one.¹⁷ Separately, the Income Tax Department states that income from transferring a virtual digital asset is taxed at 30%, with no deduction other than the cost of acquisition and no set-off of losses, and that 1% TDS applies to payments made to residents for a transfer, subject to thresholds.¹⁸

The Income-tax Act, 2025 came into force on 1 April 2026 and repealed the 1961 Act. It defines a virtual digital asset and that definition expressly includes crypto-assets.¹⁹

The point is not that founders should avoid multi-market growth. It is that each market should be budgeted for, in time and money, before it is promised to investors or customers.

5. Custody gets treated as a technical detail

Custody often lands with the engineers. Regulators treat it as a regulated activity with rules of its own. Under MiCA, a firm providing custody has to enter into an agreement with each client, keep client holdings separate from its own, and answer to clients for losses caused by incidents attributable to it.²⁰ Dubai’s VARA has a dedicated Custody Services Rulebook, with a section on the segregation and safekeeping of virtual assets.²¹ And supervision is catching up. In July 2026 ESMA launched a Common Supervisory Action on the digital operational resilience of crypto-asset service providers, with a particular focus on custody: governance, key and storage management, transaction controls, incident response, smart contract risk and reliance on third parties. National authorities will carry it out from the second half of 2026 into the first half of 2027.²²

Adding custody late usually means redoing wallet architecture, client contracts and internal controls at the moment the team is under the most pressure to ship.

What ties these together

Look at the five together and a pattern appears. None of them is really about one rule. Each comes from a decision made too late: what activity the product performs, when to apply for a licence, how the token is classified, which markets to enter, and how client assets are held. Made early, those are design choices. Made late, they turn into rework, and sometimes an enforcement problem.

The other thing they share is that jurisdiction sets how hard each one is. Where a rule is open to interpretation, a cut-off is unforgiving or the framework is still changing, founders spend more time guessing and less time building. Where the rules are clearer and regulators engage early, the same five problems are easier to handle. That is why where you build deserves as much thought as what you build. In the second half of this piece, our colleagues at KGP Legal look at Singapore through that lens.

Part two: Singapore’s approach to the five problems

Written by KGP Legal LLC · Singapore law

Singapore as the regulatory answer: how purpose-built architecture eases the founder dilemma

The friction founders face across different countries often happens because old laws are being forced onto new technology. When founders hit sudden enforcement cutoffs or confusing legal tests, growth stalls.

Singapore took a more pragmatic approach. Singapore built a unified system and clear legislative framework that regulates the specific activities a business undertakes (if they fall within the regulatory ambit). Managed by a single authority, the Monetary Authority of Singapore, this framework speaks directly to several of the problems founders run into elsewhere.

1. Activity-based regulation reduces rulebook ambiguity

Under the Payment Services Act 2019 (Singapore), the Monetary Authority of Singapore regulates seven clear categories of payment services, including digital payment token services and cross-border money transfers.²³

Since 4 April 2024, a digital payment token service covers dealing in digital payment tokens, facilitating their exchange, transferring them or arranging their transfer, brokering trades in them, and safeguarding them or the keys to them where the provider has control²⁴. It does not matter if you call your project a decentralized application or a software client, as the legislation looks at the substance of the activity being undertaken. Whether a non-custodial protocol is caught depends on who operates it and whether they carry on a business of providing one of these services. Because founders and regulators work from the same written criteria, there is less room for surprise; even so, when the scope widened in 2024, firms newly caught had to notify MAS within 30 days and apply within six months, or stop²⁵.

2. The FinTech Regulatory Sandbox eases the sequencing trap

Founders often feel forced to choose between building illegally or waiting years for a formal license. For genuinely new products, Singapore offers an interim route in the FinTech Regulatory Sandbox²⁶. It allows an approved firm to test its product with real customers in a live, controlled environment, within set limits and for a set period.

