TRW & Co · Investigations and financial crime
Online Criminal Harms Act: Directions and the 2026 Codes of Practice
The Online Criminal Harms Act in Singapore lets police direct online services to remove criminal content and accounts, and requires designated platforms to follow anti-scam codes of practice. New Messaging, Social Media and E-Commerce codes issued in August 2026 apply from 31 January 2027, and amendments passed in September 2026 will raise penalties to S$10 million per breach.
Key pointNon-designated businesses are affected too: advertisers face identity verification and financial ad restrictions on designated platforms, and anyone who receives a direction has only 30 days to seek reconsideration.
At a glance
Three codes issued
On 17 August 2026 the SPF issued a new Messaging Code, a new Social Media Code and an enhanced E-Commerce Code under OCHA.
Compliance by January 2027
Designated services must comply by 31 January 2027, with the Messaging Code's Government anti-spoofing requirements due earlier, by 30 September 2026.
Five types of direction
Officers can issue Stop Communication, Disabling, Account Restriction, Access Blocking and App Removal directions, with a lower threshold for scams.
Thirty days to challenge
Reconsideration must be sought within 30 days of the direction or order, with a further appeal to a Reviewing Tribunal of a District Judge or Magistrate.
Penalties rising sharply
Amendments passed in September 2026 allow penalties of up to S$10 million per instance of non-compliance with a code or implementation directive.
Swipe or scroll →
The short answer: what changed in 2026
The Online Criminal Harms Act in Singapore gives the authorities two sets of tools. The first is directions that require online services to remove, block or restrict criminal content and accounts. The second is codes of practice that require designated platforms to build anti-scam safeguards into their services.
On 17 August 2026, the Singapore Police Force's OCHA Office issued three codes of practice: a new Messaging Code, a new Social Media Code and an enhanced E-Commerce Code. According to the SPF announcement, designated services must comply by 31 January 2027, except for the Messaging Code's requirements on spoofing of the Singapore Government, which were due by 30 September 2026.
Separately, Parliament passed the Scams (Countermeasures) and Other Matters Bill in September 2026. It will raise penalties for platforms that fail to comply with codes and directives, allow administrative financial penalties and permit directions to be issued by computer programs. As of October 2026, the sources we reviewed indicated that those amendments would commence on a date to be notified.
How the Online Criminal Harms Act in Singapore is structured
The Online Criminal Harms Act 2023 was passed on 5 July 2023. The Ministry of Home Affairs announced that its powers to issue directions, orders and information requests took effect on 1 February 2024, with codes of practice and directives on scams and malicious cyber activities to follow. The first codes took effect on 26 June 2024.
The Act operates on two tracks. The reactive track lets officers direct online services to deal with specific criminal content or accounts. The proactive track places designated online services under codes of practice and implementation directives that require systemic safeguards against scams and malicious cyber activities.
The Competent Authority under the Act is the SPF's OCHA Office. Directions are issued by Designated Officers, while orders, which follow non-compliance with a direction, are issued by the Competent Authority.
The five types of direction
| Direction | Recipient | What it requires |
|---|---|---|
| Stop Communication | The person communicating the content | Stop communicating specified content, including substantially similar content, to people in Singapore |
| Disabling | Online service provider | Prevent people in Singapore from accessing specified content such as a post or page |
| Account Restriction | Online service provider | Stop an account communicating in Singapore or interacting with people in Singapore |
| Access Blocking | Internet access service provider | Block access by people in Singapore to an online location such as a domain |
| App Removal | App distribution service | Remove an app from the Singapore storefront |
The threshold depends on the offence. For most specified offences, a direction may be issued on reasonable suspicion that online activity is being carried out in furtherance of the offence. For scams and malicious cyber activities, MHA explained that a lower threshold applies: suspicion or reason to believe that the activity is preparatory to or in furtherance of such an offence. That lower threshold reflects the speed at which scam operations move.
