Spring Boot Development in Singapore

About Spring Boot Development

Spring Boot is how a lot of enterprise teams build Java backends: REST APIs, microservices, and integration-heavy services on a mature, well-supported framework. This is a newer service line for us, so we will be straight with you. We take it on with senior backend engineers and the same discipline we run on every build: a written scope, a flat quote, real tests, and CI, not a learning exercise billed to you.

What the engagement includes

• Spring Boot 3.x on a current long-term-support Java, 17 or 21, built with Maven or Gradle, so you are not starting on a version that is already near end-of-life.
• Tests that actually run: JUnit 5 for unit tests and Testcontainers for integration tests against a real database in CI, not mocks that pass while production breaks.
• OpenAPI and Swagger documentation generated from the code, so the API contract stays in sync with what the service actually does.
• Versioned database migrations with Flyway or Liquibase. Schema changes are reviewed and repeatable, never hand-run against production.
• Containerized with Docker and wired into CI/CD, with Spring Boot Actuator health checks and Micrometer metrics so the service is observable once it is live.
• You own the repo, the pipeline, and the deployment. Nothing is locked to us, and a written scope with a flat quote comes before any code.

MAS cyber hygiene, safeguarding deadlines and wire transfer data in a Singapore Spring Boot service

For a bank in Singapore, a Spring Boot service's management endpoints are administrative accounts in the regulator's sense. MAS Notice FSM-N06 on Cyber Hygiene, which replaced Notice 655 for banks from 10 May 2024, defines an administrative account as any user account with full privileges and unrestricted access to an operating system, database, application, security appliance or network device, and requires every one of them to be secured against unauthorised access. Multi-factor authentication is required for administrative accounts on critical systems and for every account on a system used to reach customer information over the internet. A Spring Boot application grows such accounts without anyone deciding it should: the Actuator endpoints that return a heap dump or change log levels at runtime, a Spring Boot Admin console, an H2 console left switched on in a profile, an open JMX port. Spring Boot exposes only the health endpoint over HTTP and JMX by default, so each of these is opened by a line of configuration, and we review that line as the creation of an administrative account, behind the bank's authentication and MFA. The other requirements read the same way. Security patches go on within a timeframe commensurate with the risk of each vulnerability, with compensating controls where no patch exists, so a Spring advisory or a CVE in the embedded Tomcat starts a clock rather than joining a backlog. Every system needs a written set of security standards it conforms to, which for a Spring Boot service is a short baseline: the management port bound to an internal interface, the exposure list, TLS settings and response headers, with each deviation and its control written down. The notice reaches suppliers too. A bank is excused a requirement only where it cannot control the system directly, cannot require the provider to comply, and could not reasonably switch to a provider it could require, so expect these duties in our contract. How the notice applies to your systems is for your compliance team.

Payment institutions ask a Spring Boot ledger to prove a legal deadline every business day. Under section 23 of the Payment Services Act 2019, in its form since 4 April 2024, a major payment institution providing domestic or cross-border money transfer or merchant acquisition must safeguard relevant money, which is customer money it still holds at the end of a business day, no later than the next business day. That means an undertaking or guarantee from a safeguarding institution or a deposit into a trust account, and for e-money issuance the duty starts the moment money is received. A business day excludes Saturdays, Sundays, public holidays and bank holidays, so the deadline is computed against Singapore's calendar, not a server's idea of tomorrow. A breach is an offence with a fine of up to S$250,000 and up to S$25,000 a day while it continues, and MAS must be told which method and which institution are used and of any change. In code this becomes a Spring Batch job that closes each business day and computes relevant money per customer, leaving out what the statute leaves out: money already paid on a customer's instructions, money repaid, and fees the customer was told would be taken. It then reconciles against the safeguarding account and raises an exception before the cut-off rather than after it. The Act lets MAS make regulations requiring a separate book entry for each customer, so the ledger is built per customer from the start rather than as a pooled balance with a spreadsheet beside it. Section 24 adds limits for e-wallets: the e-money in a personal payment account may not exceed a prescribed amount, and neither may the total moved out of it in a year, transfers to the user's own designated bank account excepted. Both are checks in the transfer path, with the amounts held as configuration because regulations set them. Whether your service falls within these sections is for your own counsel.

Payment service providers in Singapore build their screening and payment messages to MAS Notice PSN01, last revised on 30 June 2025, and both are data-model decisions in a Spring Boot service. For a cross-border wire transfer of S$1,500 or less, the message must carry the originator's and the beneficiary's names and account numbers, or a unique transaction reference where there is no account. Above S$1,500 the originator must also be identified and verified, and the message adds one of an address, a unique identification number such as an NRIC, or a date and place of birth or incorporation. Where only a reference travels to an intermediary in Singapore, the full details must be produced within three business days of a request from that intermediary, MAS or another Singapore authority, and immediately for law enforcement. So the payment instruction is a typed record whose fields are validated by amount band, and the lookup by reference is an indexed query with an audit trail rather than a search through logs. Screening has its own triggers. Customers, people acting for them, connected parties and beneficial owners are screened when the relationship begins, before a cross-border transfer or any transaction over S$5,000 for someone with no relationship, periodically after that, and again whenever the lists provided by MAS or other Singapore authorities change. That last trigger is the one systems miss, because an updated list means rescreening the existing customer base, not only new arrivals, and every wire transfer originator and beneficiary is screened against the same lists. In Spring Boot terms a list update is an event that starts a rescreening batch over every party, writing results to a store that shows who was screened against which version of which list, and when, since the Notice requires screening results to be documented. How PSN01 applies to your licence is for your compliance team.

How we work with Singapore clients

Singapore is the one market we serve where the working day is simply shared. We are two and a half hours behind you and neither country moves its clocks, so our morning starts partway through yours and the whole of your afternoon is live time for both sides. That changes the shape of an engagement more than anything technical does: a call is booked for the same afternoon rather than the same week, a question raised before your lunch is answered after it, and the written-first method we run for North American clients is a courtesy here rather than a necessity. We keep the written record anyway, with a default chosen on every open decision, because it is the thing an auditor or a new hire can read later and a call is not.

Invoicing is worth stating plainly because the GST position confuses buyers on both sides. We are outside Singapore, so no GST appears on our invoice. Whether you account for it yourself is the reverse charge question, and IRAS's own guidance is that a GST-registered business making only taxable supplies is not affected, while a partially exempt one accounts for it in its own return. We quote in Singapore dollars, the figure holds for the project whatever the rupee does, and payment by bank transfer or Wise avoids the card fees a five-figure invoice does not need. The contract can sit under Singapore law with Singapore courts, and unusually among our overseas markets that clause has teeth: Singapore is a reciprocating territory under section 44A of India's Civil Procedure Code, so a judgment of the Singapore High Court can be executed in India directly rather than re-litigated.

Questions Singapore clients ask

Spring Boot Development: common questions

Other markets we work in