During this testing phase, the Monetary Authority of Singapore may relax certain requirements, such as minimum paid-up capital or board composition. At the same time, core protections like anti-money laundering controls, customer confidentiality and the protection of customer assets remain in place. Entry is selective: the sandbox cannot be used to sidestep licensing, and applicants must intend to deploy in Singapore afterwards. The fast-track Sandbox Express covers only insurance broking and organised markets, not payment or digital payment token services²⁷.

3. Statutory categories reduce classification drift

Singapore’s statutes set out the main categories, and the Monetary Authority of Singapore publishes guidance on how it applies them²⁸. Tokens generally fall into three categories.

First, tokens that confer rights like shares, debentures or units in a collective investment scheme, or that are derivatives contracts, are regulated as capital markets products under the Securities and Futures Act 2001²⁹.

Second, tokens that are not pegged to a currency and are, or are intended to be, a medium of exchange accepted by the public are treated as digital payment tokens under the Payment Services Act 2019³⁰.

Third, tokens that work only as utility or governance tokens, and are neither capital markets products nor a means of payment for the public, generally fall outside these financial licensing rules. Closed-loop items such as loyalty points or in-game assets that cannot be cashed out or traded are expressly excluded as limited purpose digital payment tokens³¹. Classification still turns on each token’s features and how it is offered.

Singapore is also building a dedicated path for stablecoins. In August 2023 the Monetary Authority of Singapore finalised a policy framework for single-currency stablecoins pegged to the Singapore Dollar or a G10 currency: issuers that meet its reserve, capital, redemption and disclosure rules would be able to call their tokens MAS-regulated stablecoins³². The framework is not yet law. MAS opened consultation on the implementing amendments to the Payment Services Act on 1 September 2026, closing 16 October 2026, and proposed further requirements, so founders should treat the details as still moving³³.

4. A single integrated regulator reduces inter-agency drag

In many countries, founders spend valuable time and money navigating conflicting demands from different federal and state agencies. Singapore largely avoids this at the financial-regulatory level by having one integrated regulator.

The Monetary Authority of Singapore handles central banking, securities and payments all under one roof, though company registration, tax and data protection sit with other agencies. Licensing is also scaled to your business size. Under the Payment Services Act 2019, a smaller business may start with a Standard Payment Institution licence. It must move to a Major Payment Institution licence once average monthly transactions exceed S$3 million for a single service (S$6 million across two or more), or e-money balances exceed S$5 million³⁴. The digital payment token custody, anti-money laundering and consumer protection rules apply at both tiers³⁵, and new digital payment token applicants must file a legal opinion and an external auditor’s independent assessment with their application³⁶.

5. Statutory trust requirements make custody day-one architecture

Weak custody has been at the centre of some of the largest exchange failures. In Singapore, safeguarding customer assets is a legal requirement for licensed digital payment token service providers.

Since 4 October 2024, the Payment Services Regulations have required licensed digital payment token service providers to place customer assets in a designated trust account by the next business day, keep it apart from their own assets, keep a book entry for each customer and compute customer assets every business day³⁷. The Monetary Authority of Singapore’s guidelines add that at least 90 percent of customers’ assets should be kept in cold wallets³⁸.

The Monetary Authority of Singapore’s guidelines also bar these providers from facilitating lending or staking of retail customers’ tokens, and since 19 June 2025 have required a risk-awareness assessment before a retail customer is served^38,39. These rules reduce, but do not remove, the risk that a platform’s failure leaves customers out of pocket.

One limit founders should know: offshore-only token services

Singapore is not a base for every model. Since 30 June 2025, a Singapore company providing digital token services only to customers outside Singapore needs a licence under Part 9 of the Financial Services and Markets Act 2022, and the Monetary Authority of Singapore has said it will generally not grant one^40,41. A Singapore entity cannot be used as an unlicensed base for offshore-only crypto services. Firms licensed to serve Singapore customers may also serve overseas customers, and services for tokens used only as utility or governance tokens fall outside the regime.