The 2026 codes of practice
The three codes issued in August 2026 apply to designated services. The SPF explained that requirements will be applied according to each service's assessed scam risk, and that full or partial waivers may be granted where appropriate.
| Code | Designated services | Compliance deadline | Examples of requirements |
|---|---|---|---|
| Messaging Code (new) | WhatsApp, Telegram, WeChat, Apple iMessage, Apple FaceTime, Google Messages, Google Meet | 31 January 2027; Government anti-spoofing measures by 30 September 2026 | Consent before unknown contacts add users to groups; contextual warnings about unknown or suspicious accounts; tools to silence or block non-contacts; preventing spoofing of the Singapore Government |
| Social Media Code (new, replacing the Online Communication Services Code) | Facebook, Instagram, TikTok | 31 January 2027 | Not publishing ads reasonably suspected of furthering scams; prompt removal of suspected scam ads; verifying advertisers against Government-issued records; barring financial ads from unlicensed advertisers |
| E-Commerce Code (enhanced) | Carousell, Facebook Marketplace, Facebook Business Pages | 31 January 2027 | Stronger consent for logins from new devices; enhanced seller verification and payment protection; social media ad safeguards |
Across the codes, the obligations fall into recognisable groups: proactive detection of malicious accounts and activity, verification, protection of user accounts, disabling malicious accounts and reporting. Reporting obligations include informing the authorities of detected scam trends, retaining data on accounts used for scams, facilitating law enforcement requests and filing an annual implementation report.
Businesses that are not designated are not bound by the codes, but the Online Criminal Harms Act in Singapore will still affect them. Advertisers on social media will face verification checks, sellers on marketplaces will face stricter onboarding, and financial services firms should expect ads to be refused if they cannot show they are licensed. Our e-commerce regulation page covers the wider rules for online sellers.
Enforcement and the new penalty regime
Under the current framework, the OCHA Office can issue a Rectification Notice where it finds non-compliance with a code. The SPF states that failing to comply with a Rectification Notice without reasonable excuse is an offence carrying a fine of up to S$1 million, with a further fine of up to S$100,000 for each day of a continuing offence after conviction.
The Scams (Countermeasures) and Other Matters Bill, which received its second reading on 8 September 2026 and was passed the following day, changes this significantly for the Online Criminal Harms Act in Singapore:
- The Competent Authority may impose a financial penalty of up to S$10 million for each instance of non-compliance with a code of practice or implementation directive, as an alternative to a Rectification Notice or compliance order.
- Failure to comply with a Rectification Notice or compliance order becomes an offence punishable by a fine of up to S$10 million, with a further fine of up to S$300,000 per day for a continuing offence.
- Before imposing a penalty, the Competent Authority must notify the provider and allow at least seven days for written representations; the provider may then appeal to the Minister for Home Affairs, whose decision is final.
- Directions may be issued by a computer program, including AI or machine learning systems, with the head of the agency using the program responsible for it.
- The Competent Authority may require information to assess compliance with a code or directive, and may require measures that indirectly counter scams, such as public education.
Designated platforms should treat 31 January 2027 as a hard deadline and assume the higher penalty regime may apply by then. A documented gap analysis against each code requirement, with owners and dates, is the best evidence of good faith if the OCHA Office later questions compliance.
Responding to a direction under the Online Criminal Harms Act in Singapore
Most businesses will encounter the Online Criminal Harms Act in Singapore through a direction rather than a code. A platform may be told to disable a post, an app store to remove an app, or a business may find its own content or account targeted. The steps below set out a sound response.
- Verify the direction. Confirm it is genuine, identify the issuing officer, the type of direction, the content or account concerned and the deadline for compliance.
- Comply within the timeline. Directions are designed for speed. Comply unless there is a clear legal basis not to, because non-compliance can lead to orders and criminal liability.
- Preserve records. Keep copies of the direction, the content concerned, account data and your compliance steps, consistent with your data protection obligations.
- Assess whether to seek reconsideration. Recipients and, for some directions, the owner of the account, app or location or the originator of the material can apply for reconsideration.
