How Singapore’s proposed Bill would strengthen enforcement under the Online Criminal Harms Act
Online platforms could face financial penalties of up to S$10 million for each instance of not meeting certain anti-scam requirements, under a Bill introduced in Singapore on 4 August 2026.
The proposal is part of the Scams (Countermeasures) and Other Matters Bill. It would update the Online Criminal Harms Act, usually called OCHA, to strengthen how Codes of Practice and Implementation Directives are enforced against designated online services.
This is not a blanket S$10 million fine for every scam post that shows up online. The proposed penalty is tied to failing to meet regulatory requirements that apply to designated providers. And the Bill had only received its First Reading as at 13 August 2026, so the changes were not yet in force.
Why platforms are central to scam prevention
Scammers use online services to advertise fake investments, impersonate officials, contact victims, and move conversations into private channels. A single syndicate can create many profiles and adverts in a short time.
Taking down items one by one helps, but it does not solve everything. If a platform’s design, verification, or advertising controls keep letting the same scam pattern through, the authorities may require broader measures. This is where Codes of Practice and Implementation Directives come in.
Since OCHA came into force in 2024, the Police have used directions to require scam-related content to be removed. Designated services can also be required to put preventive systems and processes in place. The proposed penalty framework is meant to make those duties bite harder.
What Codes of Practice and Implementation Directives do
A Code of Practice can set out the systems, processes, or measures that designated online services should put in place to counter online criminal harm. An Implementation Directive can require a designated service to take specific steps in relation to its duties.
In plain language, these tools move the response from “remove this one item” to “improve the way the service prevents and handles this whole category of harm”. The exact duties depend on the code or directive issued to the provider.
The Bill would let the Competent Authority act when it assesses that a designated provider has not complied. A Competent Authority is appointed to run the relevant parts of OCHA and use the powers the Act provides.
The proposed S$10 million financial penalty
For each instance of not complying with a Code of Practice or Implementation Directive, the Competent Authority could impose a financial penalty of up to S$10 million.
The words “up to” matter. S$10 million is the maximum, not the automatic amount. The actual penalty would be decided under the legal framework after the provider has been notified and given a chance to put its case.
The words “for each instance” also matter. They suggest that separate or repeated failures could be treated individually. Platforms will need to work out whether a requirement applies across products, regions, account types, or time periods, and make sure compliance is consistent.
Rectification Notices and Compliance Orders
The Competent Authority would not always have to impose a financial penalty straight away. It could instead direct the provider to fix the problem.
Where a platform has not complied with a Code of Practice, a Rectification Notice may be used. Where the issue involves an Implementation Directive, a Compliance Order may be issued.
These measures give a provider a clear chance to correct a failure. But ignoring the follow-up direction could lead to criminal liability.
Criminal consequences for failing to fix the problem
Under the proposed changes, a person who fails to comply with a direction to fix non-compliance may be convicted and fined up to S$10 million.
If the offence continues after conviction, a further fine of up to S$300,000 may apply for each day, or part of a day, that the offence goes on. This daily fine is designed to remove any advantage in dragging out the required fix.
These are separate from the initial regulatory penalty framework. The first is the authority’s response to non-compliance. The criminal offence is about failing to comply with a Rectification Notice or Compliance Order.
Notice and a chance to respond
The proposal builds in fairness before a financial penalty is imposed. The Competent Authority must serve a written notice on the online service provider. The notice must set out the intended enforcement action and the time within which the provider can respond.
The provider can give its reasons on the alleged non-compliance. It can explain the technical facts, show what it has already done, dispute the assessment, or argue why a particular remedy or penalty would be unfair.
The authority must consider the provider’s response before deciding whether to impose a financial penalty. This does not guarantee the provider will succeed, but it does ensure the decision is not made without giving it a chance to be heard.
Right of appeal
An online service provider can appeal a financial penalty to the Minister for Home Affairs. The detailed process and timing should be checked in the applicable law and any later rules when the framework starts.
For providers, this means keeping compliance evidence before any dispute arises. System logs, risk assessments, test results, incident records, moderation decisions, and messages with the authority may all become important.
An appeal is stronger when the provider can show exactly what requirement applied, what it put in place, what failed, and how it was fixed.
Which platforms are designated
The Ministry of Home Affairs listed Facebook, Instagram, WhatsApp, Telegram, WeChat, TikTok, Carousell, Google, and Apple as designated online services under OCHA, in the context of the Bill’s new online-account offences.
Designation is a legal status, and the list can change through the relevant process. Businesses should not assume only social networks are affected. Chat, marketplace, and technology ecosystem services can all be important parts of a scam journey.