The five problems, side by side

A summary only. The text and the sources below govern. Singapore entries are KGP Legal’s; all others are Infinilex’s.

Conclusion: where you build, and when you decide

The five problems in Part one rarely come from a single bad rule. They come from decisions made late, in markets where the rules are hard to read or still moving. Singapore shows what activity-based rules, a testing route for new products, defined token categories, an integrated regulator and custody rules written into regulation can do for those decisions. It is not the answer for every business: offshore-only token services face a licensing bar the Monetary Authority of Singapore has set high, stablecoin legislation is still out for consultation, and digital payment token licences are demanding to obtain.

The lesson travels. In Singapore, Dubai, the EU, India or the US, decide early what the product does, where its users are and how client assets are held, then choose the jurisdiction that fits those answers.

Frequently asked questions

Answers on Singapore law are KGP Legal’s.

Sources and authorities

Every source below was checked against the primary text on 6 October 2026, the date the law on this page is stated as at.

Part one · Infinilex

1. FATF, The FATF Recommendations (as amended), Recommendation 15 and its Interpretive Note; Glossary, “virtual asset service provider”. fatf-gafi.org
2. FinCEN, FIN-2019-G001, Application of FinCEN’s Regulations to Certain Business Models Involving Convertible Virtual Currencies, 9 May 2019, Introduction and section 1.1. fincen.gov
3. Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), Articles 3(1)(7), 48(1) and 48(2). eur-lex.europa.eu
4. Guiding and Establishing National Innovation for U.S. Stablecoins Act (GENIUS Act), Public Law 119-27, 139 Stat. 419, enacted 18 July 2025, section 20 (effective date). govinfo.gov
5. US Department of the Treasury, press release sb0605, 17 August 2026. home.treasury.gov
6. FATF, Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers, 16 July 2026, Executive Summary para 2, paras 22 and 24. fatf-gafi.org
7. MiCA, Article 143(3). eur-lex.europa.eu
8. ESMA, Statement on the end of transitional periods under MiCA, ESMA75-113276571-1679, 17 April 2026, including the warning for consumers at pp. 2 to 3. esma.europa.eu
9. ESMA, Public Statement, ESMA75-113276571-1710, 23 June 2026. esma.europa.eu
10. VARA, “VARA steps up enforcement to safeguard Dubai’s virtual asset market: 19 unlicensed firms penalised and public warning issued”, enforcement notice, 7 October 2025. vara.ae
11. SEC (with the CFTC), interpretive release, Release Nos. 33-11412 and 34-105020, 17 March 2026, 91 FR 13714 (23 March 2026), superseding the SEC staff’s Framework for “Investment Contract” Analysis of Digital Assets (3 April 2019), now withdrawn. sec.gov
12. SEC, press release 2026-30, 17 March 2026. sec.gov
13. SEC, Regulation Crypto Assets (proposed), Release Nos. 33-11434 and 34-106150, File No. S7-2026-27, 18 August 2026, 91 FR 54510 (21 August 2026); comments due 20 October 2026. sec.gov
14. MiCA, Article 2(4) (financial instruments outside MiCA), Article 3(1)(5) to (7), and Titles II, III and IV. eur-lex.europa.eu
15. FCA, press release, 30 June 2026, and gateway page (updated 30 September 2026); Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2025, SI 2026/102. fca.org.uk
16. FATF, Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers, 26 June 2025. fatf-gafi.org
17. Ministry of Finance (Department of Revenue), Notification S.O. 1072(E), 7 March 2023, under section 2(1)(sa)(vi) of the Prevention of Money-laundering Act 2002.
18. Income-tax Act 2025 (Act 30 of 2025): tax on VDA transfer income at 30% under section 194(1), Table Sl. No. 4 (formerly section 115BBH of the Income-tax Act 1961); TDS of 1% under section 393(1), Table Sl. No. 8(vi) (formerly section 194S).
19. Income-tax Act 2025 (Act 30 of 2025), section 2(111), limb (d) (crypto-assets), in force 1 April 2026.
20. MiCA, Article 75(1), (7) and (8). eur-lex.europa.eu
21. VARA, Custody Services Rulebook, version dated 19 May 2025, effective 19 June 2025. rulebooks.vara.ae
22. ESMA, “ESMA launches Common Supervisory Action on CASPs’ digital operational resilience for custody”, 8 July 2026. esma.europa.eu

