In this guide · 7 sections
Short answer
The code requires designated platforms (currently Carousell, Facebook Marketplace and Facebook Business Pages) to verify sellers and advertisers against government records, screen ads and confirm logins from new devices. Platforms must comply by 31 January 2027.
What SPF announced in August 2026
According to the SPF announcement of 18 August 2026, the police issued three Codes of Practice under the Online Criminal Harms Act on 17 August 2026: a new code for messaging and video-call apps, a new code for social media, and an enhanced code for e-commerce services. This guide covers the e-commerce one.
| Item | Detail |
|---|---|
| Law | Online Criminal Harms Act 2023 (OCHA) |
| Issued | 17 August 2026, announced 18 August 2026 |
| Platforms covered | Carousell, Facebook Marketplace, Facebook Business Pages |
| Compliance deadline | 31 January 2027 (six months for each section) |
| Current penalty | Up to S$1 million for ignoring a Rectification Notice, plus up to S$100,000 a day |
| Proposed penalty | Up to S$10 million per breach under amendments MHA proposed in August 2026 |
The original e-commerce code took effect in June 2024. SPF says scam cases on designated online services fell by about 37% between 2024 and 2025, and that the enhanced code builds on the existing seller verification and payment protection rules.
What the e-commerce code requires of platforms
The full text is in the Code of Practice for e-Commerce Services (PDF). The requirements that affect sellers most are:
- Seller verification: users who advertise or post about selling goods or services must be verified against government-issued records (section B7).
- Advertiser verification: advertisers must be checked against records such as business registration and identity documents before they can publish ads (B6).
- New-device logins: the account holder must consent before a login from a new or unrecognised device is allowed (B4), and platforms must strongly encourage MFA (B3).
- Verified accounts: platforms must offer a 'verified' status with stronger checks and explain how to get it (B5).
- Impersonation: content and accounts that impersonate a public figure, brand or business with a verified account must be detected and removed (A2).
- Ad screening: ads aimed at Singapore users are reviewed before publication, embedded links are monitored, and suspected scam ads are blocked or removed (A5 to A7, D2).
- Payment protection: buyers must have the option of payment that is released to the seller only after delivery is confirmed (C1).
- User reports: reports of scams or impersonation must be assessed and acted on within 24 hours (A3).
What it means for small online sellers
The code puts the duties on the platforms, so you do not have to file anything with the police. But you will feel it through the platforms' sign-up and ad processes, probably in stages before the January 2027 deadline.
Likely changes for you
- Identity or business registration checks before you can list or advertise
- Ad reviews that may slow down new campaigns
- Confirmation prompts when you log in from a new phone or laptop
- More buyers choosing protected payment over direct transfer
Why it can help you
- Fewer fake sellers undercutting you with scam listings
- A verified badge that tells buyers you are real
- Faster removal of accounts impersonating your shop
- A clear process to report copycat pages
If you sell under a registered business, make sure the name on your platform account matches your ACRA registration. Mismatches are what slow down verification.
The e-commerce scam numbers behind the code
The E-commerce Scams Situation Report for 1H 2026, published on 24 August 2026, shows why platforms are being pushed:
- E-commerce scams rose 19.3% to 3,865 cases in the first half of 2026, from 3,240 a year earlier.
- Losses rose 18.9% to about S$8.3 million.
- Facebook had the highest losses, about S$2.7 million; Carousell had the most cases, with about S$1.0 million lost.
- Pokémon trading card scams more than doubled to 605 cases, mostly pre-orders that never arrived.
The report also notes that some victims are sellers who hand over goods after buyers send fake payment screenshots. Always confirm payment in your bank or payment app, never from a screenshot.
What sellers should do before January 2027
Verify your seller and ad accounts now
Apply for verified status on Carousell and your Facebook Page as soon as it is offered, using the same business name and UEN as your ACRA record.
Turn on MFA and review logged-in devices
Use an authenticator app, not SMS, for your marketplace and Meta accounts. Remove old phones and laptops from the list of logged-in devices.
Check payments in your bank, not on screenshots
Ship only after you see the money in your bank or payment app, or use the platform's protected payment option.
Search for copycat accounts monthly
Search your shop name on each platform. Report fake pages through the platform's scam report, which must now be acted on within 24 hours.
Give buyers an official place to check you
A website on your own domain, with your UEN, contact details and links to your real social accounts, is the easiest way for a nervous buyer to confirm you are genuine.
Check whether your products need a licence before you list them; our guide to licences for selling online in Singapore goes product by product.
Do it yourself or get help?
Platform verification and MFA are quick to do yourself. A store on your own domain takes longer, and it is where the code's indirect benefit lands: buyers who are warier of marketplaces want somewhere official to check you, and you keep the customer relationship. Our guide to Shopify store costs in Singapore adds up the plan and app fees, and accepting PayNow on your website covers payment options.
If you want it built for you, our Shopify Store package (S$1,890) sets up a store with up to 30 products, cards and PayNow, shipping and policy pages on your own account. Online Payment Setup (S$290) adds Stripe or HitPay to an existing site.
Frequently asked questions
Not directly. The code applies to designated platforms, currently Carousell, Facebook Marketplace and Facebook Business Pages. Sellers feel it through stricter sign-up, identity checks, ad reviews and login confirmations on those platforms. You do not need to register or report anything to the police because of the code.
The enhanced code was issued on 17 August 2026 and came into operation that day, but platforms have six months from their application notice to put the systems in place. SPF's announcement gives 31 January 2027 as the compliance date for the designated e-commerce platforms, so expect changes to roll out before then.
They are not on the list of designated e-commerce platforms in SPF's August 2026 announcement, which names Carousell, Facebook Marketplace and Facebook Business Pages. The government can designate other services later, and many platforms run their own seller verification anyway, so keep your business details consistent everywhere.
Under the current framework, SPF's OCHA Office can issue a Rectification Notice, and ignoring it without reasonable excuse can lead to a fine of up to S$1 million plus up to S$100,000 a day. MHA proposed amendments in August 2026 that would allow penalties of up to S$10 million per breach.
Get your page or seller account verified, because the code requires platforms to detect and remove accounts impersonating verified brands and businesses. Report copycats through the platform's scam reporting tool, which must be acted on within 24 hours, and tell customers on your website which accounts are genuine.