In this guide · 7 sections
- 01Key dates and status as of October 2026
- 02New offences for misusing online accounts, including by companies
- 03Police orders that can affect your business accounts
- 04Bigger penalties for platforms, and why it matters to you
- 05Practical controls for staff and finance
- 06Do it yourself or get help?
- 07Frequently asked questions
Short answer
The Act makes it an offence to supply, receive or retain a WhatsApp, Telegram, Facebook or similar account for unlawful use, with double fines for companies. It also lets police order accounts disabled for up to 30 days. It starts on a date to be gazetted.
Key dates and status as of October 2026
The Bill (No. 16/2026) was published on 4 August 2026. Senior Minister of State Goh Pei Ming moved the second reading on 8 September 2026, and the Bill was passed on 9 September.
| Date | Step | Source |
|---|---|---|
| 4 Aug 2026 | Bill No. 16/2026 read the first time and published | Singapore Statutes Online |
| 8 Sep 2026 | Second reading speech by SMS Goh Pei Ming | MHA |
| 9 Sep 2026 | Passed by Parliament | Act 21 of 2026 |
| 24 Sep 2026 | Assented to by the President | Act 21 of 2026 |
| 29 Sep 2026 | Act published in the Government Gazette | Act 21 of 2026 |
| To be announced | Comes into operation by Gazette notification | Section 1 of the Act |
Section 1 of the published Act says it comes into operation on a date the Minister appoints by notification in the Gazette. As at 20 October 2026 we did not find a commencement notification, so check Singapore Statutes Online before relying on any provision.
New offences for misusing online accounts, including by companies
This is the part most relevant to employers. MHA said people have been selling online accounts, sometimes Singpass-verified, to scammers. The Act adds offences to the Miscellaneous Offences (Public Order and Nuisance) Act for accounts on "designated online services". MHA named the currently designated services under the Online Criminal Harms Act as WhatsApp, Telegram, WeChat, Apple, Google, Carousell, Facebook, Instagram and TikTok.
- Supplying or offering to supply a designated online account to someone else, knowing or having reasonable grounds to believe it will be used unlawfully.
- Providing personal information or consenting to its use so someone else can open such an account, with the same knowledge.
- Receiving an account, or retaining control of one opened with another person's details, intending to use or supply it unlawfully.
The law presumes guilty knowledge in some cases: if the account was supplied for any gain, or if the person did not take reasonable steps to find out who was receiving it, where they were, or why they wanted it. MHA said someone who sets up a WhatsApp account for a parent or child for genuine daily use may have reasonable grounds; someone who does it for a paying stranger with no questions asked likely does not.
| Who | Maximum penalty (per MHA) | Repeat offence |
|---|---|---|
| Individual | Fine up to S$10,000, jail up to 3 years, or both | Fine up to S$20,000, jail up to 5 years, or both |
| Company or association | Double the individual fine | Double the individual fine |
Police orders that can affect your business accounts
The Act adds new orders under the Protection from Scams Act 2025. They are issued to service providers such as banks, telcos, digital payment token providers and online services, but the accounts they act on could be yours.
| Order | What it does | Limits and appeal |
|---|---|---|
| Account Disabling Order | Directs a provider to disable an account police suspect is, or will be, used for a scam-related offence | Up to 30 days, one extension of up to 30 days; appeal to the Commissioner of Police |
| Disclosure Order | Directs a provider to disclose information about an account | Police must be satisfied it is needed to prevent a scam offence |
| Service Limitation Order | Requires providers to restrict services to a person | Up to 3 years; appeal to the Commissioner of Police |
For a small business, the practical risk is a shared or poorly controlled account, such as a company WhatsApp number on an ex-employee's phone, being used by someone else and then disabled. Keeping clear ownership records makes an appeal much easier.
Bigger penalties for platforms, and why it matters to you
The Act also amends the Online Criminal Harms Act. MHA said the Competent Authority will be able to impose an administrative penalty of up to S$10 million per instance on designated online services that breach anti-scam Codes of Practice or Implementation Directives, and courts can fine up to S$10 million plus up to S$300,000 a day for continuing offences. Directions to take down scam content can also be issued by a computer program, including AI, with the agency head accountable.
Expect faster and more automated takedowns and account checks on these platforms. If your business advertises or sells on them, keep proof of identity, business registration and account ownership ready in case your page or listing is flagged by mistake.
Practical controls for staff and finance
None of these need the Act to be in force. They reduce both scam losses and the chance of your accounts being caught up in an investigation. Our 1H 2026 scam statistics guide shows which scam types are hitting businesses most.
Account and payment controls
See our guides on government official impersonation scams and corporate bank account safeguards for scripts and bank settings.
Do it yourself or get help?
An account register and a payment call-back rule are an afternoon's work for most small businesses. Help is useful when you have many staff on customer-facing accounts, or no written plan for what to do if an account is taken over or disabled.
IT Sorted is a Singapore-based team of developers with over 10 years of experience. Security Awareness Training (S$390) covers account sharing, code theft and impersonation scams for your staff, and an Incident & Ransomware Response Plan (S$390) gives you a written who-does-what plan for account takeovers and scam payments. For questions on how the law applies to you, speak to a lawyer.
Frequently asked questions
Parliament passed it on 9 September 2026, after the second reading speech on 8 September. The President assented on 24 September 2026, and it was published in the Government Gazette as the Scams (Countermeasures) and Other Matters Act 2026 (No. 21 of 2026) on 29 September 2026.
Section 1 says it comes into operation on a date the Minister appoints by notification in the Gazette. As at 20 October 2026 we did not find a commencement notification. Check Singapore Statutes Online for the current status, as different parts may start on different dates.
Yes. MHA said all the new offences for misusing online accounts also apply to corporations and unincorporated associations. Because they cannot be jailed or caned, the maximum fines for entities are double those for individuals. That makes clear account ownership and staff rules on account sharing worth putting in writing.
It is a new police order under the Protection from Scams Act. Police can direct a service provider to disable an account they suspect has been or will be used for a scam-related offence. The account can be disabled for up to 30 days, with one extension of up to another 30 days. Affected persons can appeal to the Commissioner of Police.
The offences apply to accounts on online services designated under the law. In the second reading speech, MHA said the services currently designated under the Online Criminal Harms Act are WhatsApp, Telegram, WeChat, Apple, Google, Carousell, Facebook, Instagram and TikTok. The list can change, so check the current designations.