Part two · KGP Legal (Singapore)

23. Payment Services Act 2019 (Act 2 of 2019), First Schedule, Part 1. sso.agc.gov.sg
24. Payment Services (Amendment) Act 2021 (Act 1 of 2021), in force 4 April 2024; Payment Services Act 2019, First Schedule, Part 3 (definition of “digital payment token service”).
25. MAS, media release on the expanded scope of regulated DPT services and new user protection requirements, 2 April 2024.
26. MAS, FinTech Regulatory Sandbox Guidelines (November 2016, updated 1 January 2022), paras 5.4, 5.5 and 6.2(c) and Annex A. mas.gov.sg
27. MAS, Sandbox Express. mas.gov.sg
28. MAS, Guide on the Tokenisation of Capital Markets Products, last updated 14 November 2025, replacing A Guide to Digital Token Offerings (last revised 26 May 2020). mas.gov.sg
29. Securities and Futures Act 2001 (2020 Rev Ed), section 2(1) (“capital markets products”). sso.agc.gov.sg
30. Payment Services Act 2019, section 2(1) (definition of “digital payment token”). sso.agc.gov.sg
31. Payment Services Act 2019, First Schedule, Part 2, paragraph 2(l), and Part 3, paragraph 3 (limited purpose digital payment token). sso.agc.gov.sg
32. MAS, Response to Public Consultation on Proposed Regulatory Approach for Stablecoin-Related Activities (P009-2022), 15 August 2023. mas.gov.sg
33. MAS, media release on the consultation on legislative amendments to implement the stablecoin regulatory framework, 1 September 2026 (consultation closes 16 October 2026). mas.gov.sg
34. Payment Services Act 2019, sections 5(1) and 6(4) to (5). sso.agc.gov.sg
35. MAS Notice PSN02, Prevention of Money Laundering and Countering the Financing of Terrorism, Digital Payment Token Service, issued 2 April 2024, last revised 30 June 2025. mas.gov.sg
36. MAS, Guidelines on Licensing for Payment Service Providers, PS-G01, issued 18 December 2019, last revised 8 October 2025, paras 4.1.1 to 4.1.5.
37. Payment Services Regulations 2019 (2025 Rev Ed; originally S 810/2019), Part 2, Division 2A, regulations 18A to 18J, and regulations 13A to 13B, inserted by S 287/2024 with effect from 4 October 2024. sso.agc.gov.sg
38. MAS, Guidelines on Consumer Protection Measures by DPT Service Providers, PS-G03, issued 2 April 2024, last revised 19 September 2024, paras 3.4.4 and 3.7.1 to 3.7.2, and Chapter 4 (from 19 June 2025). mas.gov.sg
39. MAS, Response to Public Consultation on Proposed Regulatory Measures for Digital Payment Token Services (P008-2022), Part 1, 3 July 2023, and Part 2, 23 November 2023.
40. Financial Services and Markets Act 2022 (Act 18 of 2022), Part 9, section 137, in force 30 June 2025. sso.agc.gov.sg
41. MAS, “MAS clarifies regulatory regime for digital token service providers”, media release, 6 June 2025; MAS response to feedback on the DTSP regime, 30 May 2025. mas.gov.sg

Further reading

From Infinilex: Where should you incorporate? Five questions first · Crypto licence requirements by country · Is my token a security? · MiCA vs VARA · FIU-IND registration in India · Crypto custodian licence terms compared · Where should you issue a stablecoin? · Our SEC comment letter on Regulation Crypto Assets

From KGP Legal: kgplegal.com.sg

Contributor note

Infinilex wrote Part one, on the EU, the US, India, the UAE and international standards. KGP Legal LLC wrote Part two, on Singapore law, and is responsible for it. Singapore law advice is given only by KGP Legal LLC.

