新闻和见解

Background

On 9 September 2026, Parliament passed the Scams (Countermeasures) and Other Matters Bill (Bill No. 16/2026) (the “Proposed Act”), which when enacted will amend five existing statutes: the Protection from Scams Act 2025 (“PSA”), the Miscellaneous Offences (Public Order and Nuisance) Act 1906, the Online Criminal Harms Act 2023 (“OCHA”), the Police Force Act 2004, and the Banking Act 1970 to strengthen measures to detect, disrupt, and deter scams.

Key measures which will be introduced by the Proposed Act include the introduction of new offences to deter misuse of online accounts, the enhancement of the OCHA, and enabling and safeguarding of scam-related information exchange between the Singapore Police Force and key service providers such as financial institutions, telcos, payment and other online platforms.

This update examines the specific obligations that the Proposed Act will impose on the key service providers, with a particular focus on telcos.

New Order Under the Protection from Scams Act 2025

Building upon the Facility Restriction Framework launched in October 2025 which restricts scam mules’ access to financial, telecommunications, and Singpass/Corppass services , the Proposed Act will introduce new orders relating to scam-enabling services .

“Scam-enabling service” is defined very broadly to encompass any service through which money or property moves – including bank accounts, payment accounts, and digital payment token accounts – as well as  communication services such as telephone line and online accounts, credit facilities, and ancillary services including web hosting and domain registration. Accordingly, telcos, banks, online platforms, web hosts, and domain registrars will be deemed relevant service providers.

Three new types of orders will be issuable by prescribed officers (including police officers, Commercial Affairs officers, or civilian specialist officers):

• Service Limitation Orders to direct service providers to restrict a scam-enabling service to a named person for up to three years, where the officer suspects or has reason to believe that person will use the service to commit or facilitate a scam. The Proposed Act does not provide guidance on what would constitute “suspects” or “reason to believe”. However, the Singapore courts have previously held that “reason to believe” is more than mere suspicion and requires a “chain of probable reasoning” that leads to the conclusion ; while “suspicion” is a lower threshold, although it should be clear, grounded and targeted on specific facts . The courts’ interpretations in these cases are in the context of different legislation and it remains to be seen whether the Singapore courts will apply a similar interpretation when interpreting the Proposed Act. If so, it means that orders may be issued even on the basis of preliminary indicators of scam-related activity.
• Account Disabling Orders to direct service providers to disable any bank account, payment account, digital payment token account, telephone line account or online account where the officer suspects or has reason to believe that the same has been or will be used preparatory to, or in furtherance of, the commission of a scam related offence. An account shall be disabled for an initial period of up to 30 days, and can be extended once for a further 30 days. In the context of telephone lines or online accounts, “disable” refers to the preventing of the use of the account to communicate with specified persons or through designated accounts.
• Disclosure Orders to require service providers to hand over compliance-related, account-related or user-related information, if the officer is satisfied that disclosure is necessary or expedient for preventing the commission of a scam related offence and reasonably believes the service provider is capable of disclosing the information. While the Proposed Act does not define what would constitute “reasonable belief”, the Singapore courts have held in the context of interpreting other statutes that it combines a subjective, honestly held belief, and objectively reasonable grounds supporting that belief. Assuming a similar interpretation is adopted in the context of the Proposed Act, then the threshold for the issuance of a Disclosure Order is likely higher than that required for issuing a Service Limitation Order or Account Disabling Order.

All three types of order have extra-territorial effect, regardless where the recipient or the relevant data is located.

Penalties for Non-Compliance

The Proposed Act will impose significant penalties on service providers that fail to comply with the new orders:

Immunity for Voluntary Disclosure and Voluntary Action

The Proposed Act will incorporate a framework of statutory immunity for certain acts. A service provider that voluntarily discloses information to a specified officer or public sector agency, in good faith and with reasonable care, is protected notwithstanding any secrecy obligation under the Banking Act 1970, the Personal Data Protection Act 2012, contract, or professional conduct rules. A service provider may also voluntarily prevent use of an account for up to 30 days without first receiving an order, provided the suspicion is grounded at least partly in information from an existing Account Disabling Order or Disclosure Order and the provider acts in good faith and with reasonable care. As a service provider may be exempt from liability arising from such voluntary disclosure or voluntary action if the relevant conditions are met, service providers can take a more pro-active role in the prevention of scams.

Enhanced OCHA Enforcement

With regards to online platforms, the Proposed Act will allow directions issued under Part 2 (Directions Against Offences) of the OCHA, namely stop communication and disabling directions, to be issued if a computer program assesses that an offence has occurred or that an activity is preparatory to a scam, subject to a “responsible officer” authorisation framework. Administrative penalties for non-compliance with a code of practice will be increased from S$1 million to S$10 million per instance, a new compliance order mechanism will be introduced for non-compliance with implementation directives (also capped at S$10 million), and the criminal penalty for non-compliance with a compliance order will be raised to S$10 million with a further fine of up to S$300,000 a day for a continuing offence.

What This Means for Telecommunication Companies

For telcos, the following are noteworthy:

• As telephone line accounts can fall under “scam-enabling services”, telcos may therefore receive Service Limitation Orders and Account Disabling Orders directly, and will need to have a process to identify, verify and act on these within whatever timeframe the order specifies. As orders may be served by delivery, registered post, email, or electronic notice, telcos should establish appropriate protocols with personnel who are trained to receive, verify, and act on such orders. Telcos should also ensure that they are able to identify all affected accounts, apply only the restrictions stated in the order, and maintain a complete audit trail of the order (i.e. the affected services, responsible staff who were involved, and completion time with duration and expiry tracking).
• As the 30-day disabling window will be extendable only once, telcos will need internal escalation paths and processes in place to facilitate timely compliance. Accordingly, telcos should ensure clear procedures and timelines are in place for the operations team to receive and verify such orders, and to escalate the same to the appropriate management levels. Telcos may also consider implementing regular training and simulation drills (with appropriate after-action reviews).
• Non-compliance is a criminal offence. Failing to comply with a Service Limitation or Account Disabling Order, without reasonable excuse, will expose an entity to hefty fines as noted above. Additionally, the provision of false or misleading information in response to such an order also carries fines and imprisonment. The Singapore Courts have held that having “reasonable excuse” is assessed from the perspective of a reasonable person in the accused’s position, and the accused bears the burden of proving the excuse on a balance of probabilities . Accordingly, telcos should ensure that it documents its efforts to comply with such orders, such that it can better aid any efforts to demonstrate that it has complied with a Service Limitation or Account Disabling Order.
• The regime will apply regardless of where a telco is based or where its data is stored, so foreign telcos serving Singapore subscribers, and Singapore telcos storing data offshore, are not insulated from these obligations.

Next Steps

The Proposed Act will come into effect on a date to be appointed by the Minister. It is recommended that affected stakeholders, particularly telcos and online platforms, begin reviewing internal compliance frameworks, escalation processes and information-sharing protocols ahead of the commencement date.

This Client Update was authored by Partner Ted Teo and Associate Chen Jun Wei.

If there are any queries, please feel free to reach out to us. 

Click here to read the article in PDF.