Singapore's Parliament passed the Scams (Countermeasures) and Other Matters Bill on September 9, 2026, capping a five-week process that began when the Ministry of Home Affairs (MHA) tabled it for First Reading on August 4. The bill amends the Online Criminal Harms Act 2023 (OCHA) and the Protection from Scams Act, and it does two very different things at once: it makes platform non-compliance dramatically more expensive, and it hands police three new powers to act on private accounts without a warrant.
What Actually Changed
The headline number is the fine increase. Under Section 51(3) of OCHA as originally enacted, a service provider that failed to comply with a directive from the Competent Authority faced a maximum fine of S$1 million, plus S$100,000 for each day a continuing violation went uncorrected. The new bill raises both ceilings tenfold: up to S$10 million per violation, plus S$300,000 per additional day — what MHA and multiple outlets have called the highest fixed-quantum financial penalty in Singapore's statute book (MHA, First Reading press release; The Star).
It's worth being precise about who enforces this, because it's commonly misattributed. OCHA's Competent Authority sits within the Singapore Police Force under MHA — not the Infocomm Media Development Authority (IMDA), which administers a separate, content-focused Online Safety Code. The two regimes cover different designated services and different harms (scam facilitation versus harmful content exposure), and conflating them understates how fragmented Singapore's platform-regulation landscape has become. Providers currently designated under OCHA's Codes of Practice include Facebook, WhatsApp, Instagram, Telegram, WeChat, and Carousell (MHA, June 2024 press release).
Alongside the fine hike, the bill creates three new police orders: a disclosure order compelling a provider to hand over account and activity information; an account-disabling order suspending a user's account for up to 30 days, extendable once for another 30; and a service-limitation order cutting a flagged individual off from financial, telecom, or Singpass services for up to three years. It also newly criminalizes acting as an "account mule" — supplying or buying online accounts for criminal use — with penalties up to three years' jail, a S$10,000 fine, and up to 12 strokes of the cane (AsiaOne; Fintech Singapore).
The Case for It
The strongest argument for the fine increase is straightforward deterrence economics. A S$1 million ceiling is a rounding error for Meta, Google, or TikTok — smaller than a single quarter's Singapore ad revenue for most designated providers. If a Code of Practice is going to actually shape platform behavior rather than just exist on paper, the penalty has to be large enough that ignoring it is a worse bet than complying. Singapore's own numbers make the urgency legible: police were fielding roughly 90 scam reports a day, representing about S$2 million in losses daily, with victims losing S$410.6 million in the first half of 2026 alone (The Star). A regulator watching losses at that scale is not overreacting by asking platforms to actually implement the account-verification and scam-detection systems they already agreed to under the 2024 Codes of Practice.
Where the Bill Overreaches
But the fine increase is not the part that should worry civil libertarians — it's a compliance-incentive tweak on an existing framework, appealable to the Minister for Home Affairs, and aimed at corporate entities with legal departments built for exactly this kind of dispute. The account-disabling and service-limitation orders are a different category of power entirely: they let police suspend a person's digital and financial life — messaging accounts, bank access, even Singpass, Singapore's national digital identity system — for up to 30 or 90 days combined, or three years for service limitation, without prior judicial authorization. The only recourse is an appeal to the Commissioner of Police, whose decision is final (AsiaOne). That is the same official issuing the order reviewing his own agency's decision — not independent oversight.
This matters because OCHA's designated-service list already spans the communications infrastructure most Singaporeans depend on daily: WhatsApp, Telegram, Instagram. A 30-to-60-day account freeze imposed on the wrong person — a scam victim misidentified as a mule, a small merchant caught in a Carousell dispute — is not a minor inconvenience corrected on appeal; it is weeks without access to primary communication and payment tools, with the burden of proof effectively reversed onto the user to get the order lifted.
The Right Fix
Singapore doesn't need to choose between fighting a genuine S$410 million-a-half-year scam problem and preserving due process. The fine increase should stand — it's proportionate to the harm and falls on well-resourced corporate actors with existing appeal rights. But the account-disabling and service-limitation orders need an independent check before they bite, not after: a fast-track judicial or tribunal sign-off within 24-48 hours, mirroring how Singapore already handles urgent Protection from Harassment Act orders, rather than routing appeals back through the same police hierarchy that issued them. Parliament got the economics of platform deterrence right. It should revisit the due-process gap before these orders start hitting people who turn out not to be scammers at all.