In this guide · 8 sections
Short answer
FEDA licensees must keep a resident register (name, FIN, work pass, employer, room, occupancy dates), a visitor log, staff, feedback and briefing records for at least one year, alert MOM to serious incidents within 3 hours and report within 24 hours. Resident data falls under the PDPA.
Who needs a FEDA licence
MOM's FEDA licence page (updated 9 July 2026) says a company managing and maintaining dormitory premises that can house 7 or more migrant workers must hold a FEDA licence before it starts operating and accepting residents. Hotels, hostels, serviced apartments, HDB flats and private residential premises are among the exempt premises.
| Occupancy load | Licence class |
|---|---|
| 7 to 99 | Class 1 |
| 100 to 299 | Class 2 |
| 300 to 999 | Class 3 |
| 1,000 and above | Class 4 |
Applications and renewals go through the GoBusiness licensing portal. MOM asks for renewals at least 3 months before expiry and lists 30 working days as the processing time. New fee formulas apply to applications submitted from 1 April 2026.
Records the licence conditions require
The FEDA licence conditions (revised edition dated 1 September 2026) set out document retention under section 2. Licensees must keep the following for at least one year and make them available to the Commissioner on request.
| Record | What it must contain |
|---|---|
| Resident register | Name, nationality, sex, FIN or NRIC, work pass number and type, industry, workplace address; employer and sponsoring company details; occupancy start and expiry dates, room number, mode of transport to work |
| Visitor and non-resident log | Name, contact number, date and time in and out, purpose, company, last four digits of NRIC, FIN or work pass, occupation title |
| Staff register | Names, designations, responsibilities, NRIC numbers, phone numbers and photographs of the licensee's dormitory staff |
| Outsourced services | Up-to-date records of outsourced cleaning, laundry, security and similar services |
| Feedback and grievances | Feedback received and the measures taken, kept for at least one year |
| Rules briefings | Residents' attendance at house-rules briefings held within 7 days of moving in |
Condition 2.1.8 adds that, on request, the licensee must submit this information to the Commissioner in the form, manner and frequency specified. In practice that means the data should be exportable quickly, not scattered across notebooks and personal phones.
Reporting deadlines operators must meet
Several conditions carry tight deadlines, so whoever is on duty needs the contact details and templates ready.
- Serious incident affecting residents' safety, security or well-being: alert MOM within 3 hours of discovery (MOM's page gives the MOM_ACE_Ops_Centre@mom.gov.sg address) and submit an incident report within 24 hours.
- Change in licence application information: notify MOM within 14 days.
- Evicting or locking out residents: notify at least 21 days before.
- Changes of directors, legal structure or name: seek MOM's approval first.
- Events on religious, race-related or political topics: apply for approval at least 30 days before.
Separately, MOM's employer guidance requires employers of Work Permit holders to update residential addresses within 5 days of a change. That duty sits with the employer, but operators who share move-in and move-out data promptly make it easier for employers to comply.
Resident data and the PDPA
The resident register holds FIN numbers, work pass details, employers and room numbers for hundreds or thousands of people. Under the PDPA you must protect it, use it only for the purposes residents were told about, and not keep it longer than needed.
PDPA checklist for dormitory operators
PDPC's NRIC guidelines also cover FIN numbers: collect the full number only where the law requires it or where you need to identify someone to a high degree of accuracy. Our guides to employee personal data under the PDPA and visitor management systems go further.
What a resident management system should do
Off-the-shelf property tools rarely match the FEDA register fields. Whether you buy or build, check the system against the licence conditions rather than a sales brochure.
Spreadsheet and paper log
Common today- No cost to start
- Hard to keep up to date across shifts
- Weak access control and audit trail
- Slow to export when MOM asks
Best for: Very small Class 1 dormitories only.
Dedicated resident system
Recommended- Register fields match the licence conditions
- Visitor check-in by tablet with last-four-digit capture
- Role-based access and an audit log
- One-click export of register, visitors and feedback
Best for: Class 2 and above, or any operator with several sites.
Useful extras include a feedback and fault-reporting channel residents can use from a phone, room allocation that keeps the register in sync, and an incident template that starts the 3-hour and 24-hour clocks.
Security basics for dormitory systems
Systems holding resident data attract the same attacks as any business: phishing, stolen passwords and lost devices. Use MFA on every admin account, keep the register in a hosted system rather than on a guardhouse PC, back it up, and remove access the day a staff member or security contractor leaves.
Do it yourself or get help?
Start by mapping your current registers against the licence conditions table above. Gaps in the visitor log, feedback records and briefing attendance are the most common.
Our Custom Business App (from S$4,900) builds a resident register, visitor log, feedback channel and exports in one browser-based system, hosted in your account with the data yours. The PDPA Compliance Pack (S$690) covers the privacy notice, data inventory, staff policy and breach plan. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page. We are not lawyers; confirm licence requirements with MOM.
Frequently asked questions
MOM says companies managing and maintaining dormitory premises that can house 7 or more migrant workers need a FEDA licence before operating and accepting residents. Premises such as hotels, hostels, serviced apartments, HDB flats and private residential premises are exempt. Applications go through the GoBusiness licensing portal.
The FEDA licence conditions require the resident register, visitor log, staff register, outsourced service records, feedback records and briefing attendance to be kept for at least one year and produced on request. Under the PDPA, review and delete records once they are no longer needed for those or other legal purposes.
For non-residents entering the living areas, the licence conditions list name, contact number, date and time of entry and exit, purpose, company if applicable, occupation title, and only the last four digits of the NRIC, FIN or work pass number. Collecting full ID numbers for visitors goes beyond what the conditions ask for.
For a serious incident affecting the safety, security or well-being of residents, the licensee must manage it, alert emergency authorities if needed, alert MOM within 3 hours of discovery, and submit an incident report within 24 hours. MOM's FEDA page lists the email address for alerts.
Yes. FIN numbers, work pass details, employers, rooms and photos of residents are personal data. The operator must protect them, use them only for notified purposes, limit access, and keep them no longer than needed. PDPC's guidelines on NRIC and similar numbers also apply to FIN numbers. This is general information, not legal advice.