About KGP Legal

KGP Legal LLC is a Singapore-licensed corporate and commercial law practice with a strong international focus. The firm specializes in cross-border transactions, mergers and acquisitions, fintech and digital assets regulation, corporate structuring, and commercial dispute management. Committed to transparency, commercial pragmatism, and technical precision, KGP Legal delivers high-quality, tailored legal solutions designed to advance and safeguard its clients’ cross-border interests. For more information, visit www.kgplegal.com.sg.

About Infinilex

Infinilex is a legal and regulatory advisory practice for Web3 and digital-asset projects, helping founders structure operations, tokens, and platform-level compliance across India, the UAE, and the US. Rather than coordinating three disconnected local counsel across three jurisdictions, Infinilex handles the work itself across all three, which is the corridor most Web3 businesses building out of the US, India or the UAE actually run on. Rather than treating jurisdiction selection as an afterthought, Infinilex works with teams at the design stage, mapping which regulator actually governs the given product, and building the entity, licensing, and compliance structure around that answer before the product ships.

Important notice

General information, not advice. Nothing in this publication is legal, tax, accounting, financial or investment advice, or an opinion on any product, token, platform or transaction. It summarises law and regulatory material for general information and leaves out detail that may matter to your facts. Do not act, or refrain from acting, on it without advice on your circumstances from a professional qualified in each jurisdiction concerned.

No client relationship. Reading, sharing or responding to this publication does not create a client, advisory or fiduciary relationship with Infinilex or with KGP Legal LLC. An engagement exists only on terms agreed in writing with the firm concerned.

Who is responsible for what. Part one, including the five problems and “What ties these together”, is written by Infinilex. Part two, on Singapore, is written by KGP Legal LLC, which alone is responsible for it. Singapore law advice is given only by KGP Legal LLC; Infinilex does not advise on Singapore law, and KGP Legal LLC does not advise on the laws of India, the UAE, the US or the EU. In the joint introduction, the comparison table and the questions and answers, KGP Legal LLC is responsible for statements about Singapore and Infinilex for statements about every other jurisdiction.

Independent firms. Infinilex and KGP Legal LLC are independent firms. This publication does not create a partnership in law, a joint venture, an agency or a fee-sharing arrangement between them, and neither firm is responsible for the other’s advice, services or conduct.

Comparisons are not recommendations. Statements comparing jurisdictions are generalisations. They are not a recommendation that any business should establish in, move to, or avoid any jurisdiction. Whether a jurisdiction suits a business depends on its activities, customers, ownership, tax position and timing, and on how the regulator applies its rules to those facts.

Not an offer. Nothing here is an offer, solicitation or recommendation in respect of any token, security, digital payment token, stablecoin or other financial product, or an invitation to use any service in a jurisdiction where that would be unlawful.

Accuracy and currency. The law is stated as at 6 October 2026. Statutes, regulations, regulators’ statements, effective dates and enforcement priorities change, sometimes quickly, and neither firm undertakes to update this publication. Summaries of legislation, guidance and regulatory statements are paraphrased; where they differ, the source documents listed under “Sources and authorities” prevail. No regulator has reviewed or endorsed this publication. A reference to an enforcement action describes only what the cited source states.

Third-party material. Links and references to regulators, legislation and other third-party material are given for convenience. Neither firm is responsible for their content, accuracy or availability.

Limitation of liability. To the fullest extent permitted by law, Infinilex and KGP Legal LLC, and their respective partners, directors, members, employees and consultants, accept no liability for any loss or damage arising from any use of, or reliance on, this publication.

© 2026 Infinilex and KGP Legal LLC. This publication may be shared in full with attribution. It may not be altered or excerpted in a way that changes its meaning.