- Apply within 30 days. The SPF states that reconsideration applications must be submitted no later than 30 days from the date on the direction or order, using the prescribed form.
- Consider the Reviewing Tribunal. If reconsideration fails, an appeal lies to a Reviewing Tribunal, which MHA describes as a District Judge or Magistrate appointed for that purpose.
The SPF reconsideration page sets out the procedure. Where proceedings are needed, we work alongside Singapore-qualified counsel.
How OCHA fits with other online harms laws
The Online Criminal Harms Act in Singapore is one of several overlapping regimes. The Protection from Scams Act 2025 allows restriction orders on banking facilities of people at risk of being scammed; we cover it in our guide to Protection from Scams Act restriction orders. The 2026 amendments also introduced new orders under that Act, such as account disabling and disclosure orders.
Content that is harmful but not criminal is addressed by other laws, including the Online Safety (Relief and Accountability) Act, covered in our explainer on online safety relief, and the Broadcasting Act's online safety codes. Falsehoods are handled under POFMA. Our online safety and content regulation practice page maps how they interact.
For individuals, the scams context also intersects with money mule offences, which we discuss in our note on money mule liability.
Illustrative scenario: a regional marketplace
This scenario is illustrative only and does not describe any real business or case.
A regional online marketplace with a growing Singapore user base is not currently designated under a code. It receives a Disabling Direction requiring it to remove several listings linked to a suspected scam. Its trust and safety team removes the listings within the deadline, preserves the data and logs the steps taken.
A seller whose listings were removed complains that its goods were genuine. The marketplace explains that the seller may apply for reconsideration within 30 days and keeps its own records in case the matter escalates. Meanwhile, the marketplace's legal team reviews the E-Commerce Code voluntarily, recognising that designation could follow as its user base grows, and begins aligning seller verification and payment protection with the code's requirements.
Cross-border platforms and the Online Criminal Harms Act in Singapore
Almost every designated service is operated by a group headquartered outside Singapore. The Online Criminal Harms Act in Singapore is drafted to reach them: directions focus on what people in Singapore can access or receive, and codes apply to designated services regardless of where the operator sits.
For international groups, the practical challenge is that Singapore requirements sit alongside parallel regimes elsewhere, such as the UK's online safety rules, EU platform regulation and anti-scam measures being developed across ASEAN. Controls such as advertiser verification or new-device login consent are often built once and deployed regionally, so it helps to design them to meet the strictest applicable standard.
Data retention and disclosure obligations also need care. Retaining data on scam accounts and responding to Singapore law enforcement requests must be reconciled with data protection rules and with any restrictions in other jurisdictions where the data is stored. Groups with operations in South Asia, the Gulf or the UK should agree an internal protocol for which entity responds to which request, and on what legal basis.
Risks and common mistakes
Treating a direction as a request
A direction under OCHA is a legal requirement, not a takedown notice that can be negotiated. Failing to comply can lead to an order and, ultimately, criminal liability. Platforms sometimes delay while debating whether the content is really criminal. The better course is to comply within the deadline and use the reconsideration process if you believe the direction was wrong. Keep the reasoning, evidence and timeline documented so that any challenge is well supported.
Missing the reconsideration window
The SPF states that applications for reconsideration must be made within 30 days of the date on the direction or order. Businesses that wait for an internal review to finish, or that assume someone else will challenge the direction, can lose the right to seek reconsideration and with it the route to the Reviewing Tribunal. Diarise the deadline as soon as a direction is received and decide early whether a challenge is worthwhile.
Under-documenting code compliance
Codes of practice are outcome-focused and risk-based, which means a platform will need to show how it has interpreted and implemented each requirement. Verbal assurances or scattered product tickets are weak evidence. A compliance register mapping each requirement to controls, metrics, owners and test results will help with annual reporting and with any Rectification Notice, and will matter more once administrative penalties of up to S$10 million per instance are available.