The proposed S$10 million framework is about designated online service providers that are subject to the applicable Code of Practice or Implementation Directive. It is not aimed at ordinary users simply because they have an account on one of these services.
What strong platform compliance may look like
The First Reading announcement does not set out one universal technology solution, and platforms differ greatly. Still, an effective programme might include:
- Risk-based checks on advertisers and sellers
- Detection of impersonation, account farming, and repeated scam patterns
- Faster review of high-confidence reports
- Controls against quickly recreating removed accounts or adverts
- Clear escalation channels for the Police
- Keeping relevant evidence and audit logs
- Testing for false positives and unfair impact
- Senior accountability for legal directions and fixes
The aim should be a measurable drop in harm, not just producing a policy document.
The challenge of speed and accuracy
Platforms operate at huge scale. Automated detection can process more content, but it may also block genuine sellers, satire, news reporting, or ordinary conversations. Human-only review can be more careful about context, but too slow for a fast-changing scam campaign. The Bill also separately proposes computer-issued OCHA directions.
A mature programme combines both. High-confidence patterns may be handled automatically, while uncertain cases get trained human review. Appeals and restoration processes should be watched for recurring mistakes.
The S$10 million ceiling raises the cost of weak compliance, but good regulation also needs clear standards. Providers need to know what outcome is expected, how compliance will be measured, and what evidence will be accepted.
What this may mean for businesses using platforms
Merchants, advertisers, and creators may see stricter verification, slower approval for higher-risk adverts, and more requests for business documents. New controls can feel inconvenient, but they can also cut impersonation and protect genuine brands.
Keep your platform ownership organised. Use accurate names, verified contact details, and consistent payment information. Keep invoices, licences, and campaign records. If content is wrongly restricted, a well-documented account is easier to review.
Businesses should also watch for fake profiles and scam adverts using their names. Report them through the platform, and where money or identity misuse is involved, through the appropriate official channels.
What consumers should understand
A large possible penalty does not mean a platform guarantees that every scam will be stopped. No prevention system is perfect, and the proposal is about meeting legal requirements, not compensating every victim.
Keep checking offers independently. Do not rely only on an advert being approved, a profile being old, or an account having many followers. Verify payment details and contact organisations through their official websites or apps.
When you report a scam, include the exact account, advert link, message, date, and payment instructions. High-quality reports make platform and Police action more useful.
Why the S$10 million figure matters
Large platforms may treat smaller penalties as a routine cost of doing business. A higher maximum gives a stronger reason to invest in preventive systems, timely fixes, and proper accountability.
But the number is only one part of the framework. The authority still has to identify non-compliance, give notice, consider the provider’s response, and make a fair, measured decision. Providers can appeal the financial penalty.
The bigger message is that anti-scam duties are becoming a core operational responsibility. Platforms cannot treat them as just a public-relations issue or an optional safety feature.
The bottom line
The Bill proposes a big increase in the consequences of failing to meet anti-scam requirements under OCHA. For each instance of not complying with an applicable Code of Practice or Implementation Directive, a designated provider could face a financial penalty of up to S$10 million.
Providers may instead be told to fix the problem, but failing to comply with the Rectification Notice or Compliance Order could lead to a criminal fine of up to S$10 million, plus further daily fines for a continuing offence.
For Singaporeans, the change signals a stronger expectation that major online services must help prevent scams at the system level. It does not replace personal caution, but it may push platforms to build safer services and respond faster when their controls fail.
Frequently Asked Questions
1. Would a platform’s directors automatically be fined personally?
The First Reading announcement focuses on the provider and on people who fail to comply with relevant directions. Personal liability would depend on the statutory provisions and the facts, not just on holding a director title.
2. Can a platform insure against an OCHA financial penalty?
That depends on the insurance terms, public policy, and the nature of the liability. Providers should get Singapore legal and insurance advice rather than assume a regulatory penalty is covered.
3. Will every financial penalty be announced publicly?
The First Reading material does not state a universal publication rule for every penalty. Any disclosure practice should be checked once the final framework and enforcement decisions are available.
4. Could a small Singapore start-up face the same S$10 million maximum?
The proposed framework applies to designated providers that are subject to the relevant requirements. Designation and proportionality matter. A business should check whether it is designated and what code or directive applies.
5. Is the S$10 million amount in Singapore dollars?
Yes. The official Singapore materials use the Singapore dollar, and the Ministry describes the maximum as S$10 million.
Thank you for sharing this article...
About the Author: Randy Alta