Forgetting the advertiser side
Businesses that advertise on designated platforms are indirectly affected. Advertiser verification against Government-issued records, scrutiny of embedded links and a bar on financial ads from unlicensed advertisers can delay or block campaigns. Marketing teams, agencies and regulated financial firms should prepare verification documents and licensing evidence in advance, and check that landing pages do not trigger scam filters through practices such as URL cloaking.
What to do now
- Designated platforms: complete a gap analysis against the relevant code and track remediation to 31 January 2027.
- Prepare an internal playbook for receiving, verifying and complying with OCHA directions.
- Diarise the 30-day reconsideration window for every direction received.
- Build a compliance register suitable for annual reporting and regulator queries.
- Advertisers: prepare identity and licensing evidence for platform verification.
- Monitor commencement of the Scams (Countermeasures) and Other Matters Act 2026 and the higher penalties.
For advice on the Online Criminal Harms Act in Singapore, from code compliance programmes to responding to a direction, see our white-collar crime practice page or contact TRW & Co.
Frequently asked questions
01What is the Online Criminal Harms Act?
The Online Criminal Harms Act 2023 gives Singapore authorities powers to deal with online activity used to commit crimes. Officers can issue directions requiring content to be removed or blocked, accounts restricted or apps removed. Designated online services must also comply with codes of practice requiring anti-scam and anti-malicious cyber activity safeguards. The direction powers took effect on 1 February 2024, and the first codes took effect on 26 June 2024.
02Which platforms are covered by the 2026 OCHA codes?
According to the SPF, the Messaging Code covers WhatsApp, Telegram, WeChat, Apple iMessage, Apple FaceTime, Google Messages and Google Meet. The Social Media Code covers Facebook, Instagram and TikTok. The enhanced E-Commerce Code covers Carousell, Facebook Marketplace and Facebook Business Pages. Requirements are applied according to each service's assessed scam risk, and waivers may be granted.
03When do the new OCHA codes take effect?
The codes were issued on 17 August 2026. Designated services must comply with the Messaging, Social Media and E-Commerce Codes by 31 January 2027. The Messaging Code's requirements on preventing spoofing of the Singapore Government had an earlier deadline of 30 September 2026. The existing Online Communication Services Code will be rescinded when the new codes take effect.
04How do I challenge an OCHA direction?
Recipients of a direction and, for some direction types, the owner of the affected account, app or online location or the originator of the material can apply for reconsideration. The SPF states that applications must be submitted no later than 30 days from the date on the direction or order, using the prescribed form. If reconsideration fails, an appeal lies to a Reviewing Tribunal made up of a District Judge or Magistrate.
05What are the penalties for platforms that do not comply?
Currently, failing to comply with a Rectification Notice without reasonable excuse can attract a fine of up to S$1 million plus up to S$100,000 per day for a continuing offence. Amendments passed in September 2026 will allow administrative penalties of up to S$10 million per instance of non-compliance with a code or implementation directive, and fines of up to S$10 million plus S$300,000 per day for failing to comply with a Rectification Notice or compliance order.
06Can OCHA directions be issued by AI?
Yes, once the 2026 amendments commence. MHA explained that directions may be issued by a computer program, including one using AI or machine learning, with the head of the agency using the program responsible for it. Lower-confidence decisions are subject to human assessment and audit checks. The existing appeal route of reconsideration and then the Reviewing Tribunal continues to apply.
Sources and official materials
- SPF: Issuance of Codes of Practice under the Online Criminal Harms Act — August 2026 codes, designated services, deadlines and penalties
- MHA: Commencement of the Online Criminal Harms Act on 1 February 2024 — Five direction types, thresholds and appeal route
- SPF: OCHA Application for Reconsideration — Who may apply and the 30-day time limit
- MHA: Second Reading of the Scams (Countermeasures) and Other Matters Bill — New penalty regime, AI-issued directions and information powers
- Online Criminal Harms Act 2023 — Full text of the Act on Singapore Statutes Online
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
